[trashb]

> We’ve normalised the idea that Bluetooth is always on. Phones, laptops, smartwatches, headphones, cars, and even medical devices constantly broadcast their presence. The standard response to privacy concerns is usually “nothing to hide, nothing to fear.”

I guess anything you send out can be used to profile you.

Some of my friends live on a farm near a semi busy road, however far enough from other farms to not be able to receive their wifi. They showed me their router logging all the wifi accesspoints that appear/disappear. There where A LOT of access points named "Audi", "BMW", "Tesla" etc. similar to those devices leaking bluetooth data. We had a discussion that it would be easy to determine who was passing by at what times due to these especially when you can "de-anonymize" the data for example link it to a numberplate.

I believe shopping malls often use such signals (wifi, bluetooth) to track what your travel pattern through the mall is. They know what section of the store you spend most of your time in and what storefronts you stall at.

[luma]

You can do this for much cheaper - all four of your tires are broadcasting a unique ID to report tire pressure, the radio to pick it up is cheap (because cars), and TPMS has no facility to randomize or otherwise secure this.

[Gigachad]

It’s actually even easier, your car has a plate on the front with a unique ID that a camera scans, often to automatically track your park time for ticketing.

I can’t really care about obscure Bluetooth tracking when every business has CCTV doing facial recognition.

[everdrive]

I believe that every morning someone in the tech industry wakes up and devises a new place to cram some sort of radio. And it's appealing enough the the unwashed masses such that it becomes widely adopted and then unavoidable. I don't want TPMS in my tires. It's not as if checking tire pressure is difficult. No one will consider moving away from TPMS. You'll only hear technologists say "yes, but we could improve the standard! Perhaps encrypt it." They only know how to solve technological problems with more technology.

[spockz]

Not all cars have active TPMS. my Volvo xc90 had them but in later models they switched back to passive ones. So it is not even a given for higher end models.

[stirfish]

I've had trouble reading these from more than a few feet away, but I concede that I have no idea what I'm doing

[officeplant]

>There where A LOT of access points named "Audi", "BMW", "Tesla" etc.

That's one of the funniest things about wardriving with Wigle on your phone. I can often see the SSID of "Jennifer's Equinox", "Jacks Suburban" right after I get cut off by someone in said vehicle. The vast majority of car bluetooth/wifi I see tends to have varying amounts of identifying information. It's almost as bad as the fact that apple still defaults to Jacks iPhone/iPad etc with no option to rename the device until you've finished setting it up.

Companies are not out to protect us with default settings and the majority of users need to wake up to this fact.

[saghm]

This might just be me being uninformed as someone who doesn't drive but how are you seeing what wifi networks are available so quickly right after being cut off? My very naive instinct is that looking at your phone or opening up a menu with the available wifi networks on your car's display seems like it would require a noticeable decrease in attention to the road, so I'd almost expect an uptick in being cut off from other people who are annoyed with your driving.

[reactordev]

What would be next level wardriving would be to break into their Bluetooth and have a conversation about their driving habits.

It can be done, relatively easily.

[Fnoord]

Don't worry about Tesla's being tracked. Via Bluetooth this has existed for at least 7 years [1] (was mentioned on HN as well). Tesla know (also for 7 years), Musk doesn't care 'since license plates can also be tracked'.

I used it in train stations, and get hits when passing highways via train or bus. Esp. fun if you stand still due to traffic lights or traffic jam, since you can try to get a visual.

The only lesson to be learned here is that it allowed one to learn in 2019 Musk is overrated. But you can also learn that lesson from the book The PayPal Wars which predates this by 15 years.

> I believe shopping malls often use such signals (wifi, bluetooth) to track what your travel pattern through the mall is. They know what section of the store you spend most of your time in and what storefronts you stall at.

Not allowed in EU.

[1] https://www.teslaradar.com/

[nandomrumber]

> Not allowed

This phrasing needs to die.

Not allowed is something your parents imposed on you when you were a child.

You’re not allowed to have an ice cream, or you’re not allowed to hang out with that boy.

Laws don’t not allow anything, they only sometimes impose penalties if you’re caught breaking them.

[sneak]

It’s done in Europe’s second busiest airport, Amsterdam Schiphol. I saw the advisory signs (so they can pretend that you gave informed consent by walking out of the jetbrige) up just last week.

https://media.licdn.com/dms/image/v2/D4D12AQHCyctOFz_EJg/art...

[xaldir]

> Not allowed in EU.

I'm surprised, I know for a fact that some stores definitely have the ability to do that on their hardware.

[jasonfrost]

There's an Android app that can find devices, make profiles, and you can track location for as long as they're connected. So you can profile passerbys and even get notified when the profile passes through again. I forgot what is was called

[RunningDroid]

Are you thinking of BLE Radar?

https://github.com/BLE-Research-Group/MetaRadar

https://f-droid.org/packages/f.cking.software

[dylan604]

Years ago when BT beacons were newish, I was talking to an AdTechBro that wanted to create the ability from Minority Report where the kiosk recognizes a user, not by eye scans but by recognizing mobile device, so they could offer a personalized whatever. The creepiness wasn't something they eased into. It was pretty much instant.

[jorvi]

> I believe shopping malls often use such signals (wifi, bluetooth) to track what your travel pattern through the mall is. They know what section of the store you spend most of your time in and what storefronts you stall at

In the EU this is forbidden unless they explicitly ask your permission. They can still gather aggregate stats but they cannot build a profile on you.

[stevage]

I find it curious that the EU, despite it having such a complex parliamentary structure, is able to consistently enact such laws that are good for ordinary people. Are the two connected, I wonder...

[wolvoleo]

True but I wouldn't put it past them tbh. It's very easy to hide or claim a 'misconfiguration'.

Even the airports here track everyone. They say it's for public safety but I'm sure they use it for market analysis for their expensive sandwich shops too.

[tskulbru]

> I believe shopping malls often use such signals (wifi, bluetooth) to track what your travel pattern through the mall is. They know what section of the store you spend most of your time in and what storefronts you stall at.

Yes, I remember Cisco had a product like this all the way back in 2011. They could pinpoint a customer to an exact position inside a store using triangulation, they would know which shelf you spent time in front of etc. In the 15 years since then, I expect the technology is much scarier and intrusive.

[nofunsir]

iBeacon. They know what shelf you're standing in front of. What products you touch and read.

Ever been in an Apple store? Look up. In the dark voids between the edge-to-edge backlit ceiling. There are secrets there. Watching you.

[SoftTalker]

I disable bluetooth on my phone, though periodically I find that it's back on.

Edit: iOS

[craftkiller]

I have the opposite experience: GrapheneOS has an option to automatically turn your bluetooth off after a configurable period of not being used. So when I need to use bluetooth, I turn it on like normal. Then, without thinking about it, it automatically turns off. The end result is my bluetooth is only ever on for a couple hours each month when I'm making phone calls.

[joemi]

I used to fervently keep my bluetooth off on iOS, and I learned that if you turn it off via the Control Center, then it automatically gets turned back on the next day. But if you turn it off via Settings, then it only gets turned back on when the system software updates. (I stopped doing this a couple iOS versions ago, though, so it may have changed since then.)

[dylan604]

I miss wired headphones for this purpose. It's the only reason I even have BT enabled.

[officeplant]

With iOS the easiest way to make sure it off and stays off is to build a shortcut to cut off wifi/bluetooth. Otherwise it's typically off until you get geolocated as being back home/work and wifi comes back on.

I have a "store mode" button that just kills wifi/bt that I hit before I go into any store.

[silon42]

Android now has an option to enable it every day.. (I have it disabled).

[scottlamb]

> We had a discussion that it would be easy to determine who was passing by at what times due to these especially when you can "de-anonymize" the data for example link it to a numberplate.

You could also read the numberplate directly with OpenALPR. It can be finicky to set up a camera to do this reliably in all conditions (particularly at night and high speed) but once done you could detect any car passing, not just ones with wifi access points.

When the law requires us to have numberplates, I think this just has to be considered public information for anyone who is nearby or can leave a camera nearby. It's not ideal to leak it in additional forms that might be easier for people to grab (say, with an ESP32), but it's a matter of degree rather than of kind.

But yeah, I'm with you on some of these others, particularly the medical devices. That's not great.

[AlotOfReading]

There's a difference between public and Public. I go outside with my face visible and I don't mind if my neighbors see me. I do mind if my neighbors stand outside my door with a notepad sketching faces every time they see me or anyone else, especially if they're selling the data. Systematic tracking that isn't subject to the constraints of human memory and apathy fundamentally changes the equation.

[wolvoleo]

> I believe shopping malls often use such signals (wifi, bluetooth) to track what your travel pattern through the mall is. They know what section of the store you spend most of your time in and what storefronts you stall

They do but most phones rotate the mac adress these days. So while they can still track you through the store (sadly) they don't have the ability to track your recurring visits.

I wish phones had the option to constantly spam broadcasts with random MAC ids. That would make the practice useless.

[chasil]

The GrapheneOS variant of Android will disable both Bluetooth and WiFi after a set period of inactivity.

There is also a Bluetooth shutoff app on F-Droid.

https://f-droid.org/en/packages/com.mystro256.autooffbluetoo...

I have also put an Airtag clone in my car (Loshall in iOS mode). That is probably leaking my arrival times. My water meter is also now bluetooth.

[bryanrasmussen]

>I believe shopping malls often use such signals (wifi, bluetooth) to track what your travel pattern through the mall is. They know what section of the store you spend most of your time in and what storefronts you stall at.

hmm, I wonder if there is anything about using this to combat shoplifting... short google later, seems there is, but mostly everything I'm finding is just brochures and breathless corporate announcements.

found this uni project https://capstone.cse.msu.edu/2020-01/projects/meijer/

[jlarocco]

I was researching bluetooth low energy for a project, and discovered "Beacons": https://en.wikipedia.org/wiki/Bluetooth_Low_Energy_beacon

What's more insidious than just tracking people through the store is that the beacons can collect the bluetooth IDs of the devices they've seen and send it off to advertisers, who can use the UUID to connect a person's offline shopping with the online advertising profile they've built up for the person.

[autoexec]

> I believe shopping malls often use such signals (wifi, bluetooth) to track what your travel pattern through the mall is.

Many places do this. The department stores in the mall, target, even grocery stores do it.

[King-Aaron]

> I believe shopping malls often use such signals (wifi, bluetooth) to track what your travel pattern through the mall is.

I worked for a company about 18 years ago where we did just this. We also sold the technology to car dealerships who were very interested in our silent salesman stuff where you could tie interactions with your web campaign directly to the person walking past the dealership and preload the salesman with all their details.

Grubby stuff nearly two decades ago.

[KolibriFly]

Even when they claim it's "anonymous," the value is in aggregate behavioral patterns: dwell time, repeat visits, path through the space, etc.

[voidmain0001]

Sure, stores use WiFi access points and BT to track MAC addresses and BT device IDs. Google does something similar with location and it provides in real time how busy a location is which I find super convenient. It’s a shame that shaping data into useful information also means it can weaponized.

[pixl97]

> even medical devices constantly broadcast their presence

I mean yes, said medical devices are a whole lot less useful to me if they are not transmitting data. For some of this stuff you can't have your cake and eat it too.

[0x1ch]

I was wardriving my neighborhood and realized my elderly neighbor's CPAP machine is broadcasting some type of BT signal 24/7. I imagine it's transmitting some important stats, but it did make me have a 2nd thought about medical devices being IoT or BT enabled.

[xanrah]

There’s a middle ground here. There is no technical reason a pacemaker constantly broadcasts itself - there is ways to allow communication to such devices without yelling your name all the time. And there is definitely no reason for such a name to be a unique identifier.

[dietr1ch]

What forces devices to constantly stream data? You can batch updates and probably save power thanks to it.