Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Westfield’s iPhone app privacy smorgasbord

troyhunt.com

Post reply on HN
Print view View original

31–37 of 37 posts

Re: The Westfield’s iPhone app privacy smorgasbord

#31

Post by angusgr »

angusgr wrote: post #30
mattgreenrocks wrote: post #27

How can Westfield secure this? Whichever method they choose, they have to ship the key with the app, won't they? And then someone can just reverse engineer it out, and we're back at the same place. Or is there a nice way to do this?

Well, to start with they could lock the API down correctly so you had to supply a number plate to get 2-3 likely matches. And fuzz the photos they send a bit more so it is legible enough to identify your car, but not to read the license plate itself. And remove superfluous data from the IP results, like time of entry. As compared to the current system where you can immediately get a list of every car in the carpark,…

Some people have talked about "crypto" and I can see lot of ways you could add some level of encryption or auth to make things slightly more obfuscated (perhaps require pre-registration of your car), but I can't see a any way that would change the fundamentals.

The app is essentially designed to let people look up car locations by license plate numbers, and as long as it does that it seems to me there will be some level of privacy issue.

Re: The Westfield’s iPhone app privacy smorgasbord

#32

Post by objclxt »

veyron wrote: post #4
objclxt wrote: post #3

So the underlying server is getting hammered with traffic right now, but this really illustrates why you should always be encrypting this kind of thing. Because not only did the developers of the app expose public data, they also managed to post their own source code online by using Pastie (check it out here: http://pastie.org/pastes/1789181 ), and exposed their entire web service documentation here: http://120.151.5…

How did you find this?

I googled for the "v2/bays.json" string, thinking I might find a few more carparks using the system, but instead found that! So not exactly rocket science.

Re: The Westfield’s iPhone app privacy smorgasbord

#33

Post by iaskwhy »

jesseendahl wrote: post #23
hugh3 wrote: post #21

Earlier quoted context omitted.

This is only in Australia, where all cars have (iirc) front and back plates.

California also requires all cars have both front and back plates.

Couldn't find a list but on all countries I have been to so far cars have front and back plates.

Re: The Westfield’s iPhone app privacy smorgasbord

#34

Post by jnorthrop »

throwaway32 wrote: post #8

to paraphrase a certain Google executive "if you don't want somebody to know where you parked, maybe you shouldn't be parking your car"

It's more than than just a single snapshot in time though. They are keeping a record of every car's coming and going every day. It wouldn't be difficult to poll a service like that to gather the information yourself for weeks or months worth of data.

Certainly you could drive around a parking lot everyday and get that information but that isn't very likely. It's that aspect of the service that is most troubling.

Re: The Westfield’s iPhone app privacy smorgasbord

#35

Post by pavel_lishin »

iaskwhy wrote: post #33
jesseendahl wrote: post #23

Earlier quoted context omitted.

California also requires all cars have both front and back plates.

Couldn't find a list but on all countries I have been to so far cars have front and back plates.

Certain states in the USA only require rear plates; I think Texas at least was one of them, they may have changed it.

Re: The Westfield’s iPhone app privacy smorgasbord

#36

Post by martingordon »

pavel_lishin wrote: post #35
iaskwhy wrote: post #33

Earlier quoted context omitted.

Couldn't find a list but on all countries I have been to so far cars have front and back plates.

Certain states in the USA only require rear plates; I think Texas at least was one of them, they may have changed it.

It looks like Texas did change it: https://secure.wikimedia.org/wikipedia/en/wiki/Vehicle_regis...

The only two states I've lived in (FL and PA) don't require front plates, so I was probably overestimating the popularity of only rear plates.

Re: The Westfield’s iPhone app privacy smorgasbord

#37

Post by frankPants »

angusgr wrote: post #11
shoota wrote: post #2

This is just sad. I'm sure someone was using the extra information for debugging purposes at one point and never thought to remove it from the json interface.

I expect a Westfield developer thought they were being very clever. "Oh look, ParkAssist already has a full API! I'll just put it on a public API and I don't have to do any backend development at all."

bingo! I'll be my life that's exactly what's happened.
Post reply on HN