Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

An insurance company’s API exposed customers’ car location histories

andreascarpino.it

Post reply on HN
Print view View original

41–50 of 69 posts

Re: An insurance company’s API exposed customers’ car location histories

#41

Post by haburka »

kosma wrote: post #2

Until there is some kind of law in place that makes companies financially responsible for this kind of blunder, it will proliferate. In the current state of affairs it's simply not economically justified to implement proper security.

There are extensive laws in place that protect the personal information of patients and students. If a hospital had this same issue, then it would be fined and depending on the state, it would have to inform all of it's users that it may have leaked personal information. Similarly, educational instituons will not share your educational record with your parents no matter how much they beg unless you're a minor.

It's not a stretch that there should be laws that affect all companies that collect data on their users. I hope it happens soon! These companies should be paying quite a bit in fines for these mistakes, not just a few thousand for a bug bounty. Otherwise our personal information will most likely leak and be all over the web.

Re: An insurance company’s API exposed customers’ car location histories

#42

Post by wtbob »

Note that with the latest changes to Android, using mitmproxy to analyse the behaviour of apps has become impossible: apps refuse to accept personally-installed certificates.

In the future, we'll see less revelations about this sort of thing, not because it has become rarer but because Google have chosen a course of action which obscures it.

(it also breaks things like personal or corporate CAs, but that's a different problem)

Re: An insurance company’s API exposed customers’ car location histories

#43

Post by Spooky23 »

Normal_gaussian wrote: post #33
Spooky23 wrote: post #25

I can't believe that anyone would voluntarily sign up for this. Frankly, insurance isn't that expensive. Having a little third party controlled snitch hooked to your car is a security issue, period. The fact that the implementation is a shitshow is just icing on the cake.

at £1400 last year my insurance is expensive. Partly due to living in a city and using on street parking but mostly due to my age ( The 15% discount for taking a black box still isn't worth it for me however.

Wow!

Being part of a late 30s couple with pretty boring driving history in a small city pays I guess. I pay like $700-850 (depending on how you break out umbrella liability cost) for maxed out coverage in an above average cost US state. I think I paid around $1200 when I was a dumb kid with tickets. :)

Even if there were siginifciant savings, it wouldn't be worth it to me to have that kind of telemetry being gathered. It can only be used against you in a accident situation.

Re: An insurance company’s API exposed customers’ car location histories

#44

Post by mhils »

wtbob wrote: post #42

Note that with the latest changes to Android, using mitmproxy to analyse the behaviour of apps has become impossible: apps refuse to accept personally-installed certificates. In the future, we'll see less revelations about this sort of thing, not because it has become rarer but because Google have chosen a course of action which obscures it. (it also breaks things like personal or corporate CAs, but that's a differen…

+1 to this. We (mitmproxy) see the changes in Android Nougat as a very unfortunate development for this kind of privacy research. :(

Some context: https://github.com/mitmproxy/mitmproxy/issues/2054

Re: An insurance company’s API exposed customers’ car location histories

#45

Post by sillysaurus3 »

TillE wrote: post #29
scarface74 wrote: post #27

No mention of the irony of someone who doesn't use Google Play Services because he only uses open source software being willing to attach a device to his car, running closed source software, that tracks everything he does in his car?

I think I have a similar attitude. I have Google's location tracking on, but search history, YouTube history, etc turned off. I'm much more sensitive to digital privacy because it has complex, wide-ranging implications, whereas my location is a limited set of data that I'm more comfortable sharing with a semi-trusted company.

Why turn off search history, youtube history, etc? Google likely gathers all of it anyway, so you might as well see what they keep regardless of your settings.

I suppose it's good in case your account gets leaked.

Re: An insurance company’s API exposed customers’ car location histories

#46

Post by pyre »

chopin wrote: post #39
TillE wrote: post #29

Earlier quoted context omitted.

I think I have a similar attitude. I have Google's location tracking on, but search history, YouTube history, etc turned off. I'm much more sensitive to digital privacy because it has complex, wide-ranging implications, whereas my location is a limited set of data that I'm more comfortable sharing with a semi-trusted company.

I wouldn't want to know a company when, how often and which doctors I consult for one. If you don't want to share your search history you may not want to share your location data either. I would see these as equivalent.

> I wouldn't want to know a company when, how often and which doctors I consult for one.

Depends. A lot of doctor's offices are in "medical parks," so it's entirely possible they don't know which doctor you are seeing or why. They have easier access to that information via your calendar (if you use it) than your location.

Re: An insurance company’s API exposed customers’ car location histories

#47

Post by gambiting »

Spooky23 wrote: post #43
Normal_gaussian wrote: post #33

Earlier quoted context omitted.

at £1400 last year my insurance is expensive. Partly due to living in a city and using on street parking but mostly due to my age ( The 15% discount for taking a black box still isn't worth it for me however.

Wow! Being part of a late 30s couple with pretty boring driving history in a small city pays I guess. I pay like $700-850 (depending on how you break out umbrella liability cost) for maxed out coverage in an above average cost US state. I think I paid around $1200 when I was a dumb kid with tickets. :) Even if there were siginifciant savings, it wouldn't be worth it to me to have that kind of telemetry being gathered…

Over here there's no choice in the limit of cover - EU mandates that every car insurance has to cover 5 million Euro in personal damages and 3 million in property damage. The only "optional" thing is whether you want to get comprehensive insurance which covers your own car for the damage caused by yourself - but 3rd party liability is always set to that 5 and 3 million by law.

I guess you could buy some specialist insurance which would cover more but unless you are planning on crashing into multiple Bugatti Veyrons, it's pretty much impossible to hit that limit.

Re: An insurance company’s API exposed customers’ car location histories

#48

Post by sillysaurus3 »

jacquesm wrote: post #6
proaralyst wrote: post #4

Earlier quoted context omitted.

I have a feeling it's a subtly different problem: the people they've contracted to build this just don't understand security. They've evidently attempted to secure this, just in completely the wrong manner!

Here's an interesting thought: what with the money there is to be made in security these days programmers that actually know everything there is to know about security will leave applications development. There is a good chance that the lure of security consultancy $ is resulting in a degradation of the quality of the applications.

There's not nearly as much money in security as most security consultants would like you to believe. It's in their best interest for most people to believe there's a huge amount of money waiting for you if you switch to security.

Unless you're someone with specialized experience (crypto), you as a pentester are worth around $100k/yr. That's excellent money, but it's not the massive margin that would drive people away from webdev.

Re: An insurance company’s API exposed customers’ car location histories

#49

Post by pyre »

wtbob wrote: post #42

Note that with the latest changes to Android, using mitmproxy to analyse the behaviour of apps has become impossible: apps refuse to accept personally-installed certificates. In the future, we'll see less revelations about this sort of thing, not because it has become rarer but because Google have chosen a course of action which obscures it. (it also breaks things like personal or corporate CAs, but that's a differen…

It's also hardening against malware basically doing the same thing that mitmproxy does though.

Re: An insurance company’s API exposed customers’ car location histories

#50

Post by pyre »

kosma wrote: post #2

Until there is some kind of law in place that makes companies financially responsible for this kind of blunder, it will proliferate. In the current state of affairs it's simply not economically justified to implement proper security.

> Until there is some kind of law in place that makes companies financially responsible for this kind of blunder, it will proliferate.

It will still be out there. For example, in a startup that's trying to get off the ground, going bankrupt because of security issues isn't that much different than going bankrupt because you failed to gain traction. It will still be put off to "later."

That said, with significant financial penalties there will be a point where the startup assesses the cost of security to be worth it (vs. now where there is no downside other than bad PR).

Post reply on HN