London Bans Recycling Bins That Track Phones

judgecorp writes "In a swift response to a media storm, the City of London has closed down a trial of recycling bins which track the phones of pedestrians. Renew provides recycling bins funded by digital advertising, and has been told to stop a trial where bins tracked phones. Although the CEO of Renew claims there was no intention to breach privacy, his own marketing material says otherwise."

Comments

Removing bins will not fix underlying problem

[sinij]

Removing bins will not fix underlying protocol implementation problem. This has to be treated as any other vulnerability and patched, so it is not possible.

Re:Removing bins will not fix underlying problem

[ackthpt]

It is astonishing how few people seem to understand that.

Rather like war-driving in reverse. How times change.

Re:Removing bins will not fix underlying problem

[ericloewe]

Here's the problem:

If the user doesn't say "I want to connect to 'Trash can Wi-Fi'", why should the phone decide on its own to connect to 'Trash can Wi-Fi' without asking?

If the phone doesn't (stupidly) try to connect to any open network it sees, it doesn't broadcast its MAC address whenever some dubious access point asks for it.

Re:Removing bins will not fix underlying problem

[mspohr]

There is something I don't understand here.
If I have my WiFi turned on and it is set to automatically connect to "known" access points but not set to connect to random unknown access points, why would it broadcast my MAC?
I can understand that it will listen for a "known" access point and when it finds one, send the MAC to connect and that is fine.
However, why would it broadcast my MAC if it has no intention of connecting?

Re:Removing bins will not fix underlying problem

[cusco]

IIRC, the address space available for MAC addresses allows something like 1000 devices for each square foot of land area on Earth, so there isn't much chance of collision. Having said that, AC is wrong. DHCP reservations (used on many, many networks for hardware that needs to maintain the same IP address) require MAC addresses that do not change. Many manufacturers have sniffer programs that are needed to do installations and service on their hardware, which sniff the set of MAC addresses assigned to their company. There are lots of other reasons that MAC addresses are linked to a piece of hardware.

The issue here isn't that MAC addresses are unique, it's that users aren't bright enough or are too lazy to turn off wi-fi detection when they're not using it.

Re:Removing bins will not fix underlying problem

[icebike]

And there is no reason a MAC address should not randomize itself in between network connections.

No reason other than that the MAC address exists to uniquely identify the device connecting to the network. You seem to have missed the point of the MAC address. Some networks lock down access by MAC address as it is supposed to identify specific devices.

Your phone knows its real Mac, and the mac of the routers it has connected to before.
All it need do is use the same mac for any router it has seen before, or use its REAL mac when you request
a connection to any router.

Routers you don't CHOOSE TO connect to, have no valid reason to know your mac.

Re:Removing bins will not fix underlying problem

[icebike]

With your question, you've touched the heart of the problem.

Lazy software designers (those working for wifi chip designers) are sending mac addresses even while they are not associated with any network.
Some say that these only occur when you have previously associated with a hidden SSID network, but that is not the only case, and most
modern chip sets send a mac address all the time for no reason at all.

Its not part of the standard to broadcast your mac unless you are a router. But since the advent of ad-hoc networks, there are a lot
phones that broadcast it all the time looking to join an adhoc network. Furthermore, bluetooth also broadcasts its mac all the time
and often bluetooth and wifi are built into the same chip.

Re:Removing bins will not fix underlying problem

[fullmetal55]

because it's easier to change DNS entries in a DHCP Server than going around to 100+ individual devices to change the DNS entries when a DNS server dies. and since DHCP hands out more than just an IP, it makes sense to use reservations. thats why every DHCP server I've ever seen allows for reservations.

There are many other things that DHCP can hand out as well, DNS is simply an example. other issues are default gateway changes, subnet mask changes, voip server changes, Dynamic DNS updating. which are all fine on a handful of devices to manage that as static, but once you get into 100s, or 1000s, reservations make a lot more sense.

This is why...

[gstoddart]

This is why I keep wi-fi disabled on my mobile devices unless I need it.

I've found I don't particularly want my device to be phoning home to people when I'm not looking, and I've also found leaving wi-fi on absolutely impacts my battery life.

Stuff like this is only going to get worse as various advertisers decide they're entitled to more information than we're willing to give them.

Re:No prosecution?

[sinij]

>>>Why no criminal investigation, or at least massive fine?


Likely because phone is actively broadcasting information in the public space. If I go out shouting my Social Security number, others are not liable for overhearing it or even writing it down.

Who thought this was a good idea to begin with?

[s.petry]

Subject says it all. How was this allowed to happen? Garbage bins don't need to other people, they need to track when they are full and need to be emptied. I'm sure that this stems from a Government funding program in a black budget that the people of London (and other areas of the UK) have no idea they are paying for.

I do realize that the US probably has similar or worse programs that we are not yet aware of. I know they have been working on billboard advertising to track people and believe it has been implemented in NYC to some extent. We, all of the free people, need to put an end to this! Nothing good can come from this level of tracking people!