Your shopping habits are uniquely identifiable | Hacker News Reader

Your shopping habits are uniquely identifiable

theverge.com

40 pointssomberi22 comments

Patterns are uniquely generated in almost all types of information. What has been missing until the great rise of the World Wide Web is intent to monetize. Earlier companies sold you products like Microsoft Windows, Coca-Cola and Apple Macintoshes. Advertising paradigms like television advertising, radio, newspapers while really nice, had a "last-mile-connectivity" problem - you never really knew how you got your customer - through TV, radio? I do understand Nielsen and other ratings companies and some TV analytics historically try to ameliorate this, but the internet has been the greatest driving force in the last few years. Google and Facebook etc. and internet driven content engines have all traded eyeballs for content or products. As a result, the intent to improve advertising for the eyeballs (since presumably the eyeball count has a theoretical upper bound) has become the force du jour. Hence the ability to identify stuff was there, except for the machine learning part which has grown up from academia tremendously. It is just that now we have the intent to use all this to identify and collect patterns from all sorts of data. Whether that is good or bad or gray is another matter.

My role in the house is to buy the cat food and the hard liquor.

I imagine someone at the supermarket statistics centre studying my shopping habits and wondering how one family can survive on whisky and Friskies Chicken & tuna dinners.

It's not that uncommon - I had a meeting with wal-mart's data team once where they talked about how there are certain pairs of purchases that are highly correlated with male shoppers - beer and diapers was one I remembered.

While amusing to consider, I doubt there is an employe combing over records. Most likely, it's an automated system.

I came in expecting something like an Amazon shopping history. I don't find it too surprising that in-person purchases can be tracked so readily - geographic information is a huge dimension to add to these data. It would be interesting to see how many data points are necessary to achieve similar accuracy just with a purchase history. Particularly interesting would be matching users across websites.

While obvious to say, use cash.

Not completely true, as I only learnt about a week ago, back in the day an anonymous appartment of the Red Army Faction was discovered exactly because they paid their power bill with cash - something that's highly uncommon (even then) in Germany.[1]

So yes, buy stuff with cash in shops and/or if there's enough other people doing it.

[1]: german article: http://www.spiegel.de/spiegel/print/d-13519259.html

May not be long before shops go cashless. With increasing numbers of people using the magic plastic - cash may fade out over time. Also, bank notes (at least in the UK) sometimes have serial numbers so it isn't wholly foolproof.

In the US, banks and most businesses who accept cash track the serial numbers of 50 and 100 denominated bills. I would imagine that banks keep a handle on the serials of their 20s as well, which are by far the bills most commonly dispensed from ATMs.

"[citation needed]"

Most banks don't include the 2 I use, one of which is not small, nor does the grocery store that's the target of many of those $100 bills.

My work experience includes working in retail where we hand recorded the numbers on large bills each night and in the morning. I'm pretty sure banks track these numbers; what makes you believe yours don't?

But that's completely useless for this purpose unless the bank supplying the cash also recorded the numbers, and "mostly harmless" even if they were (see below).

What makes me sure the banks I use don't suitably track the numbers is that I show up to them with $20s just acquired from an ATM (saves time) and they don't take any actions that would allow recording of the numbers of the $100s they give me in return. The bills just come out of a slot in the usual drawer, the teller only count them by hand to make sure they're all $100s and that she's giving me the right number of them. I'd add that many people would notice if she ran them through an OCR machine before handing them over....

What you're talking about sounds more anti-counterfeiting efforts, $100s having of course the highest payoff, and at worst case they only reveal that person X shopped at that establishment the day before. Which I suspect is not typically damning, e.g. that I shopped at a grocery store without any details as to what I bought suggests that I'm a human that eats food, little more.

I wouldn't say I'm "paranoid" about this sort of thing, i.e. I pay cash locally more to avoid credit card fraud than to keep details about myself private, but I read the appropriate SF when I was young, and being a hacker in the sense of this forum I pay close attention to these things. As of yet in my corner of SW Missouri there's no sign of them.

The last time I with Drew a large sum from the bank, he did run it through accounting machine and most of those have OCR abilities.

Businesses I've been involved with write down the serial numbers of high denomination bills when cash drawers are filled. I wouldn't be surprised if banks were aware of which serials were in their cash drawers for inventory purposes basically.

It's true that the only real tracking that goes on with serial numbers currently to catch criminals is recorded cereals in bank robberies and black market transactions. However, the capability is there to construct some small amount of conclusions about regular people based on where bills go. I wasn't saying it's widely in use for everyday surveillance.

Presumably banks have something built into their money-counters and ATMs, but how does a regular cash business do this type of tracking? (I know personally several that do not.) For those that do track these, why?

Assuming you've never used non-cash, you mean?

If your purchase habits are uniquely trackable, upon switching to cash you'd need to modify your purchasing habits sufficiently to disassociate them from your past-self. Good luck!

> If your purchase habits are uniquely trackable, upon switching to cash you'd need to modify your purchasing habits sufficiently to disassociate them from your past-self.

I do not think that's quite right, at least in this instance. For the study in the article, the use of a single credit card number links purchases together, which is what enables the de-anonymization. If you pay with cash, there's no purchase identifier, so it is more difficult (impossible?) to link multiple purchases to an individual (anonymous) person. This potentially changes, if people are tracking serial numbers on bills.

The article's central premise is that the items purchased provide unique fingerprints to identify a person. As I understand it, the study used cc numbers to link records to build their system, then once it was built, they could use shopping habits solely.

Direct link to the research paper: ("Unique in the shopping mall: On the reidentifiability of credit card metadata")

http://www.sciencemag.org/content/347/6221/536.full

You can also buy anyone's entire credit card purchase history directly from FirstData (the behind the scenes processor for most of the credit cards in the world). It's not cheap, but it's most definitely for sale.

What these tools do is "generalize", which is essentially the same as "discriminate".

(If someone makes generalizing assumptions about another person, then whether this is based on shopping-behavior, or skin-color, is not relevant.)

Hence such tools should be forbidden, or at least their use restricted.

We should be so lucky. The problem with these tools is precisely that they successfully specialize, in substantial and generally-reliably detail.

No, the problem is that if these tools are incorrect then they are falsely discriminating. If they are correct, then they are freaky. And then there is the problem that you don't know when they are correct.

There's just too many things fundamentally wrong with this kind of application of technology.

Reply on news.ycombinator.com