Now that the privacy pendulum is swinging the other way I'm curious if Apple will ultimately be the undoing of this thing they helped create. If devices using iOS 13 start broadcasting a constantly changing bluetooth ID as a part of the new "Find My" feature these systems won't be able to track users from beacon to beacon or know how long you were in range of a single beacon.

This will probably wreak havoc on traffic counters and other infrastructure that use bluetooth bacons to do things like monitor highway congestion and foot traffic

This is incorrect. Your phone detects the beacons, not the other way around, and then forwards the notifications to {insert app here}, and then the app sends information (beacon id, user_id, ...) to their servers.

I actually implemented a nearly identical system for my senior design project, except we targeted the smart home ecosystem. Basic use cases would be automatically turning on/off lights or having a music stream/temperature preference/... follow you as you move throughout your house and enter/leave rooms. All implemented by an app on your phone detecting strategically placed beacons.

> If devices using iOS 13 start broadcasting a constantly changing bluetooth ID

They've always done this. I think you have your threat model inverted. Beacons aren't tracking phones around stores.

3rd party SDKs installed in apps are tracking user's indoor location via beacon triangulation and uploading that data. A subtle, but important difference.

Shouldn't Apple ban apps using those SDKs? Is it identifiable from a source scan or binary trawl?

The issue is that there are legitimate uses for this type of code, though. For example, I have my home set up with tons of automations that change, for example, the color of the lights when I'm in the kitchen vs. when my wife is in the kitchen. She prefers warm lighting and I prefer the daytime lighting. It's the same technology, it's just being misused in these commercial instances, in my opinion. People don't actually know that they're agreeing to this type of usage.

I think so, seems to be the logical progression of their crackdown on particularly egregious 3rd party analytics implementations.

In ios 13 they added bluetooth and wifi access as privacy toggles. Does this prevent this sort of tracking by apps if turned off?

I was working with Target when they did this roll-out. As sinister as everyone here seems to make it sound, I can assure you at that time it was not. If you're familiar with the inception of corporate projects, this project was no exception to any of the stereotypical fumbles and foibles of any effort of this scale.

It began simply because Apple said "...iBEACON.." and everyone corporate wanted the new buzzword in their portfolio to let people know how hot/hip/tech they were (toys -r- us considered it for awhile) so they could pull the kids away from the internet and back into brick-and-mortar. How can we use these? What are they good for? No one really cared, they just wanted them in the store and we were there to sell them that (at a premium).

In 2015 - indoor location was bogus. Everyone in this forum seems confident that there are multiple ways you can determine location with Wifi (round trip packet time) or bluetooth (RSSI). A cacophony of radio in a catastrophically noisy environment does not work to provide reliable location information.

In fact - it was so bad, that there were a handful of other equally unrealistic solutions being pedaled by everyone from universities to light-bulb manufacturers. One such solution was to profile the accessible space of a building using a phone's compass, and then use the observations from a client device compass to identify how generated patterns correlated to the profile for the building.

The torrent of data you see pouring from your phone to the service via wireshark is real-time sensor data that is being used to feed a service side bayesian / markov-chain / monte carlo / kalman-particle filter / keyword soup monstrosity trying to generate some possible marginal confidence in a probable location. We found that this system was most effective in turning your phone into a pocket warmer, but sold like hot-cakes in a B2B setting wherein the intended end user had absolutely no voice.

Corporate wanted to buy it so they could sell advert-space (pop-up coupons) to affiliates. So we sold them something that worked barely well enough to provide a one-popup demo to potential interested parties. The affiliates bought the magic, corporate paid our company an arbitrarily large quantity of dollars for the service.

A deployment of thousands of coin-cell driven beacons per store, placed within reach of bored youths, maintained by an underpaid associate staff is of only questionable utility.

On a scale of things to worry about, ranging from nuclear holocaust to e. coli in your produce - this ranks a solid -3. In fact, in the 4 years since I've worked in this field I think the only advancement that has been made is that it's harder for third parties to sell because no one can do it well, so why not just do it in-house? It's cheaper and has the same garbage result.

If you think I'm wrong - go do it yourself. All these signals are easily grep-ed within any store (there's no way to make it proprietary), and you can create your own model and out-sell the proprietor. Surprise me. With an actual, viable client-oriented product (and assuming users actually want reliable indoor location) you'll make bundles selling it to the valley. Everyone is trying to do it (even cisco tried for awhile) - no one has.

Michael Kwet has read all the marketing copy, and rewritten it for popular consumption as a product. The insight/value provided by these systems is far more sparse than implied.

Such data is usually so noisy and incomplete that you cant get any actionable value from it.

The more complex a method is at tracking someone, the less reliable it is.

People fear too much of what can be done with the fancy ways of tracking while overlooking simpler ways that are much more effective.

All new technology is overestimated in the short term, and underestimated in the long term.

Bluetooth 5.1 promises a sub-meter accuracy in distance finding using Bluetooth beacons. When those devices become available you'll probably want to re-evaluate those statements.