Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Density.io

density.io

Post reply on HN
Print view View original

111–120 of 189 posts

Re: Density.io

#111

Post by lloeki »

tomasien wrote: post #35
uptown wrote: post #25

Earlier quoted context omitted.

"They take privacy incredibly seriously" What does that even mean? They're tracking not only the number of people in a location, but where they go ... then sharing that with their customers. From their own website: Understand your business in the context of others: 1. Who you share customers with. 2. Where else your loyal customers love to go. 3. Where foot traffic in the city is trending. How is that respecting my p…

You're just an anonymous datapoint in their system, and they've actually done a lot to make sure this always stays the case.

Deanonymizing from location is possible. I'd rather be a data aggregate than a data point.

http://www.wired.com/threatlevel/2013/03/anonymous-phone-loc...

Re: Density.io

#112

Post by MPetitt »

albertsun wrote: post #28
Robin_Message wrote: post #24

This idea is cool, but there are some issues with their privacy claim. They say they are hashing the MAC address (presumably on the device). However, they can't be salting the hash (else they wouldn't be able to match across different stores). Since there is no salt (or a fixed salt), it is trivial to de-anonymise a specific MAC address (just hash it and see if any server has it). Worse, there are only 46 bits that a…

There's no point in trying to assess any privacy claims they make — it's not a technological thing. The only value they offer is violating people's privacy.

> The only value they offer is violating people's privacy. I don't think reading a value being freely broadcast by a person in your building is an invasion of privacy, how is this any different from having security cameras with audio or anything else. Saying you have privacy to something you are broadcasting in public, even more specifically in this case a privately owned building is a little daft. Do you think it's an invasion of privacy if someone writes down your name and address if you were yelling it in the middle of a Starbucks?

Re: Density.io

#113

Post by _derko »

uptown wrote: post #43
jordanmessina wrote: post #33

Earlier quoted context omitted.

Definitely understand your concerns. In the system you're an anonymous datapoint. The information can't be used to determine who a specific individual is.

So if a shop signs up for the service, and on Monday morning they have one customer who comes into the shop and buys something ... then that customer goes to another shop and just browses. You'll likely have the name of the person because they paid by credit card. You'll also have the information that this customer went down the block to some other shop. And you'll know which customer it was because you only had one…

It's not like the shop has information on individuals, they only have information on the total number and total flow. It would take a lot of collaboration with each and every store owner to be able to get to a point where they know exactly who you are.

Re: Density.io

#114

Post by Robin_Message »

yread wrote: post #80
Robin_Message wrote: post #24

This idea is cool, but there are some issues with their privacy claim. They say they are hashing the MAC address (presumably on the device). However, they can't be salting the hash (else they wouldn't be able to match across different stores). Since there is no salt (or a fixed salt), it is trivial to de-anonymise a specific MAC address (just hash it and see if any server has it). Worse, there are only 46 bits that a…

You could salt the hash with a constant secret

http://en.wikipedia.org/wiki/Poe's_law – I can't tell if this is a serious suggestion or not...

In case it is, a HMAC (which a salted hash effectively is, except keys are secret) helps in the case of them losing the database, but not if they also lose the key, and the NSA will get access to the key as well as the database, so it won't help there.

Re: Density.io

#115

Post by Robin_Message »

rikkus wrote: post #95
hobbes300 wrote: post #23

Earlier quoted context omitted.

Collision avoidance mostly.

If an unique identifier is needed, it can still be generated on a short term basis. Make it a GUID and we have generators ready that can do this without risk of collisions.

Not in less than 46 bits, which is all history has given you.

Re: Density.io

#116

Post by rsync »

shiftpgdn wrote: post #78
chrisfarms wrote: post #5

Risky. MAC address tracking is definitely a legal 'grey area' at the moment. I can imagine mining/fingerprinting in this way could easily become illegal in the not-to-distant future. In the UK, City of London already banned the wifi-enabled bins that were tracking MAC addresses. It would be really easy to tie a name to MAC address (from point of purchase with a credit card), then see exactly where that person went vi…

City of Houston does MAC address tracking on the freeways and surface streets to power their traffic tracking measures. It's probably used in hundreds of other places you haven't thought about. If you're concerned about your privacy just turn wifi off. http://traffic.houstontranstar.org/layers/

... or you could just alter your MAC address to something non personally identifiable (00:00:00....) ... possibly rotating random ones, or whatever.

The point is, this is trivially defeated without turning wifi off.

Re: Density.io

#117

Post by nathancahill »

rsync wrote: post #116
shiftpgdn wrote: post #78

Earlier quoted context omitted.

City of Houston does MAC address tracking on the freeways and surface streets to power their traffic tracking measures. It's probably used in hundreds of other places you haven't thought about. If you're concerned about your privacy just turn wifi off. http://traffic.houstontranstar.org/layers/

... or you could just alter your MAC address to something non personally identifiable (00:00:00....) ... possibly rotating random ones, or whatever. The point is, this is trivially defeated without turning wifi off.

Relevant: http://xkcd.com/1105/

Re: Density.io

#118

Post by RyanZAG »

paulgb wrote: post #108
MAGZine wrote: post #71

Earlier quoted context omitted.

This is perfect--I'm definitely going to set this up. I'd just like a background service for my Android device that would also randomize my MAC address... (perhaps it's time to investigate android development :P)

I'd buy that app :) Unfortunately (from the apps that I've seen) it looks like only a rooted Android could support it.

Yes, definitely rooted only - Linux will block any attempt to change the MAC without root access. That said, I've got a rooted android and change my mac all the time. Especially useful for coffee shops and airports.

Re: Density.io

#119

Post by [deleted] »

_derko wrote: post #113
uptown wrote: post #43

Earlier quoted context omitted.

So if a shop signs up for the service, and on Monday morning they have one customer who comes into the shop and buys something ... then that customer goes to another shop and just browses. You'll likely have the name of the person because they paid by credit card. You'll also have the information that this customer went down the block to some other shop. And you'll know which customer it was because you only had one…

It's not like the shop has information on individuals, they only have information on the total number and total flow. It would take a lot of collaboration with each and every store owner to be able to get to a point where they know exactly who you are.

[deleted]

Re: Density.io

#120

Post by hrjet »

nathancahill wrote: post #117
rsync wrote: post #116

Earlier quoted context omitted.

... or you could just alter your MAC address to something non personally identifiable (00:00:00....) ... possibly rotating random ones, or whatever. The point is, this is trivially defeated without turning wifi off.

Relevant: http://xkcd.com/1105/

A better idea might be periodically changing and random MAC address.
Post reply on HN