Retail stores use Bluetooth beacons to track customers • Hacker News Board

Re: Retail stores use Bluetooth beacons to track customers

#71

Post by r00fus » Fri, Jun 14, 2019, 6:34 PM UTC

eunoia wrote: post #53

madMapper wrote: post #40

Earlier quoted context omitted.

Now that the privacy pendulum is swinging the other way I'm curious if Apple will ultimately be the undoing of this thing they helped create. If devices using iOS 13 start broadcasting a constantly changing bluetooth ID as a part of the new "Find My" feature these systems won't be able to track users from beacon to beacon or know how long you were in range of a single beacon. This will probably wreak havoc on traffic…

> If devices using iOS 13 start broadcasting a constantly changing bluetooth ID They've always done this. I think you have your threat model inverted. Beacons aren't tracking phones around stores. 3rd party SDKs installed in apps are tracking user's indoor location via beacon triangulation and uploading that data. A subtle, but important difference.

Shouldn't Apple ban apps using those SDKs? Is it identifiable from a source scan or binary trawl?

Re: Retail stores use Bluetooth beacons to track customers

#72

Post by TeMPOraL » Fri, Jun 14, 2019, 6:35 PM UTC

cortesoft wrote: post #43

dTal wrote: post #28

>Location marketing aims to understand “online-offline attribution.” If a Starbucks coffee ad is sent to your email, for example, marketers want to know if you actually went there and bought a coffee. The only way to know is to monitor your online and offline habits at all times. Make no mistake: the purpose of marketing is to maximize information asymmetry. The natural end point is totalitarian: they know everything…

That is not the purpose of all marketing. That might be the purpose of this kind of tracking, but I don't think telling people the product you created to serve their need is inherently evil. At its best, marketing is a way to let people know the goods and services you have that can make their lives better. This is marketing at its worst. I really enjoy this explanation of why targeted advertising is such a horrible t…

> This is marketing at its worst.

This is marketing at its real. As practiced.

> I don't think telling people the product you created to serve their need is inherently evil.

Of course it isn't evil, but this is not what marketing is doing - and claiming so amounts to a motte-and-bailey defense of an industry that's rotten to the core and quite openly malicious towards their fellow human beings.

Re: Retail stores use Bluetooth beacons to track customers

#73

Post by vertoc » Fri, Jun 14, 2019, 6:36 PM UTC

wkavey wrote: post #58

I actually implemented a nearly identical system for my senior design project, except we targeted the smart home ecosystem. Basic use cases would be automatically turning on/off lights or having a music stream/temperature preference/... follow you as you move throughout your house and enter/leave rooms. All implemented by an app on your phone detecting strategically placed beacons.

Haha I did a very similar thing for mine - it was using these to replace clock in systems for hourly workers, no more need to clock in or out, the app would auto detect when you entered/left the building

Re: Retail stores use Bluetooth beacons to track customers

#74

Post by TeMPOraL » Fri, Jun 14, 2019, 6:37 PM UTC

dawnerd wrote: post #10

I didn't know it was a secret? Figured it was pretty common knowledge back when iBeacons and similar were announced and when major retailers like Target even made press releases about it https://techcrunch.com/2017/09/20/target-rolls-out-bluetooth... Kind of funny that Apple pushing privacy basically helped create this kind of tracking to begin with. Edit: NYT article mentions other apps selling data to retailers. I…

The less-known part is the widespread practice among app authors to just include random adtech SDKs that do all this evil stuff.

Re: Retail stores use Bluetooth beacons to track customers

#75

Post by eunoia » Fri, Jun 14, 2019, 6:37 PM UTC

r00fus wrote: post #71

eunoia wrote: post #53

Earlier quoted context omitted.

> If devices using iOS 13 start broadcasting a constantly changing bluetooth ID They've always done this. I think you have your threat model inverted. Beacons aren't tracking phones around stores. 3rd party SDKs installed in apps are tracking user's indoor location via beacon triangulation and uploading that data. A subtle, but important difference.

Shouldn't Apple ban apps using those SDKs? Is it identifiable from a source scan or binary trawl?

I think so, seems to be the logical progression of their crackdown on particularly egregious 3rd party analytics implementations.

Re: Retail stores use Bluetooth beacons to track customers

#76

Post by LeifCarrotson » Fri, Jun 14, 2019, 6:38 PM UTC

Maybe the existence of such toolkits is a Chesterton's Fence that says you can't make this work without something installed on the phone. But this would be possible without these trojans.

If the Bluetooth beacon configures itself as a master, and enters inquiry mode, phones that pass nearby will happily respond with their Bluetooth ID (see https://www.bluetooth.org/docman/handlers/downloaddoc.ashx?d..., section 8.4).

You can also do the same with Wifi access points: Phones are constantly broadcasting their MAC address during active scanning for networks. The location from signal strength isn't as good (a Bluetooth beacon can pin you down near the Yoplait yogurt, a Wifi beacon and signal strength measurement just put you in dairy) but it's getting better (worse?). See: https://www.crc.id.au/tracking-people-via-wifi-even-when-not...

I imagine it would not be perfect but would be acceptably easy to use these "anonymous" MAC addresses to connect you to a name and address on a debit card. If your MAC and 20 other people left the store Friday at 2PM, and you and 20 other people went through checkout, and then your MAC and checkout are seen with 20 different people next week it's pretty trivial to identify you.

The cynic in me, though, says that even a minor loss of fidelity in tracking data weighed against the minimal risk and cost of building the spyware makes it worth building both.

Re: Retail stores use Bluetooth beacons to track customers

#77

Post by umvi » Fri, Jun 14, 2019, 6:40 PM UTC

What I don't get is:

1. Pretend it's the 1900s.

Walk into a general store, shopkeeper sees you looking at ammo for 20 minutes and then leave without buying anything. Next time you walk in, he recognizes you and says he'll give you a discount on ammo if you buy in bulk.

This is totally cool, not a violation of privacy, and both parties benefit. win/win

2. Use a computer to do the same exact thing automatically

Rage, pitchforks and proverbial molotov cocktails and people going on privacy diatribes.

What's the difference?

Re: Retail stores use Bluetooth beacons to track customers

#78

Post by TeMPOraL » Fri, Jun 14, 2019, 6:40 PM UTC

_bxg1 wrote: post #63

ajkjk wrote: post #8

Nothing would make me want to buy yogurt less than an ad on my phone while I'm looking at yogurt. I would hope everyone would feel the same way, to disincentivize this.

The best way to protest surveillance capitalism is to make it ineffective. If you get a pushy or creepy ad, go out of your way to avoid that product or brand. Even if it is appealing to you. Even if it's a good deal. Send the strongest kind of signal against targeted ads: money.

I do whenever I can. For instance, for close to a decade now I maintain a blanket ban on Groupon for that one time they spammed me with retargeted ads a bit too hard (3+ same ugly pink ads simultaneously on a single webpage).

Re: Retail stores use Bluetooth beacons to track customers

#79

Post by nerdponx » Fri, Jun 14, 2019, 6:41 PM UTC

_b8r0 wrote: post #54

andrewgioia wrote: post #24

This is rage inducing. I went into this article thinking "ok as long as I don't have the Target or Ikea or whatever app installed on my phone, I'm fine." While that is a primary way, this needs to be outlawed: > These companies take their beacon tracking code and bundle it into a toolkit developers can use. The makers of many popular apps, such as those for news or weather updates, insert these toolkits into their ap…

If this is rage inducing, you're going to lose your mind when you find out what companies have been doing with tracking phone location via GSM.

And this, too, should be illegal.

Re: Retail stores use Bluetooth beacons to track customers

#80

Post by TeMPOraL » Fri, Jun 14, 2019, 6:42 PM UTC

LeifCarrotson wrote: post #76

Maybe the existence of such toolkits is a Chesterton's Fence that says you can't make this work without something installed on the phone. But this would be possible without these trojans. If the Bluetooth beacon configures itself as a master, and enters inquiry mode, phones that pass nearby will happily respond with their Bluetooth ID (see https://www.bluetooth.org/docman/handlers/downloaddoc.ashx?d... , section 8.4)…

> Maybe the existence of such toolkits is a Chesterton's Fence that says you can't make this work without something installed on the phone. But this would be possible without these trojans.

Without these trojans the store would have on its hands a major networking infrastructure project. With these trojans, all they have to do is drop a few battery-powered beacons in their venue and store their IDs along with coordinates in a database.