21–30 of 189 posts
This is a privacy nightmare. Perhaps wifi devices should no longer provide constant MAC addresses....
What's the advantage to a constant MAC address anyway? There must be a reason for it, but my first reaction to this article was to see if I could change mine.
Risky. MAC address tracking is definitely a legal 'grey area' at the moment. I can imagine mining/fingerprinting in this way could easily become illegal in the not-to-distant future. In the UK, City of London already banned the wifi-enabled bins that were tracking MAC addresses. It would be really easy to tie a name to MAC address (from point of purchase with a credit card), then see exactly where that person went vi…
[source: I was doing other work for the bin company (renew) and saw the whole car crash from the inside]
This is a privacy nightmare. Perhaps wifi devices should no longer provide constant MAC addresses....
What's the advantage to a constant MAC address anyway? There must be a reason for it, but my first reaction to this article was to see if I could change mine.
They say they are hashing the MAC address (presumably on the device). However, they can't be salting the hash (else they wouldn't be able to match across different stores).
Since there is no salt (or a fixed salt), it is trivial to de-anonymise a specific MAC address (just hash it and see if any server has it).
Worse, there are only 46 bits that are variable in a MAC address, and there is structure in there (3 bytes manufacturer, 3 bytes serial), so a complete mapping from MACs to the hashed MAC is very doable.
A secret per-device key for a HMAC would preserve privacy much better, but would stop them doing the cool stuff they plan — the usual trade off.
Met these this last week, they're absolutely incredible and they understand their market really well. They take privacy incredibly seriously and they've built a product that can change the industry.
What does that even mean? They're tracking not only the number of people in a location, but where they go ... then sharing that with their customers. From their own website:
Understand your business in the context of others:
1. Who you share customers with.
2. Where else your loyal customers love to go.
3. Where foot traffic in the city is trending.
How is that respecting my privacy?
Where's their opt out?
We're adding it to the site now.
This idea is cool, but there are some issues with their privacy claim. They say they are hashing the MAC address (presumably on the device). However, they can't be salting the hash (else they wouldn't be able to match across different stores). Since there is no salt (or a fixed salt), it is trivial to de-anonymise a specific MAC address (just hash it and see if any server has it). Worse, there are only 46 bits that a…
Where's their opt out?