cross-posted from: https://infosec.pub/post/8862635
“Only because of that official investigation did Canadians learn that ‘over 5 million nonconsenting Canadians’ were scanned into Cadillac Fairview's database”. Wow.
This Wired article is contradictory. The spokesperson says:
“an individual person cannot be identified using the technology in the machines. The technology acts as a motion sensor that detects faces, so the machine knows when to activate the purchasing interface”
I suppose it’s possible that a sloppy developer would name an executable
Invenda.Vending.FacialRecognitionApp.exewhich merely senses the presence of a face. But it seems like a baldfaced lie when you consider that:“Invenda sales brochures that promised ‘the machines are capable of sending estimated ages and genders’ of every person who used the machines—without ever requesting consent.”
Boycott Mars
I already boycott Mars because they are a GMA member and they spent ~$500k lobbying against #GMO labeling -- and they have been blackballed for using child slave labor -- and Mars supports Russia. This is another good reason to #boycottMars.
Update
Apparently a LemmyBug replaced the article URL with a picture URL. The article is here:
https://www.wired.com/story/facial-recognition-vending-machine-error-investigation/
The vending machine pic is here:
https://infosec.pub/pictrs/image/2041d717-7cd7-4393-94f3-96aa87817aa7.jpeg
I worked for a place that wanted to do face and gesture recognition with a Kinect in a kiosk. The devs had objections, but were ignored. We also didn't launch anything and the exec team got canned, so there's that.
It's entirely possible to activate the screen on "I think that's a face" as well as have some local-only software guess age/sex and mix with engagement data for analytics. Whether anything is captured, fingerprinted, stored, or uploaded... anyone's guess.
It's a little skeezy because it's non-obvious, but doing the anonymized metrics isn't more invasive than someone with a clipboard watching and taking notes on who buys or not.
Of course, then some dumb manager fuck decides to outsource that local software to "the cloud", and you've basically got a spy camera again.