I created an account while in the store with an email of fuckyou@thisisstupid.com and a basic password and surprisingly didn’t have to verify the email. Then turned on a VPN to my house.
I plan on just creating a new account every time I go in just to fill up their database with nonsense.
GIGO (Garbage in, garbage out) is the correct way to deal with the surveillance system.
This makes me feel a lot better about ChatGPT garbage corrupting Google search results.
Fun fact: Android developer options has a Disabled Persistent Mac address randomization toggle. Or at least Pixel phones do
Cool, is samwaltoncaneatabagofdicks@inhell.com still available?
It is not. You need to add a number at the end.
inhell.info is available and Postfix is a thing.
You do realize that they are actually tracking the device itself by the hardware MAC address and other device fingerprints.
The email is just a bonus to let them legally spam you. Anti-spam laws have an exemption. If there’s a prior business relationship like shopping in their stores, they can put you on their spam list unless you opt out.
Bogus email only helps for spam but doesn’t do anything about tracking.
EDIT: For Android when there’s a Captive Portal like the screen shot. devices will use Persistent randomization which while not the hardware MAC will remain the same for the same network where they can track your visits.
Pretty much all modern phones randomize the MAC address everytime they connect to a network unless the user explicitly says not to do that.
randomize the MAC address everytime they connect to a network
+1, had issues using Android devices for presence detection because of this very useful privacy feature. Even on your home network, the MAC address and device hostname get randomized, unless disabled in the settings
Edit: typo
When there’s a Captive Portal like the screenshot, many devices use a random but persistent mac for that network avoid reauthorization after any network drop. This will make your access to the specific network trackable.
chuckles in GrapheneOS
(per-connection random MAC, for all networks, by default)
This is actually just part of stock Android. My Pixel 5 has MAC randomization on by default for new Wi-Fi networks.
It’s per-network, not per-connection. Though that option does exist but is hidden away under developer settings.
Oh you mean like per TCP connection?
But can’t you go manually forget the network in your device network options to circumvent this?
I’d assume after a certain amount of time or after moving far enough away from the network it “forgets” the last randomized MAC address?
It doesn’t really make sense to store these things long term.
GrapheneOS let’s me do a per-connection randomized MAC.
I’m sure they do collect a lot more about my device, but there’s not much I can do about it short of wrapping my phone in tin foil.
Don’t forget to disable wifi and bluetooth before approaching the store, as those give off unique identifiers too.
Don’t forget to spoof your MAC address so they cant see who is making the fake accounts ;D
That’s done automatically on mobile devices
This is the way. Fuck them.
Literally 1984
Should’ve clicked to have it reevaluated.
NB4 VPN
I think the point of this post is all the stuff below the email field. Yikes.
That data isn’t nothing, either. Over ten years ago, Target was able to use shoppers habits to determine when women were pregnant, sometimes even before the women knew.
https://www.nytimes.com/2012/02/19/magazine/shopping-habits.html
Imagine how much more robust this has gotten 10 years later.
Exactly, a damn good reason to avoid the Wi-Fi in stores altogether. So many wifi access points are super weak in security and super sketchy.
I try sticking to my home where I can manage it like a nervous hawk.
Now they can tell when women are pregnant before they even have sex.
Would using a VPN remedy this?
Not really. With https luckily being the default, at most they could get the sites you were going to (I don’t think dnss is dead, but it’s been very slow to grow unfortunately).
They could probably see if you’re checking Amazon or Google, but wouldn’t be able to see what you’re looking at exactly. Theoretically they could use cameras and or triangulation to see what you’re in front of when you use the Internet, but a VPN would still show traffic so they’d know you’re looking up something.
The big thing this would do is act like a loyalty card… They give you some amount of benefit in exchange for tracking your purchases in ever higher detail. Mostly it’s just like that, except they’d also be able to see how long you are in the store, and ideally they can link it to your purchases so they can infer more about it
FWIW, I wouldn’t only consider giving them a disposable email
Bub, they always did this.
They just tell you that they’re doing it now.
I was responding to all the people who said “just use a fake email,” bub…
Well now they can legally use that data since you now have to agree to the terms.
In the EU they already had a complaint, because it violates GDPR, but in any case I would never use a public WiFi without a VPN, and even less in places with these conditions, there is also free WiFi in some Rstaurants (even in most McDonalds), public Libraries and others. Fuck surveillance advertising
There’s just no reason to unless you are really skimping on phone data. Random wifi hotspots are one of the most dangerous things for an average joe in terms of infosec.
Agreed. My iPhone connects to my home VPN via Wireguard as soon as I leave my home WiFi. Has the added benefit of pihole ad filtering everywhere.
Have you experienced any downsides to using pi hole? Does anything stop working?
Obviously the first ad links in google don’t work any more, which drives the wife crazy ;-) Also nowadays more and more websites complain about me using an adblocker.
But technically, not really any problems at all.
I used to before but my family was extremely bothered that they couldn’t click on ad links. If I remember correctly, it’s pretty easy to set up if you want to just try it.
In the 6 years I’ve ran mine, I’ve not had any issues and I run a blocklist with over 1 million domains on it.
If I was to run into something that’s blocked that I do want loaded, I can just open the pihole interface and either whitelist the blocked domain or disable blocking for a short time, each with just a couple clicks.
Wireguard and PiHole combo is such a blessing.
So the first thing you give any sketchy WiFi is your home address?
Yup. What are they gonna do that every other portscanning bad actor isn’t doing 24/7 already?
Also, how would they distinguish between my private VPN and that of a commercial provider?
I was about to say… Isn’t using public wifi’s extremely dangerous?
Yes, because of this using an public WiFi without VPN is a no-go
Went to a Walmart the other day and my phone automatically connected to a wifi that was apparently hosted by my cell carrier. Immediately turned on my VPN because wtf. I disconnected at first then realized I didn’t have any service at all which was probably why it existed. Thankfully didn’t need to log in but that’s why I have Firefox relay.
I have seen it on Europe… maybe there was some way to circumvent it hidden away, not sure. But you could type a random email and that’s it, like they don’t send anything to confirm the email or anything once you submit you have access to internet.
Better to send a disposable mail, where yo can receive the log data before it expired.
eg
- https://maildrop.cc
- https://altmails.com
- https://www.disposablemail.com
- https://www.lazyinbox.com/#/
- https://www.guerrillamail.com
etc
anonbox from ccc
They seem to explain pretty well how your data will be used, why would this violate GDPR?
I might be wrong but i think it is because they don’t give you the option to opt out and use the wifi.
Should they? I would simply not connect to their Wi-Fi and move on, it’s not like they are obligated to provide you internet.
No way to opt out?
Right, and this Walmart in Europe would be where exactly?
https://storelocator.asda.com/directory
Asda is Walmart
That’s England so no gdpr anyway
UK gdpr not withstanding, the question asked was: where in Europe. UK remains a part of Europe post brexit.
The provisions of the EU GDPR have been incorporated directly into UK law as the UK GDPR. It’s ok to not know this stuff but it only takes like 10 seconds to google before you comment about something you don’t know.
AFAIK it does not exist in Europe, but I meant that these conditions in the EU would not be tolerated. Maybe because of this there isn’t a Walmart in the EU, there are a lot of Malls from other companies and none of these use this practices in their restaurants, mostly with free WiFi for their visitors. Offering free WiFi is already enough of a benefit for them, because it attracts customers, they do not need to intrude on their privacy with an obvious attempt to spam them and make money with their data.
Why would anyone interested in privacy connect to any public WiFi? That’s crazy.
More like “we were doing this before, but now we have to tell you we are doing it”.
For the email, you can use an email alias service like Addy or SimpleLogin. They’re both open-source and offer free tiers. I never give out my real email to anyone now except actual contacts.
After that, I think a VPN would probably still work to disguise what you’re doing from Walmart, but I’m not a 100% certain on that so I won’t link any.
But yeah, definitely use email alias wherever you can.
Do you do that with utility companies and bills?
I do.
I use SimpleLogin and ProtonMail.
Some sites have I’ll actually know you’re using SimpleLogin though and just say no, but they’re few and far between.
You could also use your own domain if you have one or buy a cheap one.
Then you can create as many as you like and just kill them as and when you need.
SimpleLogin has plugins for all browsers and phones so it’s not too difficult to create new addresses.
I do and it works great! I mostly did this to limit the blast radius of breaches, but aliases also provide an easy way to send those kinds of things to both me and my spouse.
I do it with everything. The only people who have my real email address are my family. Everything else is a masked email. It’s especially nice because if I start getting spam on one email I can immediately tell which site sold my info and I never use that site again.
Fake email and vpn = Free private connection
You dont even have to type a real email it doesn’t verify anything. Just something@somewhere.xxx
The amount of success I’ve had with optout@businessdomain.tld is unreal
I personally use .@dot.com or dot@dot.com because it’s fast to type lol
I usually do
thepresident@whitehouse.govWorks most of the time.
I sincerely hope no one has the email
test@testtesttest.combecause ohhhhh boy have they been getting some emails.It was you!!
I literally just mash characters in an email format. Qjsi@ka.aa is a valid email as far as these things are concerned.
Next time try @@@@@@@@@@@ and see if it works
deleted by creator
@@@@@@@.@@@
Pedantic but
vpn free
Boy I hope not
I’d like to hope they mean the VPN they pay for for other… uses. So it’s no extra money, cuz they already are using it at home to download Overwatch VR Porn.
There was an equal sign in between those words. Idk if it’s visible on your end but I see it on mine. That being said, the only free vpn I would use is protonvpn. Downside is it’s slow and unstable due to using a free plan.
I use https://temp-mail.org/en/ when signing up for one time stuff
Yeah I use simplelogin but for stuff I don’t care about like this I’d probably use that or spam keyboard for fake email
Walmart, the biggest grocery retailer in the entire United States, uses face tracking in the majority of their stores in several sections, and we’re concerned about their Wi-Fi?
The Wi-Fi seems like such a minor problem compared to them collecting massive amounts of data off of something you aren’t consenting to explicitly.
Like you walk into their stores and they can know: How often you visit, what items you buy, what payment method you use most often, what items you looked at and what aisles you visit, who you bring with you, what your kids look like, what disabilities you may have, size of your household, and whatever else they want. There’s basically no respect for any privacy in their stores.
The US is a privacy nightmare in competition with China. Most of the US doesn’t have any option over their privacy. You just don’t get it here.
It’s even worse as an associate. They make us sign up for some social media I never use, download apps on our phones, and make us give them our handprints for a machine to take out our tills. And we’re getting face scanned by cameras all day. Dystopian nightmare and it makes me feel ashamed to have accepted the job here.
I use GOS and therefore believe that I have some level of protection on the WiFi level based off of that, and I have their apps on a separate profile but it’s getting tougher on privacy here at Walmart.
Edit: That’s also why I have no pictures of me in my socials and deleted my Facebook, Instagram, and twitter, so they shouldn’t have too many ways to market to me aside through my debit and credit cards possibly.
Revoke the data privileges of the app on your phone. That will effectively neuter it, while you can show them it’s there.
I have all of their apps on a separate profile. One app I do sadly need data for to check my schedule and look up prices of things.
Not sure about this Walmart case but most you can write any email like random letters a@gmail.com or not even the Gmail part as long as it’s a valid looking mail and then works like you don’t even have to confirm the email or anything.
my goto is go.fuckyourself@leavemealone.net
I like steve@yahoo.com
If he was lucky or early enough to get a single name email then I’m sure they can handle some spam emails or get an email full of numbers like the rest of us
this is incorrect for the walmart case, next step is the password for the account, so you need to login or create a Walmart account for access
Oh yeah I see I mis read the prompt, I thought it was going with a enter you mail as alternative to using an account.
Expecting privacy on someone else’s network is absurd.
I always give some bs emails in those authentication forms. Mainly because as a client who tries to connect, I do not have internet access, so I cannot verify my email before they give me the access. And when they gave me access, there is no power in the world to make me do that 🤷
I used to spoof my MAC to connect to Xfinity Wifi hot spots. I would give them emails like “eet4dickComcrap@gmail.com”
I found a script for bypassing captive portals on Linux back in the day…
The full functionality of how it works escapes me at the moment, but essentially it searches the network for a host that possibly already connected through the captive portal and spoofs their MAC address.
This isn’t the one I originally found, but its the same principal and a Kali tool, so it may be considered more secure than the original bash script I copied back in the day:
I used to use an android app that shared log ins for public Wi-Fi even with a password to connwct. It was great as it automated the log in screen too, so was usually seamless.
Android automatically spoofs your MAC for every network and regularly changes it for each one too unless you explicitly disable that after connecting.
Makes static DHCP leases a PITA.
Yup.
unless you explicitly disable that after connecting.
Never trust an open network. Even if the company providing isn’t doing anything shady, the easy at which MITM (man in the middle) attacked, can be performed means that many insecure (and some secure) networks can be spoofed with a small amount of know-how.
Always make sure your connecting to a safe, secure wifi network, in a place where you expect that network to exist at.
If your phone connects in a place you wouldn’t expect it to connect, double check what it’s connecting to, and if necessary, disable your wifi.
How would they do man in the middle attacks? Don’t you need to trust their certificate first?
That mechanism only happens after you connect to it, you have to connect to the wifi in order to download the certificate to connect. And it doesn’t apply to all open WI-FI. A someone can still spoof the wifi. The fun part is when they set up their own false “I agree to the usage” pop up page that just steals your data - standardised systems like this are easily spoofed, especially when it comes to open and insecure wifi. They could even send you a bogus certificate that routes all the traffic through their gateway, allowing them to spy on the secure connections.
You do realize they were almost certainly doing this before, right?
More of shock value of them announcing it and requiring an email now.
Damn now I have to put in my real email! noooooo I don’t know how to avoid this only real emails work?
I’ve never had this happen before so I didn’t know. I just thought it was interesting how they’re requiring this now though.
It’s a good thing they don’t have high resolution cameras tracking everything you look at, or they might know what you were thinking about buying
It’s a good thing I don’t have any socials for them to trace me back to. And since I work there, I’m always looking at shit that will prolly throw them off.
it’s not like they weren’t doing this before
