Do You Have Privacy Concerns about the New MagicBands?

[Mike2023]

Overly targeted marketing. Knowing what I purchase is one thing but knowing which stores I enter, where in the store I go and how long I spend in each part is too much. Imagine a text message encouraging you to go back to a store you visited earlier in the day because Disney knows you're more likely to buy from stores you visited in the morning and spent more than 10 minutes in. It's stalker creepy.

Take this out of the Disney context. If it was a different company would you allow it? Would you allow it at home? I think everyone is giving Disney a break because we like them but they are still a large corporate entity and they are going to aggressively use the information that they collect.

I don't think we are going to see that level of location based tracking. Maybe they track you entering a store but I doubt there going to setup readers at different locations in a store.

Truthfully, I dont think there is going to be any location based tracking other then situations where you scan your card yourself. Like when using to pay or using a fastpass.

 

[k5jm]

I get your point and you do bring up some good ones. But, what would someone gain by putting that much effort into reading the cards?

There are lots of security scenarios where the "element" is looking for an upper hand. In this case petty theft, robbery, burglary, etc would be on the list. I am waiting to see the exploit for the RFID controlled doors.

 

[Mike2023]

There are lots of security scenarios where the "element" is looking for an upper hand. In this case petty theft, robbery, burglary, etc would be on the list. I am waiting to see the exploit for the RFID controlled doors.

There will be an exploit for the doors just as there are ones for the old style card doorlocks. Its inevitable and the fact that its RFID changes nothing. No system will ever be 100% secure.

But how would someone skimming the information (TBD on what info it might even be) of my magicband would help in the scenarios you provide that is not currently a risk without. I just dont see how me walking by your scanner and possibly you having the information on my card would make be more likely to be a victim then someone who has not.

 

[cslittle999]

I don't think we are going to see that level of location based tracking. Maybe they track you entering a store but I doubt there going to setup readers at different locations in a store.

Truthfully, I dont think there is going to be any location based tracking other then situations where you scan your card yourself. Like when using to pay or using a fastpass.

I would hope not but again I ask if this was at your local mall would you be as comfortable? In the end we're saying that we think Disney wouldn't do anything like this but once the infrastructure is in place it will become tempting for them to do it. They can even do it inside their existing privacy agreement.

When it's all said and done I will likely use a wrist band. I'm just going into it knowing that I'm giving up some privacy and the amount of privacy I'm giving up is likely to increase over time.

 

[Stacy's a freak]

One thing I am unclear about is if this is a non-removable thing. Do I have to wear this thing in the shower or can I take it off whenever I like? For me, the biggest ick factor is being stuck with an unsightly wide band on my wrist for a week of dirt and grime and if I will have ridiculous looking tan lines. (I'm shallow)

 

[Mike2023]

I would hope not but again I ask if this was at your local mall would you be as comfortable? In the end we're saying that we think Disney wouldn't do anything like this but once the infrastructure is in place it will become tempting for them to do it. They can even do it inside their existing privacy agreement.

When it's all said and done I will likely use a wrist band. I'm just going into it knowing that I'm giving up some privacy and the amount of privacy I'm giving up is likely to increase over time.

I don't think I would have an issue with it personally. I can't see it impacting me in a negative way if my mall knows I like to shop at X store versus Y store.

The more detailed information they have when it comes to marketing is only going to allow them to market more meaningful information to me.

 

[Mike2023]

One thing I am unclear about is if this is a non-removable thing. Do I have to wear this thing in the shower or can I take it off whenever I like? For me, the biggest ick factor is being stuck with an unsightly wide band on my wrist for a week of dirt and grime and if I will have ridiculous looking tan lines. (I'm shallow)

As of right now, everything points to a removable band. But no one is sure yet.

 

[k5jm]

I just dont see how me walking by your scanner and possibly you having the information on my card would make be more likely to be a victim then someone who has not.

You are not looking at skimming information. You are reading the ID number and using the ID # to track someone's movements. If you know when someone enters or leaves a resort, then someone can use that opportunity the try and gain access to a resort room. There have been more complicated scams pulled on folks at resorts.

 

[cslittle999]

I don't think I would have an issue with it personally. I can't see it impacting me in a negative way if my mall knows I like to shop at X store versus Y store.

The more detailed information they have when it comes to marketing is only going to allow them to market more meaningful information to me.

Getting you to buy things isn't always in your best interest. Imagine deals that are only offered when your kids are with you. It isn't marketing to kids but it makes it harder to say no. I'm not saying that Disney would do these things but just that it is possible.

In some ways this is no different than tracking cookies on the web. Sometimes we want advertisers to know where we've been and sometimes we don't.

 

[CruellaDuVille]

Do I have privacy concerns? Yes, but not with Disney. Disney does not sell my information, my bank does.

 

[jackieinJuneau]

I have 99 things to worry about but the magic band isn't one

I have no issue, the more information that they have the better the crowd control. Even the idea of them being able to track my every move, not that they can at this point doesn't bother me. Targeted marketing, my web browser already does that and I have found some really great stuff that way!

I can't wait to try this system out; I am going on my Honeymoon in Oct and hope everything is up and running!

 

[Mike2023]

You are not looking at skimming information. You are reading the ID number and using the ID # to track someone's movements. If you know when someone enters or leaves a resort, then someone can use that opportunity the try and gain access to a resort room. There have been more complicated scams pulled on folks at resorts.

But you wont know that information from what you are describing.

Let say im standing by the front door of a resort with a device you describe. Only information I would be able to obtain is the number on the card and the time that I acquired the information.

- I would not know who that information is linked to.
- There would be no way for me to know what room that person is staying in
- There would be no way for me to gain access to that room if I did indeed figure it out somehow.
- I would not know if that person was coming, or going, all I would know is they walked within a perimeter of me.

my point is a device that you describe in someones pocket would not allow you to "track movements" anymore then can be done now without said tools.

Its interesting to think about though.

 

[Mike2023]

Getting you to buy things isn't always in your best interest. Imagine deals that are only offered when your kids are with you. It isn't marketing to kids but it makes it harder to say no. I'm not saying that Disney would do these things but just that it is possible.

In some ways this is no different than tracking cookies on the web. Sometimes we want advertisers to know where we've been and sometimes we don't.

I kinda get your point but I have no problem saying no to my Kids. So would not bother in the least. Marketing towards kids is in no way a new idea, and your right, it does work.

Thats a good point about tracking cookies, it really is the same thing.

I guess I'm just different then most as targeted advertising really does not bug me. If I'm interested in a product or service then I will buy it. If I'm not interested then I won't. But if I don't know about the product or service then there is no way for me to take advantage of it.

 

[zianha]

One thing I am unclear about is if this is a non-removable thing. Do I have to wear this thing in the shower or can I take it off whenever I like? For me, the biggest ick factor is being stuck with an unsightly wide band on my wrist for a week of dirt and grime and if I will have ridiculous looking tan lines. (I'm shallow)

Sadly, this is my biggest concern. Plus, I don't even like wearing a watch. I'm shallow too...

 

[k5jm]

my point is a device that you describe in someones pocket would not allow you to "track movements" anymore then can be done now without said tools.

Its interesting to think about though.

All it takes is a visual confirmation, ie watching the person come out a room and getting the UID of the RFID Tag. We ran an identical test of people leaving our parking garage at the office with RFID tags on their windshield. All you had to do was write down the tag, make, and model after reading the tag. There is nothing that is automatic, but some level of social engineering and/or ground pounding is always required. So putting a Cellular Card on the Single Board Computer with the reader allows you to be notified remotely if someone passes the reader that has been placed by an exit/entrance door.

 

[Mike2023]

All it takes is a visual confirmation, ie watching the person come out a room and getting the UID of the RFID Tag. We ran an identical test of people leaving our parking garage at the office with RFID tags on their windshield. All you had to do was write down the tag, make, and model after reading the tag. There is nothing that is automatic, but some level of social engineering and/or ground pounding is always required. So putting a Cellular Card on the Single Board Computer with the reader allows you to be notified remotely if someone passes the reader that has been placed by an exit/entrance door.

So this is a different scenario then before.

Example,

- Someone is walking the halls with device in hopes that someone leaves there room. Once that happens they note the id of the card, and room number of the person.
- Then sets up a remote scanner the front of hotel in hopes that this person walks out the front door when they leave thus tipping them off that there room is empty.
- Still no way to get into the room
- no reason to think there would be anything in the room worth the trouble.

Yes, this possible. But very unlikely that someone would go to these lengths. The risk vs rewards is very low in this situation.

I think it way more likely to have an untrusting housekeeper.

I want to point out as well that the RFID cards that are being used, and have been in place for 6 to 8 months are susceptible to this as well. So the Magic Bands don't add any vulnerability in this situation. They might make it a bit easier as they are powered and are easier to read.

 

[k5jm]

So this is a different scenario then before.

Example,

- Someone is walking the halls with device in hopes that someone leaves there room. Once that happens they note the id of the card, and room number of the person.
- Then sets up a remote scanner the front of hotel in hopes that this person walks out the front door when they leave thus tipping them off that there room is empty.
- Still no way to get into the room
- no reason to think there would be anything in the room worth the trouble.

Yes, this possible. But very unlikely that someone would go to these lengths. The risk vs rewards is very low in this situation.

I think it way more likely to have an untrusting housekeeper.

I want to point out as well that the RFID cards that are being used, and have been in place for 6 to 8 months are susceptible to this as well. So the Magic Bands don't add any vulnerability in this situation. They might make it a bit easier as they are powered and are easier to read.

Any passive RFID is exploitable in this manner (and this was the scenario I was talking about originally. There is no value is skimming information since there is no information on the MagicBands other than the UID.)

The RFID side is not battery powered, but the Zigbee side is powered and encrypted.

 

[Mike2023]

Any passive RFID is exploitable in this manner (and this was the scenario I was talking about originally. There is no value is skimming information since there is no information on the MagicBands other than the UID.)

The RFID side is not battery powered, but the Zigbee side is powered and encrypted.

So you agree then that the bands are not worse off then what is currently out there?

 

[sayhello]

Overly targeted marketing. Knowing what I purchase is one thing but knowing which stores I enter, where in the store I go and how long I spend in each part is too much. Imagine a text message encouraging you to go back to a store you visited earlier in the day because Disney knows you're more likely to buy from stores you visited in the morning and spent more than 10 minutes in. It's stalker creepy.

Take this out of the Disney context. If it was a different company would you allow it? Would you allow it at home? I think everyone is giving Disney a break because we like them but they are still a large corporate entity and they are going to aggressively use the information that they collect.

They can only text you if you give them your cell phone number. That's not required information.

I already allow my grocery store to track what I purchase and when. I don't really care, and I get great discounts. The targeted coupons I get when I check out, nine times out of ten end up in the recycling bin.

Sayhello

 

[fall08CP]

Since I haven't been following the development closely and I don't plan on visiting WDW in the near future, are the bracelets cheaply made? Easily programmed? I feel like I'd want to take it off the second I left the park, but what if I accidentally left it in my room and didn't realize until I got to the park? Does Guest Relations re-issue them?

It's all confusing to me. I thought the KTTW was just fine I used to work front desk @ Disney so I'm trying to get the logistics down. Seems like a bracelet would be more difficult than printing a KTTW.

Thanks in advance The security concerns are really interesting, and seeing behind the scenes at Disney really opened my eyes. I don't want to overshare but there's a lot that really surprised me.