Startup pushes Newsstand publication samples to iOS devices through Apple's iBeacons

2»

Comments

  • Reply 21 of 29
    blah64blah64 Posts: 993member
    Quote:
    Originally Posted by Dick Applebaum View Post

    Ehhh... No! UUIDs do not necessarily identify you -- they can just differentiate you.


    The difference between "identify" and "differentiate" is a very fine line when it comes to tracking/profiling/privacy. Profiling/marketing companies spend huge $ and development effort to bridge that gap wherever possible.

    Quote:
    Originally Posted by Dick Applebaum View Post
    Now a Computer, iPad, or cash register POST, could listen for both UUIDs using CoreBluetooth. It would recognize you as a "Target Visitor iBeacon", and along with the 3 closest (to you) Target iBeacons, could approximate your location through trilateration.

    There is no way the above identifies you or your device -- it just differentiates you from everyone else -- as long as you're in this particular Target store.


    So this is exactly the methodology I'm concerned by, although it's possible there still may be something I'm missing, because of your last clause here.

    Is it not possible for an app to generate a UUID of its own, based on communication with its own home server, then use that as part of a beacon/BLE "solution" that returns a truly unique ID to these store beacons when requested? If so, then it's Game Over for privacy, because it will get married with your real-world ID via triangulation at the Point Of Sale. The retailers will share or sell this data to aggregate it for increased value and companies like Facebook and Google will be on this like flies to honey, not to mention Acxion and their whole ilk as well.

    The one tiny bright spot is that it sounds like if a person is not using any beacon/BLE-enabled app, then no data is transmitted. That closely resembles a "master kill switch". However, if Facebook decides to get involved, as one example, their app is pretty ubiquitous. If any bits of code run in the background, then they could respond to beacons with a "facebook UID", right? Also, look at all the data harvesting companies that provide libraries that get embedded in so many apps these days. It seems like this could proliferate that way as well.

    I'm happy to be corrected if there are still technical details I'm not seeing. In fact, I'm almost hoping.

    Also, I'm not saying that Apple is a bad guy here, but the technology, like so many technologies, can be used for "good" or "evil" purposes, unless there are stringent blocks put in place to prevent it. I mean hard technological blocks, not procedural or EULA-ish impediments, because the latter are sidestepped every day, with the mindset that "let's just do it and ask forgiveness later IF we get caught."

    Quote:
    Originally Posted by Dick Applebaum View Post

    As illustrated above, it's not your UUID, it's a Target "Visitor" UUID Assigned/generated to you when you enter a Target store. It says nothing about you or your iDevice.


    This sounds like a reasonable usage scenario, but is there a way to actually prevent the above?

    If it's technically possible, the data harvesters will figure out a way to do it, and a way to get it integrated into products or services that are in widespread use. Lest anyone think this is a paranoid attitude, one need only look to all the existing practices used in the data harvesting industry, and the millions they spend to gather every bit of data possible, with or without explicit permission from end users. It's an industry that's out of control. If I'm thinking about it, they're already working on implementations.

    Quote:
    Originally Posted by Dick Applebaum View Post

    Again, I don't know/care about other OSes implementations -- I trust Apple based on 35+ years of experience dealing with them.


    I don't care as much about other OS implementations, because I'm unlikely to use them personally, but I still do care because I'm bothered by the "what's good/bad for humanity" questions, and I also think that people are being numbed to this stuff, which means it's more likely to fold back into channels or products that I would like to use.

    As for experience with Apple, you may the only one here with deeper roots than I (barely, as I was coding on an early Apple ][ in the late 70s!), and I basically agree. Actions like their stance against the magazine industry when it came to divulging user data was an example of standing up strong for the consumer. Same with dev access to hardware UUIDs. But the world is changing, and Apple is only one piece of the data harvesting pipeline, and it's an ugly industry. I'm not optimistic.
  • Reply 22 of 29
    blah64 wrote: »
    <div class="quote-container" data-huddler-embed="/t/161035/startup-pushes-newsstand-publication-samples-to-ios-devices-through-apples-ibeacons#post_2443303" data-huddler-embed-placeholder="false"><span>Quote:</span><div class="quote-block">Originally Posted by <strong>Dick Applebaum</strong> <a href="/t/161035/startup-pushes-newsstand-publication-samples-to-ios-devices-through-apples-ibeacons#post_2443303"><img src="/img/forum/go_quote.gif" class="inlineimg" alt="View Post"/></a><br />
    Ehhh... No! UUIDs do not necessarily identify you -- they can just differentiate you. <br /></div></div>

    The difference between "identify" and "differentiate" is a very fine line when it comes to tracking/profiling/privacy. Profiling/marketing companies spend huge $ and development effort to bridge that gap wherever possible.

    <div class="quote-container" data-huddler-embed="/t/161035/startup-pushes-newsstand-publication-samples-to-ios-devices-through-apples-ibeacons#post_2443303" data-huddler-embed-placeholder="false"><span>Quote:</span><div class="quote-block">Originally Posted by <strong>Dick Applebaum</strong> <a href="/t/161035/startup-pushes-newsstand-publication-samples-to-ios-devices-through-apples-ibeacons#post_2443303"><img src="/img/forum/go_quote.gif" class="inlineimg" alt="View Post"/></a>
    Now a Computer, iPad, or cash register POST, could listen for both UUIDs using CoreBluetooth. It would recognize you as a "Target Visitor iBeacon", and along with the 3 closest (to you) Target iBeacons, could approximate your location through trilateration.<br />
    There is no way the above identifies you or your device -- it just differentiates you from everyone else -- as long as you're in <i>this particular</i> Target store.</div></div>

    So this is exactly the methodology I'm concerned by, although it's possible there still may be something I'm missing, because of your last clause here.

    Is it not possible for an app to generate a UUID of its own, based on communication with its own home server, then use that as part of a beacon/BLE "solution" that returns a truly unique ID to these store beacons when requested? If so, then it's Game Over for privacy, because it will get married with your real-world ID via triangulation at the Point Of Sale. The retailers will share or sell this data to aggregate it for increased value and companies like Facebook and Google will be on this like flies to honey, not to mention Acxion and their whole ilk as well.

    You're overthinking this!

    Scenario:

    You walk into your friendly, local butcher (candy, ice cream coffee) shop. There is a line. There is a sign next to a roll of tickets saying: "Take a number". You take ticket #2014590407

    Eventually, your number gets called and you buy whatever and pay with a credit card. The CC terminal is down, so they run your card through a manual terminal with a carbonless 3-part (customer, store, bank) receipt. You sign the receipt and they staple your ticket #2014590407 and the store copy of the itemized receipt to the store copy of the Credit Card receipt.

    The store now has:
    • Your Name
    • Your Credit Card Number, Expiration Date (possibly zip code and auth number)
    • Your itemized purchase sales receipt
    • your ticket #2014590407

    The ticket #2014590407 equates with a "Visitor iBeacon" -- it has no value in itself.

    If the store wants to collect and market your info, your name is the common denominator... It can search it's servers and update your records -- including assigning you an an unique number (by whatever means it chooses).


    The one tiny bright spot is that it sounds like if a person is not using <i>any</i> beacon/BLE-enabled app, then no data is transmitted. That closely resembles a "master kill switch". However, if Facebook decides to get involved, as one example, their app is pretty ubiquitous. If any bits of code run in the background, then they could respond to beacons with a "facebook UID", right? Also, look at all the data harvesting companies that provide libraries that get embedded in so many apps these days. It seems like this could proliferate that way as well.

    I'm happy to be corrected if there are still technical details I'm not seeing. In fact, I'm almost hoping.

    You seem to be blocking out things I've explained (in prior posts) but don't fit your understanding.
    • In Apple's implementation of iBeacons, Store iBeacons broadcast the store's UUID, Major, Minor and signal strength only
    • Your iDevice only listens for a specific store's iBeacons
    • Your iDevice cannot be detected, located or tracked by Store iBeacons

    Apple's curated App Store assures rigorous test for compliance with Apple's security/privacy policies.

    This means that any app that performs unauthorized tracking or data mining will not be allowed in the Apple App Store!




    Also, I'm not saying that Apple is a bad guy here, but the technology, like so many technologies, can be used for "good" or "evil" purposes, unless there are stringent blocks put in place to prevent it. I mean hard technological blocks, not procedural or EULA-ish impediments, because the latter are sidestepped every day, with the mindset that "let's just do it and ask forgiveness later IF we get caught."

    <div class="quote-container" data-huddler-embed="/t/161035/startup-pushes-newsstand-publication-samples-to-ios-devices-through-apples-ibeacons#post_2443303" data-huddler-embed-placeholder="false"><span>Quote:</span><div class="quote-block">Originally Posted by <strong>Dick Applebaum</strong> <a href="/t/161035/startup-pushes-newsstand-publication-samples-to-ios-devices-through-apples-ibeacons#post_2443303"><img src="/img/forum/go_quote.gif" class="inlineimg" alt="View Post"/></a><br />
    As illustrated above, it's not your UUID, it's a Target "Visitor" UUID Assigned/generated to you when you enter a Target store. It says nothing about you or your iDevice.<br /></div></div>

    This sounds like a reasonable usage scenario, but is there a way to actually prevent the above?

    If it's technically possible, the data harvesters will figure out a way to do it, and a way to get it integrated into products or services that are in widespread use. Lest anyone think this is a paranoid attitude, one need only look to all the existing practices used in the data harvesting industry, and the millions they spend to gather every bit of data possible, with or without explicit permission from end users. It's an industry that's out of control. If I'm thinking about it, they're already working on implementations.

    <div class="quote-container" data-huddler-embed="/t/161035/startup-pushes-newsstand-publication-samples-to-ios-devices-through-apples-ibeacons#post_2443303" data-huddler-embed-placeholder="false"><span>Quote:</span><div class="quote-block">Originally Posted by <strong>Dick Applebaum</strong> <a href="/t/161035/startup-pushes-newsstand-publication-samples-to-ios-devices-through-apples-ibeacons#post_2443303"><img src="/img/forum/go_quote.gif" class="inlineimg" alt="View Post"/></a><br />
    Again, I don't know/care about other OSes implementations -- I trust Apple based on 35+ years of experience dealing with them.</div></div>

    I don't care <i>as much</i> about other OS implementations, because I'm unlikely to use them personally, but I still do care because I'm bothered by the "what's good/bad for humanity" questions, and I also think that people are being numbed to this stuff, which means it's more likely to fold back into channels or products that I would like to use.

    As for experience with Apple, you may the only one here with deeper roots than I (barely, as I was coding on an early Apple ][ in the late 70s!), and I basically agree. Actions like their stance against the magazine industry when it came to divulging user data was an example of standing up strong for the consumer. Same with dev access to hardware UUIDs. But the world is changing, and Apple is only one piece of the data harvesting pipeline, and it's an ugly industry. I'm not optimistic.

    Finally, the way i see this working out eventually:
    • you will shop, using iBeacons (when available) to streamline the shopping process
    • you will checkout anonymously using iTunes which generates an unique transaction ID

    If you choose, you can allow a store to identify you with your purchases in detail or in aggregate,
  • Reply 23 of 29
    gatorguygatorguy Posts: 24,271member
    [/LIST]

    Apple's curated App Store assures rigorous test for compliance with Apple's security/privacy policies.

    This means that any app that performs unauthorized tracking or data mining will not be allowed in the Apple App Store!

    Dick, you appear to be making assurances about 3rd parties and data collection that Apple themselves wouldn't go so far as to claim. Here's what Apple says about those iBeacon-friendly apps like the ones MLB and Macy are currently testing:

    "If you allow third-party apps or websites to use your current location, you agree to their terms, privacy policies, and practices. You should review the terms, privacy policies, and practices of the apps and websites to understand how they use your location and other information. Information Apple collects will be treated in accordance with Apple's Privacy Policy."
    http://support.apple.com/kb/HT6048

    As an example of how convoluted that can be take the provider of the helpful magazine service profiled in this thread, Exact Editions. When you agree to their privacy policy they tell you you are also agreeing to:
    - Google's Privacy Policy
    - Flurry's Privacy Policy and
    - New Relic's Privacy Policy.
    :err:
    There's just too many fingers in the pie. Personally I don't see any way that consumers will ultimately be able to protect the details of all their little shopping trips and other assorted travels if they agree to use iBeacons but you could be right. Perhaps the potentially far-more-intrusive privacy issues attached to Beacons will wring themselves out as they come into wider use. Perhaps.

    There's also questions about just how "rigorous" the Apple tests are before applications make it to the App Store. I'm sure you've read the same claims as I have, including those made here by AI editors.
    http://appleinsider.com/articles/13/08/16/apples-approval-of-jekyll-malware-app-reveal-flaws-in-app-store-review-process

    I'm not at all saying that iBeacons are inherently malicious intrusions on privacy. On the contrary they have a lot of potential benefits for users of smart devices at home, shopping or in the workplace. It looks like they might make our lives much easier in some venues. At the same time you cannot make blanket statements about Apple insuring that everyone using them follows Apple's own privacy policies. They don't and Apple doesn't require them to AFAIK. As Apple themselves will tell you regarding iBeacons the privacy policies of the app provider are the ones that matter, not Apple's. Read 'em.

    It's way too early to know how Beacon technology, no matter whether it's Apple's or someone else's, is going to be used to benefit retailers, data resellers/aggregators, advertisers, employers etc. rather than the device owner. Beacons are not solely controlled by Apple in the first place. Their implementation is just one of several. With technology this new users need to read each provider's privacy policies before checking that "Agree" box. Just because Apple uses it too doesn't make it automatically innocuous and consumer friendly.
  • Reply 24 of 29
    blah64blah64 Posts: 993member
    I suppose the time had to come where I agree with a GatorGuy post. Cats and dogs.....

    Dick, much of what GatorGuy wrote here gets to the "meat" of what I'm trying to get at.

    Apple has created some kind of reference model, and they may stick with best practices themselves, but I don't see anything on the technology side you're describing so far that leads me to believe a system like this won't be abused. Yes, Apple has a pretty good curation system, but it doesn't stop companies like Flurry and their ilk from providing embedded tools that provide behavior tracking across an extremely wide variety of apps. If iBeacons/BLE usage follows a similar path, companies will sprout up that provide similar tools that track location on a very fine scale, on behalf of what could amount to any and all popular apps.

    While these apps may technically require users to opt-in, the reality is that most people don't understand what they're opting into, they just want to launch their shiny new app. My (admittedly anecdotal) take is that this is endemic on Android, where so many apps want access to so much of your data that people reach their fatigue point and just click yes to everything. If the apps require you to agree to everything, then often you can't use them at all unless you hand over your keys.

    Unless there are absolute technical barriers to this, I can't see how it won't happen.
  • Reply 25 of 29
    blah64 wrote: »
    I suppose the time had to come where I agree with a GatorGuy post. Cats and dogs.....

    Dick, much of what GatorGuy wrote here gets to the "meat" of what I'm trying to get at.

    Apple has created some kind of reference model, and they may stick with best practices themselves, but I don't see anything on the technology side you're describing so far that leads me to believe a system like this won't be abused. Yes, Apple has a pretty good curation system, but it doesn't stop companies like Flurry and their ilk from providing embedded tools that provide behavior tracking across an extremely wide variety of apps. If iBeacons/BLE usage follows a similar path, companies will sprout up that provide similar tools that track location on a very fine scale, on behalf of what could amount to any and all popular apps.

    While these apps may <i>technically</i> require users to opt-in, the reality is that most people don't understand what they're opting into, they just want to launch their shiny new app. My (admittedly anecdotal) take is that this is endemic on Android, where so many apps want access to so much of your data that people reach their fatigue point and just click yes to everything. If the apps require you to agree to everything, then often you can't use them <i>at all</i> unless you hand over your keys.

    Unless there are absolute technical barriers to this, I can't see how it won't happen.



    Fine!

    But, IMO, you're worried about the wrong thing -- like sitting on the beach applying sun protection as a tidal wave approaches.

    I posted this on another thread:

    I live in California where the state sells personal information gathered from individuals.

    So if you want complete privacy:
    • don't receive a paycheck
    • don't drive
    • don't vote
    • don't use banks
    • don't use credit
    • don't invest
    • don't use store loyalty programs
    • don't use store lay-away programs
    • don't rent or own a home
    • don't pay taxes
    • don't go to school
    • don't use utilities (Water, Gas, Electricity, Garbage, Sewerage)
    • don't receive retirement benefits
    • don't use insurance
    • don't use emergency services (Ambulance, Fire, etc).
    • don't receive medical care
    • don't subscribe to cable TV
    • don't subscribe to the Internet
    • don't use a phone, tablet or computer
    • don't travel or leave the country
    • don't rent a hotel room
    • probably a lot more don'ts

    I guess that means that you pay cash for everything, sleep in the park, wash in public restrooms and stew in your own juices. When/If you smell OK, you can probably hang out in your local pub, though...

    FWIW, it was 27º F last night in the San Francisco East Bay area
  • Reply 26 of 29
    Originally Posted by Dick Applebaum View Post

    FWIW, it was 27º F last night in the San Francisco East Bay area

     

    Seeing this the second time, I realize you weren’t saying C. I looked up the storm last night and I was pretty surprised at where it would be. You guys generally don’t fall below 40, do you? Think you’ll even get snow?

  • Reply 27 of 29
    gatorguygatorguy Posts: 24,271member
    Fine!

    But, IMO, you're worried about the wrong thing -- like sitting on the beach applying sun protection as a tidal wave approaches.

    I posted this on another thread:

    I live in California where the state sells personal information gathered from individuals.

    So if you want complete privacy:
    • don't receive a paycheck
    • don't drive
    • don't vote
    • don't use banks
    • don't use credit
    • don't invest
    • don't use store loyalty programs
    • don't use store lay-away programs
    • don't rent or own a home
    • don't pay taxes
    • don't go to school
    • don't use utilities (Water, Gas, Electricity, Garbage, Sewerage)
    • don't receive retirement benefits
    • don't use insurance
    • don't use emergency services (Ambulance, Fire, etc).
    • don't receive medical care
    • don't subscribe to cable TV
    • don't subscribe to the Internet
    • don't use a phone, tablet or computer
    • don't travel or leave the country
    • don't rent a hotel room
    • probably a lot more don'ts

    I guess that means that you pay cash for everything, sleep in the park, wash in public restrooms and stew in your own juices. When/If you smell OK, you can probably hang out in your local pub, though...

    FWIW, it was 27º F last night in the San Francisco East Bay area

    Wow, quite the list. And here I thought Google was the one to worry about. Instead we're doing it to ourselves through our own chosen representatives of the people.
  • Reply 28 of 29
    blah64blah64 Posts: 993member
    Quote:
    Originally Posted by Dick Applebaum View Post
    But, IMO, you're worried about the wrong thing -- like sitting on the beach applying sun protection as a tidal wave approaches.


    Trust me, I'm working on mitigating (no way to totally stop) the effects of the coming tidal wave as well, this is just a nitpicky side conversation. I would personally never use any product like this, and if it becomes pervasive and hidden in apps I'm pretty sure I can just disable bluetooth entirely. But yeah, I certainly understand what you're saying.

    However, your next comment:

    I live in California where the state sells personal information gathered from individuals.

    I don't need to even read the list that followed to ask this simple question:

    Does ANYONE think this is okay? It's NOT okay!

    I don't live in a cabin in the mountains, but I've reduced or even eliminated in some cases, many of the items you mentioned. In fact, I've take some level of measures to address in some way the vast majority of the items in your list. Our world, especially here in the U.S. is becoming nearly intolerable when it comes to really basic privacy expectations. Most Americans are like lobsters in the pot, stupidly enjoying the temporary benefits of "warm water", meanwhile the temperature is being turned up all around us until there's no way out. It's disgusting. Frivolous conveniences or "shiny cool stuff" turns so many people into mindless sheep. :-(

    Ignoring my minor rant here, backing up to the question above; don't you think what the state is doing is wrong?

    And it's not just the states, the feds have their fingers in so many things as well, as do local municipalities, sometimes under the auspices of the feds. It's a crazy world we're living in, in so many ways.
  • Reply 29 of 29
    blah64blah64 Posts: 993member
    Quote:
    Originally Posted by Gatorguy View Post

    Wow, quite the list. And here I thought Google was the one to worry about. Instead we're doing it to ourselves through our own chosen representatives of the people.


    It isn't always an question of either-or, sometimes the correct answer is both! ;-)

Sign In or Register to comment.