21–30 of 37 posts
I always laugh at people who back into spots in large parking lots (although in close-quarters it sometimes makes sense to), but now I realize that it could be a security measure (particularly in states without front plates), with or without this park assist.
That is amazing. How are people this short-sighted and reckless with people's data? It's so frustrating. I just told my family that no vehicles are to be parked at a Westfield parking garage until further notice. I'm used to them rolling their eyes at me over data security issues, but I gave them the link to this one and their jaws dropped.
I always laugh at people who back into spots in large parking lots (although in close-quarters it sometimes makes sense to), but now I realize that it could be a security measure (particularly in states without front plates), with or without this park assist.
This is only in Australia, where all cars have (iirc) front and back plates.
That is amazing. How are people this short-sighted and reckless with people's data? It's so frustrating. I just told my family that no vehicles are to be parked at a Westfield parking garage until further notice. I'm used to them rolling their eyes at me over data security issues, but I gave them the link to this one and their jaws dropped.
While I share your concern that this is poor protection of privacy, are you really sufficiently concerned that someone is desperately interested in the location of your car to bother to put yourself to any inconvenience?
Then again, I don't know anything about him. For all I know his wife has a crazy, vengeful ex, and his daughter has a stalker.
That is amazing. How are people this short-sighted and reckless with people's data? It's so frustrating. I just told my family that no vehicles are to be parked at a Westfield parking garage until further notice. I'm used to them rolling their eyes at me over data security issues, but I gave them the link to this one and their jaws dropped.
Really.
So the underlying server is getting hammered with traffic right now, but this really illustrates why you should always be encrypting this kind of thing. Because not only did the developers of the app expose public data, they also managed to post their own source code online by using Pastie (check it out here: http://pastie.org/pastes/1789181 ), and exposed their entire web service documentation here: http://120.151.5…
Or is there a nice way to do this?
/api/v3/plate_search?plate=ABC123 and it can return you the closest match. Search it again from the same phone, get the second mate(track the cookie). It's not that hard, it just takes some thought, and the Westfield, and the vendor have tried to cut corners.
Earlier quoted context omitted.
I have notified ParkAssist (Australia); appropriate contact details were found via the API: http://120.151.59.193/v2/email-alerts
Dear Benevolent Developer, We cannot thank you enough for notifying us. Here's what happened: 1. The API should never have been made accessible publicly. The regular authentication that protects API access was incorrectly disabled. We have corrected the configuration and the services are now protected again. 2. The code snippet should never been placed on pastie. We were sloppy in that regard. While the information i…
"My name is John Batistich and I am the General Manager Marketing for Westfield. Firstly, thanks Troy for bringing this issue to our attention. Our intention was to create a free service for our customers so they never lose their car again! However, we have more work to do. Our partner, Park Assist, who provide the camera technology to capture the number plate today advised there was an issue with the authentication of their data feed to the iPhone which resulted in number plate data being publicly assessable via the internet. This issue has been addressed immediately by Park Assist and the Find My Car functionality will not be available for approximately one week until the app has been modified to ensure that data cannot be publicly assessable online. Further, the ‘Find my Car’ functionality on our app is similar to other location-based services and has been developed to provide a service to the average shopper, in an effort to make it easier to find their car. In terms of privacy, the application does not contravene the Privacy Act in so far as numbers plates are not “personal information”, and are therefore not subject to that act. Having said that, the application theoretically could be used for purposes other than its original intention, however it does not facilitate any activity that couldn’t already happen otherwise. For example, a member of the general public may try to use the application to find a car that is not theirs. On the other hand, at the request of police, the application might also be used to assist in their enquiries into a given situation however, Westfield would not expect either of these situations to be typical.We appreciate you bringing this issue to our attention and we are now working on an update to resolve the technical issue. "
How can Westfield secure this? Whichever method they choose, they have to ship the key with the app, won't they? And then someone can just reverse engineer it out, and we're back at the same place. Or is there a nice way to do this?
As compared to the current system where you can immediately get a list of every car in the carpark, with its location, entry time, and photos where the license plates are discernable.
And they could institute per-IP throttling of requests (no more than 5 an hour or something) to stop someone brute-forcing number plate combinations to get a "map" of the centre.
Finally they could have locked out the admin interface so that random members of the public couldn't do other things as well. ;)
But you're right in general - even implemented correctly, this feature has an interesting privacy implication - at any given time, anyone with a license plate number and a vague description of the vehicle can check if that car is parked at a Westfield, and where it is parked.