Comment by OptionOfT

14 hours ago

Well, usually the answer is no, and then when something breaks the app will tell me.

Which reminds me. Why does the CVS app need access to Bluetooth?

Oh! There's actually good reason!

If you have an Extracare card, in some markets, you can self-unlock the locked display cabinets with the CVS app (because they have your identity via the ExtraCare card which adds inherent trust).

It's powered by the Invue smartlock platform. https://invue.com/smart-locks

https://abc7ny.com/post/cvs-testing-new-nyc-shoppers-open-ca...

  • Very interesting. But I'd imagine they aren't doing proper KYC to get an ExtraCare card, I bet it is very soft KYC. Like phone number verification or card payment which you can get anonymously, so it won't necessarily do too much to find the perpetrator. I wonder if it works through throttling and blacklisting so the loss and damage radius are reduced.

    • At the same time, though, the thought is "a criminal won't give out their business burner's cellphone number" to sign up for a card/unlock a case. There's still an additional level of self-selection required to be honest enough to want to acquire the loyalty card that a "dishonest" person does not want to spend time doing (they want to snatch and run).

      Same reason Walmart gated the self-checkout Scan-and-Go-via-phone system behind a paid membership on Walmart+, criminal's not gonna burn fifty bucks to steal a couple times if they have to hand over anything vaguely close to PII, even if it's burner PII.

  • Ah, are you telling us that while people were outraged about rampant theft and pointing to all the locked-up merchandise as emblematic of the corporate response to rampant theft, even while there wasn't enough staff to unlock the cabinets... but the lockups are also a way to entice customers to install the app, sign up for an account, and enable Bluetooth all the time?

    https://youtu.be/zS9U3Gc832Y?si=BmVOHE6ahKLbw82c

> when something breaks the app will tell me.

Then you have to require these permission controls to tell the app the user denied permission, and not just giving a valid but empty result. Some people on HN feel strongly that when you deny contacts permission to an app, the app should receive a list of dummy contacts. Without it a bad app can lock its UI and not do anything unless the permission is granted.