Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Retail stores use Bluetooth beacons to track customers

nytimes.com

Post reply on HN
Print view View original

211–220 of 257 posts

Re: Retail stores use Bluetooth beacons to track customers

#211

Post by jschwartzi »

gruez wrote: post #209
jonahhorowitz wrote: post #130

Earlier quoted context omitted.

And when you swipe your card to check out they have your name, even if you don't use a loyalty card. Name + Face, along with some bluetooth tracking data. They can now track you forever, even if you delete the app, stop using your credit cards, etc.

>And when you swipe your card to check out they have your name, even if you don't use a loyalty card I thought the name’s embossed on the card, but not on the magstripe/EMV chip data?

It's very much encoded in the track data. It may not be in clear-text by the time it leaves the reader but it's encoded in the data.

Re: Retail stores use Bluetooth beacons to track customers

#212

Post by xur17 »

imperialdrive wrote: post #210
xur17 wrote: post #55

Earlier quoted context omitted.

I really wish android differentiated between foreground and background location permissions.

Meet the newest Android Q (10) which is available as a beta. The permission levels are there for what you wish. It's impressive to see just how many apps were previously getting background location (and many other) permissions by default. Eye opening experience for someone that figured it wasn't that bad.

That is very good to hear - excited to try it out.

Re: Retail stores use Bluetooth beacons to track customers

#213

Post by jschwartzi »

ej3 wrote: post #193
bdz wrote: post #9

Apple's iBeacon location-aware shopping goes live today (2013) https://www.theverge.com/2013/12/6/5181302/apple-store-ibeac... Beacon Technology Arrives in 50 Target Stores (2015) https://corporate.target.com/article/2015/08/beacon-technolo...

I was working with Target when they did this roll-out. As sinister as everyone here seems to make it sound, I can assure you at that time it was not . If you're familiar with the inception of corporate projects, this project was no exception to any of the stereotypical fumbles and foibles of any effort of this scale. It began simply because Apple said "...iBEACON.." and everyone corporate wanted the new buzzword in t…

Bluetooth 5.1 promises a sub-meter accuracy in distance finding using Bluetooth beacons. When those devices become available you'll probably want to re-evaluate those statements.

Re: Retail stores use Bluetooth beacons to track customers

#214

Post by jschwartzi »

graeme wrote: post #180
dpkonofa wrote: post #169

Earlier quoted context omitted.

That still won't change much, though, because, inevitably, there will be some app that requires Bluetooth for some fundamental aspect of its use that will also use one of these SDK's. Granting that app access to this will give it all the info it needs. What really needs to happen is that Apple needs to make some of these beacon-able permissions more granular. How to do that in a way that a tech-naive population under…

Which app types require permanent bluetooth access? Bearing in mind that connected to bluetooth audio is handled for apps by the system. Not being snarky, genuinely unsure what would need this. You’re definitely right that a single app with permissions and the sdks would be enough.

Fitbit is a good example. I'm willing to bet a good amount of money that they sell a lot of the BLE beacon data they snarf up alongside their heart rate monitor data.

Re: Retail stores use Bluetooth beacons to track customers

#215

Post by brlewis »

jschwartzi wrote: post #214
graeme wrote: post #180

Earlier quoted context omitted.

Which app types require permanent bluetooth access? Bearing in mind that connected to bluetooth audio is handled for apps by the system. Not being snarky, genuinely unsure what would need this. You’re definitely right that a single app with permissions and the sdks would be enough.

Fitbit is a good example. I'm willing to bet a good amount of money that they sell a lot of the BLE beacon data they snarf up alongside their heart rate monitor data.

Fitbit is a good example of an app that requires permanent Bluetooth access, but a terrible example of a company likely to sell user data. Fitbit's users are its customers, and are the source of $1.5 billion per year in revenue. Any money gained from selling that data would be miniscule in comparison, and would put the main revenue stream at risk by alienating customers.

I work for but don't speak for Fitbit.

Re: Retail stores use Bluetooth beacons to track customers

#216

Post by remarkEon »

Spooky23 wrote: post #171
fingerlocks wrote: post #161

Earlier quoted context omitted.

Maybe I’m one of these people. What exactly are the consequences? So far, the most damaging consequence of overreaching customer privacy is the famous teenage pregnancy leak when Target sent out coupon mailers to expecting moms based on shopping history. That’s a really weirdly specific issue, and hard to imaging a similar scenario that would affect my life in some equally horrible way. Am I missing something? Why sh…

My wife got a box of Enfamil Fedexed to our door as a promotion on what would have been the due date of our baby. Unfortunately, she miscarried at 3 months. They knew this because marketers get near real-time access to prescriptions, hospital admissions and other things. You should care because your information will be sold or traded, and behaviors can be correlated against medical and other outcomes. Are you a divor…

If what you are saying is true (I'm genuinely asking), that sounds like behavior that should absolutely be made illegal and severely punished.

I try to maintain a "lite" internet footprint (no facebook, only social media is LinkedIn, I use a VPN when I can) ... it's a little disturbing to think that someone can just purchase my buying history and use it as, essentially, an attack vector to serve me ads or gaslight me into buying stuff I don't really want or need.

Am I'm being naive?

Re: Retail stores use Bluetooth beacons to track customers

#218

Post by Kronopath »

givinguflac wrote: post #126
andrewgioia wrote: post #24

This is rage inducing. I went into this article thinking "ok as long as I don't have the Target or Ikea or whatever app installed on my phone, I'm fine." While that is a primary way, this needs to be outlawed: > These companies take their beacon tracking code and bundle it into a toolkit developers can use. The makers of many popular apps, such as those for news or weather updates, insert these toolkits into their ap…

iOS 13 actually has BT permissions per-app, and blocking that has no bearing on bt audio as that’s handled on the system level. It’s quite eye opening. Netflix for example wants access to BT even though there is absolutely no Netflix accessory that would warrant such access. I’m pretty thrilled about the change and it only cements my choice of iOS for me.

Apple doesn’t pop up this permission dialog for their proprietary iBeacon system though, since thats also handled at the system level. With that taken into consideration, this feels less like a privacy feature and more like an anticompetitive move.

At least, that’s the situation to the best of my knowledge.

Re: Retail stores use Bluetooth beacons to track customers

#219

Post by Spooky23 »

remarkEon wrote: post #216
Spooky23 wrote: post #171

Earlier quoted context omitted.

My wife got a box of Enfamil Fedexed to our door as a promotion on what would have been the due date of our baby. Unfortunately, she miscarried at 3 months. They knew this because marketers get near real-time access to prescriptions, hospital admissions and other things. You should care because your information will be sold or traded, and behaviors can be correlated against medical and other outcomes. Are you a divor…

If what you are saying is true (I'm genuinely asking), that sounds like behavior that should absolutely be made illegal and severely punished. I try to maintain a "lite" internet footprint (no facebook, only social media is LinkedIn, I use a VPN when I can) ... it's a little disturbing to think that someone can just purchase my buying history and use it as, essentially, an attack vector to serve me ads or gaslight me…

Yes, you are. The events surrounding what happened to my wife was very painful (an ectopic pregnancy that nearly killed her), and a thoughtless reminder was very unwelcome. I still feel violated and betrayed.

In our case, I found out the marketing list from Enfamil and bought it for my zip code. I complained to the hospitals’ privacy officer and the state regulator and found that everything was legal.

There is a lot of data on the topic...

Prescriptions: https://www.theguardian.com/technology/2017/jan/10/medical-d... Linkage to lifestyle data: https://www.statnews.com/2018/07/18/health-insurers-personal...

In our case, the hospital pharmacy issued drugs to her indicative of a pregnancy. The pharmacy or insurer provides that information in real time to data brokers. The pharmaceutical companies assign quotas and send salespeople for certain drugs. There are other ways for data to get out that we’re not certain of. Perhaps the insurer “anonymizes” and sells subrogation information. Or the lab. In any case, they knew that my wife was admitted to an OB floor of a hospital, but didn’t know the outcome.

It’s not going away. The US government uses these same techniques with companies like Google to combat extremism or terrorist conversions — they actually use factors like this to target potential recruits with counter-information via ads.

Re: Retail stores use Bluetooth beacons to track customers

#220

Post by manyxcxi »

0xffff2 wrote: post #150
manyxcxi wrote: post #125

Having done some proof of concept work for a couple of very large retailers using BLE/beacons I believe most of the scumminess isn’t on the retailer side but the 3rd party API/framework. The requests we were fielding was for better ability to find things in the store, floor maps for every store with wayfinding, and the ability to use the app to get more contextual info on demand. For those not completely in the know…

I'm a developer, but I've never touched mobile dev at all. Could you clarify what "running in the background" means here? I see it come up a lot and I'm never quite sure. Specifically, if I have an app installed, but it's not open in any way (e.g. in iOS I double tap home and swipe up on the app's window to close it) can the app still run any code? Am I safe from these "background" vulnerabilities as long as I aggres…

They can if given permission to. For certain apps in iOS it’s usually an application asking for location permissions without a real good reason for it, that’s why (in my opinion) it seems like weather apps are some of the worst offenders for this stuff, as it makes sense to give it location permissions. There are other permissions that can be abused as well, but location is the dead give away.

I can’t speak to Android as it’s been a long time, but iOS is pretty strict about what you can and can’t do in the background. There are certain events that will “wake up” an app, even one that is killed. You’re not necessarily safe if you have a bad app installed and kill it. I usually just recommend avoiding free apps that seem super heavy on ads. Because the ad framework is likely abusive, even if the developer didn’t intend it.

Post reply on HN