I had no idea stores tracked shoppers this way, but it makes sense--business will keep pushing the limits till someone complains. Anyhow, iOS 8 will keep stores from using your iPhone's wifi to track you as you walk through the store.

[www.washingtonpost.com]

I want to applaud this, but Apple is more than happy to provide their own platform specific mechanism for tracking customers in stores. iBeacon. Granted, iBeacon is clearly (?) opt in so that is a nice improvement over MAC address tracking.

Now for some technical questions. I thought phones only sent out their MAC address while searching for an available WiFi connection? If you disable the join available WiFi option and choose not to manually join a WiFi network while out shopping, isn't the tracking defeated? Are these systems actively sniffing packets of all WiFi connections or only harvesting MAC addresses from devices attempting to connect to their WiFi access points?



Edited 1 time(s). Last edit at 06/11/2014 12:52PM by silvarios.

For some reason, probably mistaken, I thought access points normally broadcast information to potential clients, so a phone with saved networks was only passively scanning, unless it had connected to a device with a hidden SSID. In that case, the client was actively scanning (revealing the hidden SSID and client MAC address???).

[stackoverflow.com]

Do most devices actively scan? Are the MAC addresses revealed, even with a passive scan and no current connections to a WiFi access point? Am I completely flubbing this high falutin' tech concept?



Edited 1 time(s). Last edit at 06/11/2014 01:08PM by silvarios.

I want to applaud this,

So why don't you?


but Apple is more than happy to provide their own platform specific mechanism for tracking customers in stores

Not the same thing. Tracking is a misnomer. iBeacon doesn't get info from your phone. iBeacon only sends info.


Granted, iBeacon is clearly (?) opt in

No, it's opt-out. But you have to install any given store's app to get the info. So somebody who doesn't know anything about iBeacon won't get messages unless they choose, for some odd reason, to install a store's app.

iBeacon uses Bluetooth. Don't want notices? Uninstall the app or turn off BT via CC. Done.

I don't know that there is a such thing as passive scanning. My guess is that a MAC address is always broadcast. Turning off WiFi in CC should defeat that.

---

I am that Masked Man.

All you can do, is all you can do.

There’s trouble — it's time to play the sound of my people.

Your boos mean nothing to me, I've seen what you cheer for.

Insisting on your rights without acknowledging your responsibilities isn’t freedom, it’s adolescence.

I've been to the edge of the map, and there be monsters.

We are a government of laws, not men.

Everybody counts or nobody counts.

When a good man is hurt,
all who would be called good
must suffer with him.

You and I have memories longer than the road that stretches out ahead.

There is no safety for honest men except
by believing all possible evil of evil men.

We don’t do focus groups. They just ensure that you don’t offend anyone, and produce bland inoffensive products. —Sir Jonathan Ive

An armed society is a polite society.
And hope is a lousy defense.

You make me pull, I'll put you down.

I *love* SIGs. It's Glocks I hate.

I attended the National Retail Federation's Big Show this January in NYC and was really amazed at the number of companies exhibiting various types video proximity analysis systems for shopper analysis. From facial and gender recognition to eye path scanning, this is the future of retail shopping and POS, for better or worse.

It's pretty interesting but kinda creepy at the same time.

---

JoeM

RAMd®d,
Yes, there is such a thing as passive scanning. I admit to possibly misunderstanding the differences between passive and active, but to doubt the existence when I've already provided a link to head start the conservation… We need some WiFi people to chime in to clarify what leaks out with WiFi and when. I really thought the whole reason I didn't use hidden SSIDs, kept the join available network options unchecked, and avoided joining a random store's network, was to avoid constantly spamming the area with my MAC or other associated information.

Wait, iBeacon isn't opt in?

As to not applauding. If Apple wants to be privacy conscious, why not skip rolling out iBeacon? For consumers, it seems similarly awful. I don't want the stores tracking me actively. Maybe I want to have the Apple Store app installed and keep my Bluetooth enabled, but I don't want to deal with iBeacon opt in/out? My newest iOS device currently is an iPhone 3GS, so I am lucky to not need to deal with that scenario. Yet, if I was on a newer Apple device, you are telling me that to avoid iBeacon, I need to lose access to my Bluetooth or uninstall this otherwise useful app? That stinks, at least a little bit, right?



Edited 3 time(s). Last edit at 06/11/2014 02:15PM by silvarios.

Quote
RAMd®d



but Apple is more than happy to provide their own platform specific mechanism for tracking customers in stores

Not the same thing. Tracking is a misnomer. iBeacon doesn't get info from your phone. iBeacon only sends info.

Wait, isn't it the same thing, other than gleaning your MAC address, what info is the WiFi method getting from your phone? Seems like the stores are more concerned about trying to pinpoint where in the store you are, for how long, what dates, etc. I don't know how iBeacon could avoid the same, for lack of a better vocabulary selection, tracking???

If Apple wants to be privacy conscious, why not skip rolling out iBeacon?

Why skip it?

Where is privacy being violated by iBeacon? You're in a store that open to the general public. While it may be on private property, you are in a public place. That store or other venue sells goods. That's their business. While you're in their store, they want to market to you as effectively and efficiently as possible. iBeacon does that without violating privacy. Win-win-win.


For consumers, it seems similarly awful.

Why, why, why are people such drama queens. "Awful". Hardly. And many consumers seem to like the idea of being informed of bargains.


you are telling me that to avoid iBeacon, I need to lose access to my Bluetooth or uninstall this useful app? That stinks, at least a little bit, right?

Again, I see this as you being a little bit of a drama queen, right? I don't think that "stinks", not even a bit. I would agree, IF iBeacon tracked customers and collected data. And IF Apple didn't provide a way to opt-out. Since the former is not the case and the latter is, I'm cool with it.

And wouldn't you agree that most people who install this useful app would also be likely to appreciate the option of getting notifications of potential bargains? We'll have to agree that you and I see things much differently.

I did neglect to mention that you can turn off any location aware app in Location Services. You'll be free of the supposed iBeacon bondage, and enjoy full access to BT and your useful app.

---

I am that Masked Man.

All you can do, is all you can do.

There’s trouble — it's time to play the sound of my people.

Your boos mean nothing to me, I've seen what you cheer for.

Insisting on your rights without acknowledging your responsibilities isn’t freedom, it’s adolescence.

I've been to the edge of the map, and there be monsters.

We are a government of laws, not men.

Everybody counts or nobody counts.

When a good man is hurt,
all who would be called good
must suffer with him.

You and I have memories longer than the road that stretches out ahead.

There is no safety for honest men except
by believing all possible evil of evil men.

We don’t do focus groups. They just ensure that you don’t offend anyone, and produce bland inoffensive products. —Sir Jonathan Ive

An armed society is a polite society.
And hope is a lousy defense.

You make me pull, I'll put you down.

I *love* SIGs. It's Glocks I hate.

Wait, if iBeacon is kosher because it is simply interacting with people who have walked into an open to the public business, why isn't the MAC address logging similarly okay? Couldn't iBeacon detect the exact same information, when, where, and how long someone is in any specific store or department; yet, it also pushes marketing to you. Doesn't that actually seem worse?

To clarify, Bluetooth also has a MAC address. What exactly does the iBeacon access point log? It has to be aware of people coming and going in order to interact with individual devices, yes? Can someone point me to the iBeacon documentation?



Edited 1 time(s). Last edit at 06/11/2014 03:30PM by silvarios.

Just read something that stated iBeacon is opt-in, merely installing an iBeacon enabled app is not enough to enable tracking. Can someone clarify? RAM?

For consumers, it seems similarly awful.

I don't think so. iBeacon in conjunction with the new Apple Store App allows you the walk into the Apple store, purchase something on a shelf there and walk out - without interacting with an Apple store employee, if you desire. Think how convenient that could be at a holiday time when Apple employees might not be available due to large crowds or when you are in a hurry.

Also, as RAMd®d said, iBeacon can always be turned off and notifications can always be disabled on your iPad/iPhone.

---

JoeM

Quote
silvarios
Just read something that stated iBeacon is opt-in, merely installing an iBeacon enabled app is not enough to enable tracking. Can someone clarify? RAM?

Here's some optin info:
[support.apple.com]

and more:
[en.wikipedia.org]
[www.computerworld.com]

---

JoeM

Quote
JoeM
For consumers, it seems similarly awful.

I don't think so. iBeacon in conjunction with the new Apple Store App allows you the walk into the Apple store, purchase something on a shelf there and walk out - without interacting with an Apple store employee, if you desire. Think how convenient that could be at a holiday time when Apple employees might not be available due to large crowds or when you are in a hurry.

Also, as RAMd®d said, iBeacon can always be turned off and notifications can always be disabled on your iPad/iPhone.

Not saying there is no benefit to iBeacon, but can or cannot Apple track the same information with iBeacon they are now attempting to prevent from WiFi MAC address harvesting? This whole discussion began about Apple attempting to limit in store tracking, so I want to know if their alternative prevents the same type of tracking?

Also, still wanted to clarify if merely having a device with WiFi enabled allow such tracking by these stores? As I stated previously, I thought you could set clients for passive mode, but maybe that was untrue, or technically true, but merely a placebo for preventing such logging. This is an important point to discern because the ramifications are further reaching.

Just read something that stated iBeacon is opt-in, merely installing an iBeacon enabled app is not enough to enable tracking.

That was the case prior to 7.1.

Apple enabled iBeacon reception as default in 7.1 because testing apparently showed that nobody bothered to enable it when walking into a store.

---

I am that Masked Man.

All you can do, is all you can do.

There’s trouble — it's time to play the sound of my people.

Your boos mean nothing to me, I've seen what you cheer for.

Insisting on your rights without acknowledging your responsibilities isn’t freedom, it’s adolescence.

I've been to the edge of the map, and there be monsters.

We are a government of laws, not men.

Everybody counts or nobody counts.

When a good man is hurt,
all who would be called good
must suffer with him.

You and I have memories longer than the road that stretches out ahead.

There is no safety for honest men except
by believing all possible evil of evil men.

We don’t do focus groups. They just ensure that you don’t offend anyone, and produce bland inoffensive products. —Sir Jonathan Ive

An armed society is a polite society.
And hope is a lousy defense.

You make me pull, I'll put you down.

I *love* SIGs. It's Glocks I hate.

Slashgear has a great article on iBeacons:
[www.slashgear.com]

Quote

You'll need to have the Apple Store app installed in order to actually see any of the beacon-triggered messages, and to have given the app permission to access your physical position, too.

That per-app approach means each third-party application and service will need to specifically request location awareness before they can tell where you are; it also means you can quickly shut down any app which is overloading you with iBeacon messages.

I'd say this combined with iOS8's randomization of WiFi MAC address provides for much greater user privacy choice.

JoeM,
Good links.

So iBeacon could track you by device if you've opted in to the app and notifications. Your device "pings" the iBeacon when opted in, similarly to how a WiFi device, in at least some circumstances "pings" the access points. Do iBeacon access points by default perform any logging of connected devices? If not, can such logging be enabled? Those are the details I'm most curious about.

Similarly, of course a connected WiFi device can see your MAC address and such logs could be analyzed and profiles modeled. I'm just curious if my devices with WiFi on are actively attempting broadcasting information, even if I've told it not to join any available network, and only to join previously saved networks? Yes, I'm dismissing the possibility of a saved network with hidden SSID because that opens a different can of worms.



Edited 1 time(s). Last edit at 06/11/2014 04:07PM by silvarios.

Quote
bhaveshp
Slashgear has a great article on iBeacons:
[www.slashgear.com]

Quote

You'll need to have the Apple Store app installed in order to actually see any of the beacon-triggered messages, and to have given the app permission to access your physical position, too.

That per-app approach means each third-party application and service will need to specifically request location awareness before they can tell where you are; it also means you can quickly shut down any app which is overloading you with iBeacon messages.

I'd say this combined with iOS8's randomization of WiFi MAC address provides for much greater user privacy choice.

Great link! Your last sentence perfectly frames the point regarding iBeacon and MAC address randomization. You now have "greater user privacy choice". You can give up a pretty similar amount of privacy by opting into iBeacon, but it should be easier to reclaim by disabling such features at a later time.

Again, a little clarification of how the WiFi capture is happening and I'm golden. You guys have been great explaining things thus far. Thanks!



Edited 1 time(s). Last edit at 06/11/2014 04:08PM by silvarios.

Couldn't iBeacon detect the exact same information, when, where, and how long someone is in any specific store or department; yet, it also pushes marketing to you.

iBeacon BT signals are transmit only, so as is, no.


Doesn't that actually seem worse?

Only if iBeacon actually did any of that.

The app you chose to install may collect some data for their nefarious purposes. I don't know what data they are limited to access. I assume you read the EULA when installing any apps.

[developer.radiusnetworks.com]

All of this begs the questions- what is privacy and what are privacy violations?

An app sends the store some data about your visit- how long you were at any given location. Is that a violation of your privacy? I don't think so. If the store than sells or shares that with other stores, as is done with email addresses, I'd say yes.

If the app collects personal information that is not anonymous data about your visit, I'd say yes, that's a violation. If they sell or share that data, that's an additional violation.

Since iB doesn't provide any user data, I don't know if any third-party app can glean any MAC address, BT or WiFi, or any other unique identifiers without Apple's permission. After all, any app is a potential key logger until proven otherwise, or at least accepted as such.

Digital privacy is at best an illusion. I do not believe that Apple, with iBeacon, is letting any genie out of its bottle.

If we want to be anonymous (which is probably no longer an option for the general public) you were a Latex mask, carry no tech, and pay with cash.

And that's just for shopping.

---

I am that Masked Man.

All you can do, is all you can do.

There’s trouble — it's time to play the sound of my people.

Your boos mean nothing to me, I've seen what you cheer for.

Insisting on your rights without acknowledging your responsibilities isn’t freedom, it’s adolescence.

I've been to the edge of the map, and there be monsters.

We are a government of laws, not men.

Everybody counts or nobody counts.

When a good man is hurt,
all who would be called good
must suffer with him.

You and I have memories longer than the road that stretches out ahead.

There is no safety for honest men except
by believing all possible evil of evil men.

We don’t do focus groups. They just ensure that you don’t offend anyone, and produce bland inoffensive products. —Sir Jonathan Ive

An armed society is a polite society.
And hope is a lousy defense.

You make me pull, I'll put you down.

I *love* SIGs. It's Glocks I hate.

This explains it well as they sell the product which performs the scanning:
[www.libelium.com]

Sounds like BT detection is equally susceptible and randomization of the BT MAC would prevent repeated seamless pairing.

Quote
bhaveshp
This explains it well as they sell the product which performs the scanning:
[www.libelium.com]

Sounds like BT detection is equally susceptible and randomization of the BT MAC would prevent repeated seamless pairing.

See, that's where I was/am confused, I thought my WiFi devices were set to not constantly "say hello", but instead to only passively wait for a "hello" from a known access point. If a hello from known access point was present it would say "hello I'm this MAC address and here's my key, if any, to connect". I intentionally won't join a hidden SSID network, because my understanding is then my WiFi devices would act just like iBeacon (yes, WiFi verus Bluetooth is but one difference in the two, but bear with me) and broadcast its presence. "Hey, hidden SSID, it is me again, are you out there?", "Hey, hidden SSID, it is me again, are…", etc. at a predetermined interval.

Am I misunderstanding this post:
[revision3.com]

Granted, I don't watch the video, just read the text. Goes into passive and active scanning a bit.

Quote
bhaveshp
This explains it well as they sell the product which performs the scanning:
[www.libelium.com]

Follow up from the link.
"What about privacy?

The anonymous nature of this technique is due to the use of MAC addresses as identifiers. MAC addresses are inot associated with any specific user account or mobile phone number not even to any specific vehicle. Additionally, the “inquiry mode” (visibility) can be turned off so people have always chosen if their device will or won't be detectable."

Emphasis mine. Near the top of the same page, the company claimed devices didn't need to do anything active to be sniffed. So which is it??? Bluetooth devices have a mode to toggle visibility, if a device is not visible and not actively trying to connect to anything, can it still be tracked?



Edited 1 time(s). Last edit at 06/11/2014 10:29PM by silvarios.

So how is it, though, that the store can associate your phone's wifi code with you as an individual?

In other words, how does Nordstrom, et al know that a particular wifi code goes with a mailing address/name/etc.?

---

[www.zeemaps.com]