Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota: Car location data and videos of 2M customers exposed for ten years

bleepingcomputer.com

Post reply on HN
Print view View original

161–170 of 314 posts

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#161

Post by asdfman123 »

iambateman wrote: post #42
LeifCarrotson wrote: post #30

Earlier quoted context omitted.

It's a simple equation: Revenue = (value of data per person) x (number of customers) - (probably of data loss) x (probability of fine) x (cost of fine). If that number is greater than zero, they'll do it, if it's less than zero, they won't.

This is how engineers think executive decisions are made and it is just not accurate. The CEO of Toyota plays golf with the uncle of the head of the “we track you forever” group. They both feel like the nephew has a big future and there is a ton of money to be made over the next 5 years before the CEO plans to retire. Plus, according to their marketing team, Volkswagen is worse. Much worse. There is way less science…

It has less to do with just emotion and more to do with politics. Maybe something is a marginal idea but you approve it because X is a good VP you want to reward.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#162

Post by CamperBob2 »

_hypx wrote: post #112
CamperBob2 wrote: post #78

Earlier quoted context omitted.

Toyota in particular has wasted a ridiculous amount of time and money on consumer-level hydrogen tech. As a result competitors that focused on battery EVs over the last few years have a decent head start.

The other companies are wasting their time. Battery EVs are a dead end and they will all have to move to hydrogen tech eventually. It is the other companies that are way behind.

In EE terms, betting against batteries is like betting against CMOS. Progress will go where the industry's money goes, not where any one company's money goes. If I could say just one thing to Toyota's management, it would be, "Stop trying to make hydrogen happen. It's not going to happen. There are just too many technical and economic drawbacks."

But any of their engineers could tell them the same thing, so what'd be the point?

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#163

Post by JohnFen »

thewataccount wrote: post #96
sandworm101 wrote: post #88

Earlier quoted context omitted.

Funny, I looked around and couldn't find an equivalent for Honda motorcycles. Perhaps Honda understands their customers better than we think. Honda seems perfectly willing to build tracking-free products when the customer base cares enough . I have never met any sportbike rider willing to share one iota of ongoing GPS data with anyone.

> https://www.honda.com/privacy/connected-product-privacy-noti... ~~~ Their's is a lot better, does still include Geolocation, audio recordings, navigation usage, however the usage looks limited to just Honda and the obviously required services: ~~~ > We will not use Geolocation Information for our own marketing purposes or disclose identifiable Geolocation Information with third parties (except our service providers…

> or disclose identifiable Geolocation Information with third parties (except our service providers) without your consent.

There's also that little qualifier "identifiable" in there. Companies usually take a very different stance on what constitutes "identifiable" than people think.

What that's really saying is that they will share the geolocation information with third parties without your consent, but they'll probably do a little handwavy "anonymization" thing on it first.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#164

Post by spacebanana7 »

TheCapn wrote: post #134
brk wrote: post #76

It is clear that automakers are utterly failing at technology. In-vehicle control systems are typically garbage. Several hacks have been shown where vehicle data is exposed over cellular links, in some cases with remote attackers being able to actually control elements of the vehicle (eg: Jeep). Software updates are rare, with manufacturers often trying to charge exorbitant amounts for basic updates. Data breaches of…

So I don't work in automotive domain, but I work in Controls Engineering. Basically everything you just said relates to my work as well, and based on tidbits of anecdotal info I've picked up through various technical forums it sounds like automotive & controls are quite similar in that regard. The dirty truth is often times these domains were designed and chiefly operated by non-software people. Not to say a mechanic…

> Software Engineering as a regulated profession is going to be a necessity as much as civil engineering or electrical engineering has been

Wouldn’t it be easier to regulate the quality of software used in critical products?

AFAIK similar regulatory standards and certifications exist for aerospace software.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#165

Post by JohnFen »

AceyMan wrote: post #113
jeffbee wrote: post #94

Earlier quoted context omitted.

Well, the motorcycle community is overstocked with privacy lunatics, preppers, gun nuts and other extremists, so this makes sense. Also I can't think of any Honda motorcycle with a GPS aside from the Gold Wing, which stretches the definition of motorcycle in numerous ways. On the other hand every motorcyclist I ride with carries a Garmin inReach, which is the very definition of sharing your GPS with someone.

> privacy lunatics, preppers, gun nuts and other extremists [...] Being a prepper isn't extremist. (Yes, it's expensive , done right, but not necessarily extremist.) [disclaimer: I live in Los Angeles]

Every person that I've ever met who calls themselves a "prepper" has been what most would call an extremist. (I'm not calling you an extremist -- I've never met you.)

That's a different crowd from someone who is just prepared for emergencies and disasters.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#166

Post by jstarfish »

StillBored wrote: post #139

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

> its still going to reduce down to just a handful of cars which can then be cross referenced against place of work, relatives, etc.

You are correct, but I can't imagine why anybody would go to that much trouble for a speculative answer. Your idea requires quite a bit of intelligence collection as well (relatives' addresses, addresses of known hangouts, etc. that you have to vet for accuracy).

If you have a confirmed home or work address, just go to their home or work and take a picture of the target VIN through the windshield.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#167

Post by Tempest1981 »

chasd00 wrote: post #75
beefee wrote: post #62

Owners may want to disable this in hardware rather than relying on a sketchy opt-out mechanism. The relevant part is the "data communications module". It has an LTE modem and a backup battery, so it's able to transmit even if the car battery is disconnected. It requires a little bit of dashboard disassembly to access. You can either remove it or disconnect the LTE and GPS antennas. Toyota has technical documents avai…

"tracker detection and removal" would be a great service for a local service garage to offer.

And you would want to do it before you take your new car home, or create a pattern of PII.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#168

Post by reaperducer »

lmkg wrote: post #91
SR2Z wrote: post #72

Earlier quoted context omitted.

Yeah, companies seem to think that "personally identifiable information" is basically just your name. That's clearly wrong because GPS data and VIN make it extremely straightforward to figure out who a car owner is. As far as I'm concerned, this is PII. That statement is a bald-faced lie and a state AG should bring charges over this - it's extraordinarily irresponsible for Toyota to collect this data and then leak it…

"Personally identifiable information" is a legal term with a legal definition[1], and location data is not PII. Companies think that PII is basically just your name because that's literally true: PII means name and government-issued ID number. That's it. Everything else is not PII. Relatedly, PII sucks as a basis for privacy law. The laws enshrining PII were made in response to identity theft[2], and that's the "thre…

Personally identifiable information" is a legal term with a legal definition

In the U.S., the definition of PII varies depending in which federal department regulates your company.

My company's legal department recently sent down new PII rules, with links to the relevant federal agencies policies. Much purging of log files ensued.

I think most tech people would be shocked to see what very basic information some federal agencies consider PII.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#170

Post by JohnFen »

ThePowerOfFuet wrote: post #149
thewataccount wrote: post #23

Their privacy policy is wild and every customer is opted into the connect services by default. Interior images, exterior images, facial geometry, voice recordings, location/driving data, "multimedia screen data", https://www.toyota.com/privacyvts/ https://web.archive.org/web/20230512182022/https://www.toyot...

> This Privacy Notice DOES NOT apply to: >[...] > Any Toyota vehicles equipped with Connected Services located outside of the continental United States, Alaska and Hawaii. Ah, so only Americans are getting shafted.

Americans probably have the fewest legal protections of their various markets.
Post reply on HN