Hacker News Reader

Comment by kornhole | Hacker News Reader

Sometimes it feels ridiculous how much OPSEC I need to employ to buy anything at the grocery store. I walk or bike to the store to not reveal a license plate. All radios and sensors on my handset are turned off. I wear a mask to thwart facial recognition cameras. I pay cash.

View on HN

Honestly I think that this a problem that needs to be solved via legislation.

I think it's completely unreasonable to tell people to leave their phones at home all the time, or put them in some kind of Faraday cage whenever they go out, and it's become abundantly clear that we cannot trust companies to respect our privacy without ramifications.

Edward Snowden revealed that u need to remove the battery on ur phone to make it "safe", turning it off doesn't do the trick. [Which u can't do anymore]. As another commenter says: leave the phone at home.

What about a Faraday bag?

A faraday bag works (but be sure to test it).

Be aware, though, that phones will increase their radio power and retry constantly when they aren't reaching a cell tower. If the increased battery drain is an issue, put your phone in airplane mode first.

That is a great option.

anyone have any suggestions for a Faraday bag?

Two bags of chips. With or without the chips.

https://usa.kaspersky.com/blog/terminator-dark-fate-chips/18...

Wrapping it in aluminum foil works, too.

Anything that completely surrounds the phone with conductive material will do the job.

theoretically the phone could still record all audio and then sync with the cloud when back online, but I'm grasping at straws here.

In such case the solution is to have hardware kill switches, like on my Librem 5.

That kind of phone goes so far to protect your privacy it won't even let you use it to call anyone. (https://www.techrepublic.com/article/librem-5-review-the-lin...). The real solution is regulation with lots of teeth and oversight, so we don't have to depend on flawed products that don't work.

This is an extremely old review, when the software was in beta. Phone calls are working fine for me now.

Regulations are great, but I prefer to have both kinds of defense.

That's a good sign! I'd given up all hope for the Librem and pinephone. I guess it's time to take another look...

I agree that hardware switches are ideal, but I don't see them being common since most of the folks pushing out phones want to use those devices to collect data on the people who buy them.

Why would it, though? If you're the sort who puts your phone into a faraday cage, you're not the sort who will install an app from the stores.

zero day OS-level exploit by some govt? idk.

I thought we were talking about retail stores here, not governments.

If your threat model is governmental, then that's a whole different thing entirely. You'll have to go to true extremes to even have a chance at defending against that. For instance, you shouldn't have a cell phone at all.

Airplane mode has to be able to make it zero-emissions due to FAA regulations, right?

The FAA no longer prohibits this stuff, although the airlines still have their own restrictions.

The FAA also only ever had rulemaking about BT and WiFi, because the use of the cell transmitter in flight is prohibited by the FCC, not the FAA. I don't know what the FCC's rules are, precisely.

I am going to the grocery store, not blowing up a pipeline. I doubt Kroger is going to remotely activate my baseband modem. Even if they did, I have an anonymous phone with a burner SIM.

IME at Safeway if you don't use a "club card" you end up paying nearly double for many items. Are there ways around this?

Yes. Using real safe ways to shop elsewhere.

Local area code + 867-5309

In my formative years I rode the CTA a lot, and they always had an announcement, "call 836-7000 for transit information". The number was burned in my head and it's worked in every store I've tried. (You can add any Chicago-area area code; 847, 312, etc.)

Yes, it worked at a Safeway in San Jose too. I love that someone also had this stuck in their head and used it to sign up for grocery discounts.

One of the best rock tunes ever written, "8675309 Jenny Jenny" was a blazing meteoric hit by a band that produced few others:

Rendition of the song (bet you can't play it just once):

https://www.youtube.com/watch?v=boaJCrHNRMA

Story of the song (along with a history of problems/facts about the phone number itself before and after the song hit):

https://en.wikipedia.org/wiki/867-5309/Jenny

The band:

https://en.wikipedia.org/wiki/Tommy_Tutone

Shop at Walmart or just use a burner sim/phone. I don't care how much they are going to "profile" me if there is no connection to myself in any way

I deal with it by shopping at a reasonable store. Or, if there isn't one that prices reasonably, then I'll choose the expensive store that doesn't pull this sort of nonsense and is just expensive for everyone.

I have a store like this nearby and try to give them as much of my business as I can. It's refreshing: no membership rewards nonsense, no unclear or deceptive volume sale pricing, high-quality produce and deli, everything is exceptionally clean, well kept, and efficient. The employees by all accounts and indications mostly really enjoy working there (not all teenagers enjoy it), and in four decades of shopping there I've never had a bad customer experience that wasn't caused by another customer.

It does cost a bit more, but some of that is inherent because they generally carry stuff that is genuinely better. Despite that, some products are still very competitively priced, and the administrative and cognitive overhead of shopping there is significantly lower.

Thus far they've kept the large chain Orwellian dystopia entirely at bay. My shopping behavior doesn't make much of an individual difference to society but it's worth a premium to get a better product and to not feel like I'm contributing to The Great Race to the Bottom of Everything™ when I shop there.

Club card application information isn't usually validated, you can sign up for one with bogus information.

I think that's less valuable than one would expect for the average person.

For example if you rode the bus to the store and paid in cash then you'd have a low correlation coefficient.

The issue is most people (at least in the US) drive a car with a publicly registered license plate and use the same credit cards each time. And with things like facial recognition becoming more common it may be near impossible to hide who you are in the future.

> drive a car with a publicly registered license plate

Where is that info publicly available?

Most people are too lazy to get a PO Box and trust paperwork to hold their assets. LLCs work for this, also.

> Where is that info publicly available?

In my state, you just ask the DMV for it. For a yearly subscription fee, you can ask their servers.

Be me, 35 and using my parent's phone number for their club card.

Not in my experience, in fact if you go to similar lengths to wipe cookies and hide your online identity using other additional methods, when I needed to locate a replacement AGM battery for the stop start tech in a car, the best prices I was quoted were £400-£500.

Then used an account with a known online history, ie cookies not wiped etc, search engines and online retailers came back with prices for £100.

So in my limited experience, going to the lengths I did to hide one's identity online will cost you 4x -5x the typical price.

In some respects, these companies have also put a price on the value of online privacy, which is handy to have.

As someone who has had a limited input into supermarket clubcards in the UK, there is a lot of personal data that can be gained from this information even if the supermarkets dont go to the lengths they could.

I dont think people would be happy with what could be extrapolated, like working out how rich a family or shopper is, health conditions before they even get detected by medical experts, what religion they are, have they been made redundant. There is just so much meta data we give away, its quite shocking really.

In the wrong hands, people could carry out their own stealth agenda's. Back in the 90's people were injecting chemicals or tampering with food which prompted food companies to start using foil seals and other methods to ensure food tampering is/was spotted easily. Things like tampering with baby food and liquids.

It also gives the police and security services via court orders, a ready made dataset in order to build any case against you. Its bad enough people can be psychologically profiled using streaming services like Netflix or Amazon or Youview and satellite services connected to the net, but I dont think people value privacy personally and they dont understand how they can be manipulated once some information is known about them.

At the same time, the state has never had access to so much data in order to better target populations to control or manipulate for their own purposes, like we see with election manipulations that saw Brexit and Trump get into power. I saw some of those social media adverts and it was extreme psychological manipulation and even the BBC were involved with some of that data collection on social media.

In my experience, some criminals will operate over decades, cultivating scams especially when large sums of money like asset acquisition is involved.

Idk about Safeway but Stop n Shop/Giant lets you click "forgot my card" and get the discounts anyway, minus the reward points to your card

It should be illegal. If stores want to be open to the public, they shouldn't be able to force people to trade surveillance for cash discounts; grocery store shoppers are in no way qualified to evaluate either the short-term or long-term costs of selling their privacy, and not selling your privacy to every store you shop at becomes a permanent tax. If you want to offer discounts to members, stop selling to the general public and only sell to your membership.

If you get two or three keychain cards share them among friends?

Yeah I thought about this, and other ways of anonymizing. But now it seems that Safeway puts its best deals in their app, which requires login. Not sure that would be feasible to rotate with friends.

This is good because it pollutes the pool of data.

I actually stayed are a VRBO (like airBnB) where the owner left a rewards card for guests to use (so they'd get the deals at the grocery store and not have to sign up for their own for a regional grocery store).

enter (local area code) 777-1234.

I have used this across the country in random grocery stores and it has never failed me. I think I got this from some BBS text file...

> I pay cash.

Can we, today, be sure that ATMs do not record serial numbers of the bank notes they dispense?

;)

If they don't, that's the best startup idea I've heard on HN in a long time. I mean, it's evil and everything, but you could make a lot of money probably. Government contracts would probably pay out too.

10 bucks says Palantir saw the idea and are working on the pitch deck right now.

https://www.wheresgeorge.com/

The problem is convincing big store chains to put a new dollar barcode scanner machine in their checkout lines at every location, to do something that they have no trouble doing right now with credit card details, rewards cards, and bluetooth tracking.

Recently I’ve noticed multiple grocery store chains posting notices about how they no longer accept cash. A couple as of the new year.

Isn't that illegal?

Only illegal to not accept cash for debts. A merchant can refuse to do business with you in cash since you're not in debt at the checkout counter (as no transaction has occured)

Ah, I thought it was the claim about "legal tender". As in, my folded-up $10 bill is legal tender, and you (the vendor) must accept it, even if you don't like dealing with cash registers, coins, petty theft, and counting change.

It's illegal in San Francisco

hmmm, wonder if it's a preventing cash theft sort of thing with cashiers or something in that space.

It's a few things, most likely. It removes human error (did you give the cashier a $1 or $100 bill?), reduces risk of loss/theft of physical assets, reduces staffing costs (One person can operate one manual till, one person can operate 15? automated tills where they're basically just overriding weights and checking ID for alcohol), is probably _cheaper_ than handling cash (because you already have a visa/mastercard/payment provider contract who will give you discounts for increased volume, and they likely charge less because of the topic of this article).

The interesting thing is, both of these store chains already had fully automated checkouts, they simply removed the ability for these to accept cash and make change.

The recent proliferation of "digideals" which require that you scan item barcodes with your handheld also is also popular. These deals are usually very good, often half-price. But w/o a cellphone you're locked out of the deal.

There will have to be at least one store that takes cash, though, or the people who don't have cards or phones will starve.

What is your threat model? Are you buying incriminating goods at the grocery store? What do you gain by putting yourself through all that? Or what are you preventing / protecting yourself from?

> Are you buying incriminating goods at the grocery store

You mean hummus, right?

Or do you mean the store selling of your eating habits pretty much every entity out there. Pretty sure eating isn't HIPAA related, but correlated to potential health.

So the threat model is to prevent insurers from gaining knowledge that you buy 5L of sugary soda per week?

I agree there is some privacy concern, but I am having a hard time articulating how or why that data might actually impact a person in a net negative way.

What if I buy everything gluten-free?

http://web.archive.org/web/20071221122513/http:/cqpolitics.c...

I literally don't care if places don't do anything with this info, I'm saying they have no right to it. If they want it they can negotiate with me and I'll give them an insane price. Right now they just do it whether I consent or not.

A free person shouldn't have to articulate why they need privacy.

Privacy should be the default in free societies.

I can play this game though: you are pregnant, but have not shared that information yet with your family because it's early term and there might be complications. The grocery store accurately predicts you are pregnant from your shopping habits (change in diet, per-natal vitamins, "New Mommy Magazine"). The grocery store snail mails you a New Mommy coupon book as a "thank you." Your family sees this and confronts you, forcing you to reveal your medical status against your wishes.

This is a scary outcome WHICH HAS ALREADY HAPPENED. https://bit.ly/3S3hlrA

The commenter I responded to initially wrote as if they actively seek anonymity by taking several inconvenient steps every time they shop, even when they presumably have nothing to hide. I wanted to understand what drove that behavior and if it was worth it.

They don't have to articulate it, but inability to articulate might be a sign of overcautiousness / paranoia that is having a negative impact on their life.

If one has something to hide - then sure, take extra steps to be anon. Otherwise, why put yourself through so much trouble?

> what are you preventing / protecting yourself from?

I am protecting myself from having more data about me entered into databases.

Why is that important to me? For exactly the same reason that I have curtains on my windows.

But... why?

Much like you will never understand why someone would go to these lengths I struggle to understand how someone _wouldn't_. I can't understand people whose threat model begins with "these places I'm okay with someone knowing things about me".

If I read your email and then selected "metadata" I found important, walked into a very busy public square, and started shouting your secrets you'd be right to be uncomfortable. If I, for example, made a reasonably accurate prediction that you are pregnant/on drugs/have ED/etc and then told 10,000 people about this you'd be right to be angry.

Yet...you're okay with a company doing any of this? Is it because you can't see it or feel it directly? The head in the sand approach doesn't work. With enough datapoints in one bin anyone can use "metadata" to make extremely accurate predictions about your private life. You need to defend yourself from the constant gathering of this metadata. Snowden warned us and apparently very few of us decided to listen. All it takes is one leak, one hack, one disgruntled employee, or one bad government to take all those secrets you're not thinking about and turn them into weapons to use against you. In a modern battlefield you are a target and the war has been going on for decades now.

Consequences; when you have meaningful consequences around someone knowing what you purchased at the grocery store, you'll be justified in this behavior.

Until then, it's paranoia.

For my part, my "public" life has not once caused me negative consequences, and I've lived it this way for 34 years. Why would I live in fear of something that hasn't happened to me, anyone I know personally, is not recommended by any industry experts, is not presented as a risk factor by group responsible for my well being, etc.?

You need to prove that all of that extra effort is worth the degraded quality of life.

"I've seen this weapon used against other people, but I have nothing to worry about, they'll never turn the gun on me"

Also can be stated as "First they came for the socialists, and I did not speak out—because I was not a socialist."

Are there examples of snack food purchasing habits being used against somebody?

http://web.archive.org/web/20071221122513/http:/cqpolitics.c...

So no, since that’s not what was asked at all?

> You need to prove that all of that extra effort is worth the degraded quality of life.

No, nobody has to prove any such thing. This isn't an important issue to you -- that's fair. It is to others -- that's fair too.

You say "worth the degraded quality of life", but in my view, the degraded quality of life is always being under surveillance. Taking these measures improves my quality of life.

What I sacrifice is just a little bit of convenience. That's not a big hit.

You haven't justified the claim that "always being under surveillance" is categorically a bad thing. If you refuse to do that, you're kind of breaking the social contract around communication. Why share this belief if you can't defend it?

And what you sacrifice is a lot of convenience, and a wholesale rejection by the very society you rely heavily on to survive. It's not tenable to live in this society and wear a ski mask while shopping in a grocery store.

> You haven't justified the claim that "always being under surveillance" is categorically a bad thing.

I don't have to. It's sufficient for me to say that I strongly dislike it.

> Why share this belief if you can't defend it?

Why do you think this is something that needs defending?

Regardless, I think I have adequately defended it. It's an intrusion into my life that I don't consent to and I find highly objectionable. The reason I find it objectionable is exactly the same as the reason I object to someone following me around writing down everything I do, or peering into my windows at home.

> And what you sacrifice is a lot of convenience, and a wholesale rejection by the very society you rely heavily on to survive.

Neither of those things are true at all. I do not feel greatly inconvenienced, and I fully participate in society.

> It's not tenable to live in this society and wear a ski mask while shopping in a grocery store.

I agree. I don't do that. That said, if I'm aware that a store is engaging in facial recognition, I will choose to shop at a store that doesn't.

That, too, is engaging in the society I live in.

If it doesn't matter to you if you're understood, then you're just commenting for attention, and there's no point in reading anything else you write...

Obviously, it does matter to me if I'm understood. What I'm not understanding is what it is I'm not being clear about.

Edit: I think part of the problem we're having in our communication is that we're both coming from angles that are alien to each other, and haven't really worked out what each other is saying.

For instance, the questions you are asking me are difficult for me to answer directly because they make no sense to me in the context of this issue. I've been trying to interpret them in such a way that I can provide useful answers, but clearly I've failed. I suspect that's because we each have very different underlying assumptions.

Biggest thing is leave the phone at home

or in a Faraday cage/bag if you think you might want to call someone later, but it might be performing dead reckoning

But if you block ads and third-party cookies, which I'm 146% you do with this mindset, that data collection is of no use either way.

Is that actually true? They still might be using you for demographic details, and indirectly targeting ads at you for things you can't easily block.

I don't understand...

What does blocking ads and third-party cookies have to do with it? How does doing that affect the usefulness of real-world data collection?

I may have said it wrong. I meant that, because of ad blocking, it's impossible to show you targeted ads, that data collection doesn't do anything bad to you personally. They can't use it to try to sell something to you in particular because that requires non-consensually shoving information into you, via your own devices. They can still use it for analytics, of course, but that's not nearly as worrying as creepily targeted ads that follow you around everywhere.

Ah, I see. That doesn't address the issue for me. It's not the ads I care about, it's the data collection.

They have your fingerprints!1!!

Or are you wearing gloves?

They have your genes.

Or are you wearing clothing which limits the spread of particles from your skin and hair?

Well. At least they could have. If they really wanted to. Or anybody else.

> Well. At least they could have. If they really wanted to. Or anybody else.

You're lying here. I guarantee that you, LargoLasskhyfv, do not even have the ability to keep a nationwide database of fingerprints and DNA, and of course you couldn't bear the expense of physically collecting a DNA profile or the fingerprints of everyone in the country no matter how much you "wanted to." Yet, you are a member of "anybody." Are you just an outlier?

Well. Lemme try to explain. Starting with fingerprints, collecting them on an individual basis is not that difficult. From the handles of the shopping cart, for instance. Maybe better if they had been wiped clean beforehand by somebody, but since Covid many shops actually had their clerks, security doing that generally. So you'd just have to wait, and grab that one interesting cart, and take the prints off of it. By several means, there should be apps possible, for certain phones, with certain (flash)lights, doing that. Otherwise more conventional means are available. Still fast, with commonly available single use supplies.

Some fun thing from 2008 comes to mind, where people associated with the german Chaos Computer Club took the fingerprints of the Minister of the Interior from a glass, and published them :->

So this is really not that special.

More special, but not impossible would be the large scale gathering of fingerprints in shops, but again, that should be possible during scanning of the stuff you've put on the belt, and during scanning of the bills, for counterfeit checks.

Analyzing your genes from generally collecting particular matter raining out of your personal cloud may seem like science fiction now, but it's not that far around the corner.

OTOH, wiping them of some surface someone has seen you sneeze at is possible now. Just not that cheap.

Edit: Also https://www.spymuseum.org/exhibition-experiences/about-the-c... comes to mind.

I'll start worrying about that stuff when they start using that stuff. But they aren't right now, and the odds are they never will. The cost/benefit of doing so doesn't work out.

Reply on news.ycombinator.com