Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

We hacked Burger King: How auth bypass led to drive-thru audio surveillance

bobdahacker.com

Post reply on HN
Print view View original

81–90 of 239 posts

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#81

Post by EvanAnderson »

nerdsniper wrote: post #79
EvanAnderson wrote: post #73

Earlier quoted context omitted.

I could easily see a judge regarding the conversation over a drive thru speaker as not a public space and more like a telephone call.

Edit: Apparently some states do ban non-consensual audio recordings in public: https://www.dmlp.org/legal-guide/massachusetts-recording-law The laws prohibiting these recordings have neither been upheld nor overturned by the US Supreme Court.

I wouldn't chance it. Stick an "audio may be recorded for performance evaluation purposes" on the drive thru kiosk and call it a day. Otherwise you're inviting litigation when something like this happens.

You can want things to be black and white but litigators are going to argue.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#82

Post by redserk »

nerdsniper wrote: post #67
nycpig wrote: post #49

Earlier quoted context omitted.

That is a farily broad statement. How would you reconcile your statement against state laws that require all-party consent for audio recordings? e.g. CISA, or FSCA

Those don’t apply to public spaces in the USA. This is super well-established law. If you needed consent to record in public there would be nearly zero YouTube videos recorded in public. And security cameras would generally not be allowed to record audio. And Tesla’s “Sentry mode” would be illegal. In the USA, there is no right or legal expectation of privacy in public spaces, which includes fast food restaurants tha…

Sentry mode doesn’t record audio.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#83

Post by akerl_ »

chimpanzee wrote: post #75
akerl_ wrote: post #65

Earlier quoted context omitted.

You’ve described a totally different “signal” than the comment I replied to.

I guess I should have made it clearer by making the implicit explicit: “The signal isn’t to pay white hats more, instead…” And perhaps an addendum such as: “…which will then, indirectly and in the long run, create the signal you were replying to.”

Ah. I don’t have much optimism that companies like Burger King will ever get that 2nd signal (mostly because I don’t think the average consumer-facing business suffers much impact from this kind of incident), but I agree with your premise.

Appreciate your clarification despite the bluntness of my reply.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#85

Post by chimpanzee »

akerl_ wrote: post #83
chimpanzee wrote: post #75

Earlier quoted context omitted.

I guess I should have made it clearer by making the implicit explicit: “The signal isn’t to pay white hats more, instead…” And perhaps an addendum such as: “…which will then, indirectly and in the long run, create the signal you were replying to.”

Ah. I don’t have much optimism that companies like Burger King will ever get that 2nd signal (mostly because I don’t think the average consumer-facing business suffers much impact from this kind of incident), but I agree with your premise. Appreciate your clarification despite the bluntness of my reply.

And I appreciate your reply. It fixes the tone in our little thread and refocuses it on the topic. Thank you.

Also, you’re probably right, the signal will likely pass right over Burger King’s crown.

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#87

Post by thimkerbell »

techjamie wrote: post #30
newhotelowner wrote: post #27

Earlier quoted context omitted.

Do you need 2 party consent for recording in a public space?

That's what I'm getting at with the expectation of privacy part. Talking into a drive thru speaker isn't really a private activity since everyone around can kinda hear it, but it'd probably be better to disclaim it anyway since someone attempting to file on you for it still costs money.

Is there an easy effective way to tell a company not to ask its customers' phone numbers if someone parked nearby can overhear them?

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#88

Post by [deleted] »

EvanAnderson wrote: post #81
nerdsniper wrote: post #79

Earlier quoted context omitted.

Edit: Apparently some states do ban non-consensual audio recordings in public: https://www.dmlp.org/legal-guide/massachusetts-recording-law The laws prohibiting these recordings have neither been upheld nor overturned by the US Supreme Court.

I wouldn't chance it. Stick an "audio may be recorded for performance evaluation purposes" on the drive thru kiosk and call it a day. Otherwise you're inviting litigation when something like this happens. You can want things to be black and white but litigators are going to argue.

[deleted]

Re: We hacked Burger King: How auth bypass led to drive-thru audio surveillance

#89

Post by jrockway »

hluska wrote: post #20
jrockway wrote: post #5

I'm most surprised that they have this whole system for how drive-thru interactions should go. Positive tone. Saying "you rule" like their exceedingly-irritating television commercials. Like... what if you don't? "If you don't follow the four Sales Best Practices, you're gonna be flippin' burgers for a living. Oh. Well. Oh." They're getting paid $6 an hour. The microphone/speaker system can't reproduce audio to an ex…

[flagged]

I'm not making a value judgement. I'm saying, how are they going to punish you, as a burger flipper, for not saying their TV commercial tagline? Demote you to burger flipper? That's already your job. So why pay people to build a system to track their metrics, when they realistically have no way of making this happen.

Pay people $30/hour and I bet they'll say it every time without software yelling at them. (With the software in place, I have never heard the line "you rule" at Burger King, but I also only go like twice a year. So why write it? It doesn't work.)

Post reply on HN