Retail stores use Bluetooth beacons to track customers • Hacker News Board

Re: Retail stores use Bluetooth beacons to track customers

#161

Post by fingerlocks » Fri, Jun 14, 2019, 9:06 PM UTC

pariahHN wrote: post #151

AndrewKemendo wrote: post #92

Earlier quoted context omitted.

Yes that's exactly how this gets implemented in practice. I did quite a bit of client work here too, specifically around using already existing surveillance camera networks to build user profiles. At the end of the day the goal is to optimize for the intersection of "what the user wants" and "what we want to sell." So, a low collection system will give bad recommendations and a really good recommendation system will…

Part of the problem I think is that these people don't actually comprehend what is happening and the possible consequences. To them it's just a magic black box.

Maybe I’m one of these people. What exactly are the consequences? So far, the most damaging consequence of overreaching customer privacy is the famous teenage pregnancy leak when Target sent out coupon mailers to expecting moms based on shopping history.

That’s a really weirdly specific issue, and hard to imaging a similar scenario that would affect my life in some equally horrible way.

Am I missing something? Why should I be so afraid of Home Depot or whatever knowing a little bit about me?

Re: Retail stores use Bluetooth beacons to track customers

#162

Post by dpkonofa » Fri, Jun 14, 2019, 9:12 PM UTC

pariahHN wrote: post #151

AndrewKemendo wrote: post #92

Earlier quoted context omitted.

Yes that's exactly how this gets implemented in practice. I did quite a bit of client work here too, specifically around using already existing surveillance camera networks to build user profiles. At the end of the day the goal is to optimize for the intersection of "what the user wants" and "what we want to sell." So, a low collection system will give bad recommendations and a really good recommendation system will…

Part of the problem I think is that these people don't actually comprehend what is happening and the possible consequences. To them it's just a magic black box.

This is, in general, the problem with America and other countries, in my opinion. Technical literacy is extremely low for the level of technical sophistication present in everyone's everyday life. I know it's not great in other countries but I think America has it worse in a lot of ways because our society encourages companies to take advantage of people in every way imaginable and lawmakers are possibly even less tech savvy than the majority of the population. People don't actually understand the consequences of their actions (agreeing to ToS, giving Facebook their data, using Amazon Echo/Google Home, etc.) and so they can't actually make an informed decision. The EU, at the very least, has attempted to make this conversation more public through the GDPR, but America is too self-involved to even consider educating the populace.

Re: Retail stores use Bluetooth beacons to track customers

#163

Post by tacLog » Fri, Jun 14, 2019, 9:14 PM UTC

move-on-by wrote: post #158

tacLog wrote: post #145

Earlier quoted context omitted.

I do wifi tracking for a living and no there is no off the shelve solution for consumers that I have ever seen. You can accomplish this with a raspberry pi, a wifi adapter that supports monitor mode, and tcpdump set to the right filters. However, I don't see why anyone ever would. As others have mentioned many of the top wifi brands, Cisco, Aruba, and Meraki (now owned by Cisco) provide this kind of information to cl…

Built-in RaspberryPi WiFi can do monitor mode. Kali Linux even has a raspberry pi image. RaspberryPi also has built in Bluetooth that supports 4.1 and low energy. Since Bluetooth is a less powerful signal, is there anything I could do with that?

I haven't tried to track phones with bluetooth, it seems like it wouldn't be possible because phones aren't always announcing themsleves. A by product of battery limitations I would guess. The more common use is tracking powered tags for the purpose of asset tracking in say hospitals or similar.

I didn't know the onboard adapter supported monitor mode, that is ligitmately useful knownledge for me. Thanks, it should be simple to build your own sniffer to just plan around with. Carefull if you are in the EU though, not that it is removely possible to catch a silent sniffer.

Re: Retail stores use Bluetooth beacons to track customers

#164

Post by dpkonofa » Fri, Jun 14, 2019, 9:15 PM UTC

fingerlocks wrote: post #161

pariahHN wrote: post #151

Earlier quoted context omitted.

Part of the problem I think is that these people don't actually comprehend what is happening and the possible consequences. To them it's just a magic black box.

Maybe I’m one of these people. What exactly are the consequences? So far, the most damaging consequence of overreaching customer privacy is the famous teenage pregnancy leak when Target sent out coupon mailers to expecting moms based on shopping history. That’s a really weirdly specific issue, and hard to imaging a similar scenario that would affect my life in some equally horrible way. Am I missing something? Why sh…

It's not that you should necessarily be afraid of it but rather that you should be more aware of it. Advertising is now weaponized to the point that companies can take advantage of people through psychological tricks to get them to disadvantage themselves just to make a sale. Imagine the housing crisis amped up to an order of magnitude. Transactions, theoretically, should be based on good faith from both parties. If a business has far more insight into you than you have into them, though, then nearly every transaction has the potential to be predatory.

Re: Retail stores use Bluetooth beacons to track customers

#165

Post by dpkonofa » Fri, Jun 14, 2019, 9:17 PM UTC

reaperducer wrote: post #116

ganoushoreilly wrote: post #97

Earlier quoted context omitted.

I've used systems that leverage passive detection of Bluetooth, Wifi, and other radio signals as an indicator. No Apps required. Tying beacons into points of authentication (login from workspace) or transactional data at a register. A large portion of it was actually focused around security and not product marketing, but the tech is the same.

Tying beacons into points of authentication Reminds me of an old Mac application from PowerPC days that would sense your phone's Bluetooth coming into the room and automatically unlock your computer. I thought it was pretty cool. Current Macs have that possibility built-in, but it only works with the Watch.

>Current Macs have that possibility built-in, but it only works with the Watch.

Maybe built-in to the OS. You can definitely do this with any Bluetooth device and any Mac with both free and paid software.

Re: Retail stores use Bluetooth beacons to track customers

#166

Post by Mediterraneo10 » Fri, Jun 14, 2019, 9:17 PM UTC

nxcho wrote: post #107

umvi wrote: post #77

What I don't get is: 1. Pretend it's the 1900s. Walk into a general store, shopkeeper sees you looking at ammo for 20 minutes and then leave without buying anything. Next time you walk in, he recognizes you and says he'll give you a discount on ammo if you buy in bulk. This is totally cool, not a violation of privacy, and both parties benefit. win/win 2. Use a computer to do the same exact thing automatically Rage, p…

1. Pretend it is the 1970s in East Berlin and someone follows you around, noting down every interaction you have with other humans and every bit of media you consume and collects this information in a file somewhere for future use. This is the horrifying and oppressive surveillance machine of a paranoid dictatorship. 2. Use a computer to the the exact thing automatically today. This is just the natural state of the w…

There is a clear difference between 1970s East Berlin and now. Stasi spying propped up a system that provided a relatively low standard of living and a limited availability of consumer goods. Modern tracking of customers fuels a vibrant customer-good market that is a win-win for everyone.

Re: Retail stores use Bluetooth beacons to track customers

#167

Post by dpkonofa » Fri, Jun 14, 2019, 9:20 PM UTC

r00fus wrote: post #71

eunoia wrote: post #53

Earlier quoted context omitted.

> If devices using iOS 13 start broadcasting a constantly changing bluetooth ID They've always done this. I think you have your threat model inverted. Beacons aren't tracking phones around stores. 3rd party SDKs installed in apps are tracking user's indoor location via beacon triangulation and uploading that data. A subtle, but important difference.

Shouldn't Apple ban apps using those SDKs? Is it identifiable from a source scan or binary trawl?

The issue is that there are legitimate uses for this type of code, though. For example, I have my home set up with tons of automations that change, for example, the color of the lights when I'm in the kitchen vs. when my wife is in the kitchen. She prefers warm lighting and I prefer the daytime lighting. It's the same technology, it's just being misused in these commercial instances, in my opinion. People don't actually know that they're agreeing to this type of usage.

Re: Retail stores use Bluetooth beacons to track customers

#168

Post by social_quotient » Fri, Jun 14, 2019, 9:20 PM UTC

dpkonofa wrote: post #162

pariahHN wrote: post #151

Earlier quoted context omitted.

Part of the problem I think is that these people don't actually comprehend what is happening and the possible consequences. To them it's just a magic black box.

This is, in general, the problem with America and other countries, in my opinion. Technical literacy is extremely low for the level of technical sophistication present in everyone's everyday life. I know it's not great in other countries but I think America has it worse in a lot of ways because our society encourages companies to take advantage of people in every way imaginable and lawmakers are possibly even less te…

Agreed. I feel like if I had to classify the issue “technical literacy” would be the root problem and solution.

Re: Retail stores use Bluetooth beacons to track customers

#169

Post by dpkonofa » Fri, Jun 14, 2019, 9:23 PM UTC

givinguflac wrote: post #126

andrewgioia wrote: post #24

This is rage inducing. I went into this article thinking "ok as long as I don't have the Target or Ikea or whatever app installed on my phone, I'm fine." While that is a primary way, this needs to be outlawed: > These companies take their beacon tracking code and bundle it into a toolkit developers can use. The makers of many popular apps, such as those for news or weather updates, insert these toolkits into their ap…

iOS 13 actually has BT permissions per-app, and blocking that has no bearing on bt audio as that’s handled on the system level. It’s quite eye opening. Netflix for example wants access to BT even though there is absolutely no Netflix accessory that would warrant such access. I’m pretty thrilled about the change and it only cements my choice of iOS for me.

That still won't change much, though, because, inevitably, there will be some app that requires Bluetooth for some fundamental aspect of its use that will also use one of these SDK's. Granting that app access to this will give it all the info it needs. What really needs to happen is that Apple needs to make some of these beacon-able permissions more granular. How to do that in a way that a tech-naive population understands what's happening is a very difficult problem to solve, though.

Re: Retail stores use Bluetooth beacons to track customers

#170

Post by LamaOfRuin » Fri, Jun 14, 2019, 9:32 PM UTC

fingerlocks wrote: post #161

pariahHN wrote: post #151

Earlier quoted context omitted.

Part of the problem I think is that these people don't actually comprehend what is happening and the possible consequences. To them it's just a magic black box.

Maybe I’m one of these people. What exactly are the consequences? So far, the most damaging consequence of overreaching customer privacy is the famous teenage pregnancy leak when Target sent out coupon mailers to expecting moms based on shopping history. That’s a really weirdly specific issue, and hard to imaging a similar scenario that would affect my life in some equally horrible way. Am I missing something? Why sh…

As a more serious and well-known concrete threat, this type of data is regularly aggregated by data brokers, and then used by stalkers and domestic abusers to commit crimes.

I imagine it being available and cheaply for sale is also a boon for various financial crimes/fraud.

It's not home depot specifically to be worried about knowing a little about you, but about them not being competent to control that data and everyone's little bit becoming a lot more significant and dangerous when combined.

edit: Also, the same type of information can easily be used later by government. I imagine if Uyghurs were not being specifically targeted by the Chinese government for cultural extermination there would be little trouble in their cultural identity being discernible from certain purchasing profiles. Once they are rounded up into camps, the last 15 years of detailed surveillance about them becomes very troublesome for them.