Risky. MAC address tracking is definitely a legal 'grey area' at the moment. I can imagine mining/fingerprinting in this way could easily become illegal in the not-to-distant future.
In the UK, City of London already banned the wifi-enabled bins that were tracking MAC addresses.
It would be really easy to tie a name to MAC address (from point of purchase with a credit card), then see exactly where that person went via the 'sharing' of data with other retailers. This is certainly something you would expect to need 'opt in' to.
They didn't really "ban" anything. They just instructed the company that was hosting them to stop doing so, in the face of a media shitstorm. And since that company was also a licensee of the City, they saw it fit to do as told. A shop owner in the City can still do as they like.
[source: I was doing other work for the bin company (renew) and saw the whole car crash from the inside]
City of Houston does MAC address tracking on the freeways and surface streets to power their traffic tracking measures. It's probably used in hundreds of other places you haven't thought about. If you're concerned about your privacy just turn wifi off.
Something similar caused a stir in the Netherlands as well, a month ago certain electronics stores where caught using wifi and bluetooth tracking alongside IR cameras. The Dutch Data Protection Authority said customers should be informed and have a possibility to opt-out, while the State Secretary of Security and Justice commented that people should turn off their wifi or bluetooth if they do not want to be tracked.
I built a device similar to this (with a raspberry pi). iOS from 7 and up no longer allows getting mac addresses... so it's much harder to tie a mac addresses to actual purchases. You'd have to do some sort of collaborative filtering over tons of visits to reliably tie purchases to a mac address.
At first when I saw this page, I thought they count the number of people in a store through an eye-tracking device or facial recognition. This isn't too far off.
In version 3.0 we will be seeing the ability to identify shoppers who are on a shopping spree by ringing a beep as they enter the store. Sad.
This idea is cool, but there are some issues with their privacy claim.
They say they are hashing the MAC address (presumably on the device). However, they can't be salting the hash (else they wouldn't be able to match across different stores).
Since there is no salt (or a fixed salt), it is trivial to de-anonymise a specific MAC address (just hash it and see if any server has it).
Worse, there are only 46 bits that are variable in a MAC address, and there is structure in there (3 bytes manufacturer, 3 bytes serial), so a complete mapping from MACs to the hashed MAC is very doable.
A secret per-device key for a HMAC would preserve privacy much better, but would stop them doing the cool stuff they plan — the usual trade off.
There's no point in trying to assess any privacy claims they make — it's not a technological thing. The only value they offer is violating people's privacy.
I'm confused why it's a privacy nightmare. They could just as easily sit someone there and count how many people are in a store and write it down. Your face is an identifier. I don't get why people think that anything technological anymore is instantly privacy nightmare. For an often technological website there is so much technophobia.
What's the advantage to a constant MAC address anyway? There must be a reason for it, but my first reaction to this article was to see if I could change mine.
This is really clever. So it's like Google Analytics (or any analytics) for your brick and mortar business. This is the kind of stuff I love to read about and see being developed, it makes a refreshing change from yet another javascript framework or social network for your pets.
Before you say more, check euclidanalytics.com. The creator of Google Analytics has been working on this, with funding, for a number of years already.
I had seen news about this recently and am surprised that more people didn't notice how it is essentially the same, without funding, and less developed.
I hadn't realized how trackable cell phones were until I was experimenting on a wifi project and saw both MAC addresses and Preferred Network List of devices within the area that had not joined my network. Cell phone wifi is a privacy nightmare. Even the most technical people don't realize this, so projects that popularize it are going to kick up huge amounts of mud. Think of how easy it is to identify "whale" clients, if not by direct tracking, then by revenue correlation (these N people were present for $N,NNN,NNN in revenue events). They're valuable to track because when they show up you want your sales people to be at their best, but a service that starts tracking those people is going to make real enemies quickly.
Without wishing to belittle the privacy concerns of my fellow HNers, I wonder how long it will take for people to just be ok with being tracked in this way? This seems like one of those social changes that feels strange and uncomfortable at first, but over time becomes the accepted norm.
It pains me if I see someone describing the slow and gradual installment of the total surveillance world and the loss of any privacy as just something "that feels strange and uncomfortable at first".
I for one will never be okay with it! and I know a LOT of people that are against loosing civil liberties too (even if the likes of you don't care!).
Ofcourse I know that my smartphone broadcasts its mac/stored-essids every few seconds, thats why I have wifi disabled most of the time. Most people don't realize that, most people also don't realize the tracking capabilities of cookies.
Laws in EU have begun to make it illegal to store cookies without the users consent, because even though its technically possible to block cookies, most people have no idea about that. So I can only hope that it will become one day illegal to violate peoples privacy like that!
People already have dozen of loyalty cards, and throw their email at every point of sale, which are handled in a centralized way behind the scene by a few actors.
Also, people log in with Facebook to basically anything.
"it's free" and "get cool rebates" create such an incredible variant of SEP field[0].
I was under the impression they were not entirely legal. I recall a movie theater saying they were going to install a 'deadzone' only to find out they weren't able to.
Keep in mind that these "anonymous" data points aren't. Your phones MAC address exposes your home wifi network thanks to Google's databases. They also expose where you work, where your friends houses are, what your favorite coffee shop is. This is beyond dangerous, it's completely unacceptable.
Apparently Nordstrom did an experiment with this for a while - http://www.nytimes.com/2013/07/15/business/attention-shopper... - even going as far as monitoring passing traffic so you could monitor the percentage of people passing who actually come into the store. This could be pretty fascinating in the context of running certain types of window displays, sales/offers, etc, and lead to ecommerce-style split testing and the like. It says they stopped the experiment partly due to people whining though, but I imagine it'll just go 'under the radar' in future since it could be too valuable not to try.
Everyone here seems to be complaining about the anonymous tracking, which isn't really an issue for "normals". Its a relatively useless complaint too as that data already exists in the credit card network.
The real issue with this is that most SMBs are unsophisticated when it comes to the technology stack they use. I saw this firsthand in many ways working at Swipely (swipely.com) as we figured out product market fit. While things like 'see where else your customers shop' might seem like an interesting feature from an outsiders perspective, the businesses don't actually care. They often barely have the bandwidth to worry about their own customers.
Since we haven't officially launched yet we hadn't posted our official opt out form. Definitely an oversight on our part, wanted to get you something as soon as possible: https://density.wufoo.com/forms/density-opt-out/
The funny part to me is that people think this is new. Companies like Euclid have literally been doing this for a couple of years(and quite successfully I might add) http://euclidanalytics.com/
Not only is it not new, its probably not going away.
I've actually seen a crude version of something like this on a trip to Taiwan a couple of years ago. I was at a mall and I noticed a wifi network called "People Counter." I wasn't entirely sure what they were doing with it, but I assumed it was counting MAC addresses.
As I understand it, the device is like a WiFi Router looking for nearby clients broadcasting their MAC. Since phones have the ability of turning themselves into WiFi Hotspots, could a phone/app offer this same capability, or is it missing a hardware piece that lives in Density/Pineapple?
If anyone knows or can say: What physical principle(s) is the sensor operating on? There doesn't seem to be much information on that (possibly deliberately).
[+] [-] chrisfarms|12 years ago|reply
In the UK, City of London already banned the wifi-enabled bins that were tracking MAC addresses.
It would be really easy to tie a name to MAC address (from point of purchase with a credit card), then see exactly where that person went via the 'sharing' of data with other retailers. This is certainly something you would expect to need 'opt in' to.
[+] [-] alexandros|12 years ago|reply
[source: I was doing other work for the bin company (renew) and saw the whole car crash from the inside]
[+] [-] shiftpgdn|12 years ago|reply
http://traffic.houstontranstar.org/layers/
[+] [-] Rafert|12 years ago|reply
Source: http://translate.google.com/translate?sl=nl&tl=en&js=n&prev=...
[+] [-] dmix|12 years ago|reply
http://www.cbc.ca/news/politics/csec-used-airport-wi-fi-to-t...
They used the wifi purchase at the airport to ID the user. They are likely already vacuuming up MAC addresses everywhere they can.
[+] [-] chrischen|12 years ago|reply
[+] [-] beejiu|12 years ago|reply
[+] [-] aleem|12 years ago|reply
In version 3.0 we will be seeing the ability to identify shoppers who are on a shopping spree by ringing a beep as they enter the store. Sad.
[+] [-] nickporter|12 years ago|reply
How would you do it?
[+] [-] Robin_Message|12 years ago|reply
They say they are hashing the MAC address (presumably on the device). However, they can't be salting the hash (else they wouldn't be able to match across different stores).
Since there is no salt (or a fixed salt), it is trivial to de-anonymise a specific MAC address (just hash it and see if any server has it).
Worse, there are only 46 bits that are variable in a MAC address, and there is structure in there (3 bytes manufacturer, 3 bytes serial), so a complete mapping from MACs to the hashed MAC is very doable.
A secret per-device key for a HMAC would preserve privacy much better, but would stop them doing the cool stuff they plan — the usual trade off.
[+] [-] albertsun|12 years ago|reply
[+] [-] yread|12 years ago|reply
[+] [-] silvertonia|12 years ago|reply
[+] [-] albertsun|12 years ago|reply
Perhaps wifi devices should no longer provide constant MAC addresses....
[+] [-] chrisfarms|12 years ago|reply
[+] [-] xauronx|12 years ago|reply
[+] [-] paulgb|12 years ago|reply
[+] [-] huhtenberg|12 years ago|reply
[+] [-] highace|12 years ago|reply
[+] [-] paulgb|12 years ago|reply
[+] [-] soithrewitaway|12 years ago|reply
I had seen news about this recently and am surprised that more people didn't notice how it is essentially the same, without funding, and less developed.
[+] [-] ynniv|12 years ago|reply
[+] [-] plusbryan|12 years ago|reply
[+] [-] rlx0x|12 years ago|reply
Ofcourse I know that my smartphone broadcasts its mac/stored-essids every few seconds, thats why I have wifi disabled most of the time. Most people don't realize that, most people also don't realize the tracking capabilities of cookies. Laws in EU have begun to make it illegal to store cookies without the users consent, because even though its technically possible to block cookies, most people have no idea about that. So I can only hope that it will become one day illegal to violate peoples privacy like that!
[+] [-] lloeki|12 years ago|reply
Also, people log in with Facebook to basically anything.
"it's free" and "get cool rebates" create such an incredible variant of SEP field[0].
[0]: http://en.wikipedia.org/wiki/SEP_field#Fiction
[+] [-] chrischen|12 years ago|reply
https://meraki.cisco.com/blog/2013/12/get-a-visual-on-your-b...
So people are probably already being tracked... and no one has noticed.
[+] [-] alexcroox|12 years ago|reply
[+] [-] agentultra|12 years ago|reply
[+] [-] buro9|12 years ago|reply
Though in the UK I have unlimited 4G for £20 per month, so I just leave WiFi permanently disabled.
[+] [-] untog|12 years ago|reply
[+] [-] nwh|12 years ago|reply
[+] [-] petercooper|12 years ago|reply
[+] [-] jamiequint|12 years ago|reply
The real issue with this is that most SMBs are unsophisticated when it comes to the technology stack they use. I saw this firsthand in many ways working at Swipely (swipely.com) as we figured out product market fit. While things like 'see where else your customers shop' might seem like an interesting feature from an outsiders perspective, the businesses don't actually care. They often barely have the bandwidth to worry about their own customers.
[+] [-] moogleii|12 years ago|reply
[+] [-] droob|12 years ago|reply
[+] [-] adamio|12 years ago|reply
[+] [-] 650REDHAIR|12 years ago|reply
[+] [-] icebraining|12 years ago|reply
[+] [-] Xorlev|12 years ago|reply
[+] [-] jordanmessina|12 years ago|reply
We're adding it to the site now.
[+] [-] adregan|12 years ago|reply
[+] [-] pfraze|12 years ago|reply
[+] [-] zbruhnke|12 years ago|reply
Not only is it not new, its probably not going away.
[+] [-] jroes|12 years ago|reply
[+] [-] telecuda|12 years ago|reply
As I understand it, the device is like a WiFi Router looking for nearby clients broadcasting their MAC. Since phones have the ability of turning themselves into WiFi Hotspots, could a phone/app offer this same capability, or is it missing a hardware piece that lives in Density/Pineapple?
[+] [-] jofer|12 years ago|reply
If anyone knows or can say: What physical principle(s) is the sensor operating on? There doesn't seem to be much information on that (possibly deliberately).
[+] [-] geuis|12 years ago|reply