Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota: Car location data and videos of 2M customers exposed for ten years

bleepingcomputer.com

Post reply on HN
Print view View original

191–200 of 314 posts

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#191

Post by ren_engineer »

thewataccount wrote: post #23

Their privacy policy is wild and every customer is opted into the connect services by default. Interior images, exterior images, facial geometry, voice recordings, location/driving data, "multimedia screen data", https://www.toyota.com/privacyvts/ https://web.archive.org/web/20230512182022/https://www.toyot...

if you own a car from 2008 or newer the government essentially mandates it to be a privacy nightmare. If you care about privacy don't buy a modern car. Throw in the Vault 7 CIA leaks about how they explicitly had programs to research how they could hack modern cars remotely

https://en.wikipedia.org/wiki/Vault_7

you have to wonder how many vehicle 0-days nation state actors have saved up for when they need them, even just displaying the ability would grind the country to a halt because people would be afraid to even drive

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#193

Post by pessimizer »

jstarfish wrote: post #166
StillBored wrote: post #139

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

> its still going to reduce down to just a handful of cars which can then be cross referenced against place of work, relatives, etc. You are correct, but I can't imagine why anybody would go to that much trouble for a speculative answer. Your idea requires quite a bit of intelligence collection as well (relatives' addresses, addresses of known hangouts, etc. that you have to vet for accuracy). If you have a confirmed…

Going to everyone's house seems multiple orders of magnitude more trouble than looking at where a car is most often parked, and seeing if you have anybody in your database that lives, works, or has relatives (or facebook friends) that live at those addresses. I bet you'd get a unique hit 99.99% of the time if you have 10 years of data.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#194

Post by wwweston »

version_five wrote: post #110
short_sells_poo wrote: post #36

Earlier quoted context omitted.

> Interior images, exterior images, facial geometry, voice recordings, This is an absolutely unbelievable level of privacy intrusion IMO. I 100% support very heavily fining this sort of behavior, otherwise it will continue to proliferate.

Where would the support for fines come from? When government understands these issues at all, they only want more control and restriction. The only thing I can imagine legislators getting upset about is they the car manufacturers are not sharing all the info with government by default. Next steps will be mandating tracking, not fining for it.

> When government understands these issues at all, they only want more control and restriction

CHIPS Act of 2022 allocated money to support US semiconductor manufacturing. Right-to-repair laws have been gaining traction even though it can't benefit any large economic interest directly. Those are two recent examples off the top of my head that aren't a reflection of a government that "only want more control and restriction."

I get that politics is frustrating but this kind of blanket caricature just relieves people of the responsibility for engaging with specifics, and when people commit to it that actually covers and enables real corruption.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#195

Post by unethical_ban »

_hypx wrote: post #122
unethical_ban wrote: post #61

Earlier quoted context omitted.

I mean, even 40 miles is a significant portion of many peoples commutes. Elimination of 50-95% of gas consumption is a big win.

FYI, 40 miles is not plucked out of a hat. Scientists specifically mention that number because it exceeds the daily average driving distance of >90% of people. It is basically the point where any further increases in range becomes unnecessary cost.

That's interesting. Yeah, I know it's probably a more complicated drivetrain, but PHEV to me are the absolute sweet spot for US drivers. Enough to electrify most of the time while enabling longer commutes if needed. Too bad there doesn't seem to be one with 40 mile range under $50k.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#196

Post by hanoz »

StillBored wrote: post #139

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

Okay, massive tangent, but it's been bugging me for a while and this has finally tipped me over the edge - why is it called personally identifiable information? That would be information that someone can personally identify surely? Shouldn't it be personally identifying information?

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#197

Post by cyanydeez »

jstarfish wrote: post #166
StillBored wrote: post #139

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

> its still going to reduce down to just a handful of cars which can then be cross referenced against place of work, relatives, etc. You are correct, but I can't imagine why anybody would go to that much trouble for a speculative answer. Your idea requires quite a bit of intelligence collection as well (relatives' addresses, addresses of known hangouts, etc. that you have to vet for accuracy). If you have a confirmed…

I think his point is just because the data in isolation isn't identification, we live in a world where multiple public datasets are easily used to make 99.9% correlation, yet laws still act like these associations are "technically challenging" Most of the problems are from actors who are very specifically motivated and we need to start a less isolated view of data breaches .

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#198

Post by wolrah »

JohnFen wrote: post #43
wolrah wrote: post #31

Earlier quoted context omitted.

All machines of meaningful complexity need maintenance if you expect them to last, including EVs, and a fluid change that happens twice a year for most vehicles isn't exactly a huge inconvenience. IMO getting under your vehicle twice a year is a good thing and more people should be encouraged to do it. Getting eyes on the stuff hidden underneath before it gets bad enough to start breaking is always useful.

> Getting eyes on the stuff hidden underneath before it gets bad enough to start breaking is always useful. For people like myself, looking at the underside of a car is worthless. I wouldn't even begin to be able to recognize something needs attention until it's very obviously broken. And even then, I might not know.

If you're looking at it a few times a year even if you don't know what you're looking at after a few times any substantial changes should be notable. On top of that I'd imagine most people who do their own oil changes are going to lean in the direction of mechanically inclined or at least willing to learn things.

If you're paying someone else to do it, presumably they're a set of eyes that's a bit more experienced with cars and can more confidently identify the sorts of things one could see from the perspective of an oil change.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#199

Post by TheSpiceIsLife »

hanoz wrote: post #196
StillBored wrote: post #139

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

Okay, massive tangent, but it's been bugging me for a while and this has finally tipped me over the edge - why is it called personally identifiable information ? That would be information that someone can personally identify surely? Shouldn't it be personally identifying information?

Words mean whatever people who use them intend them to mean.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#200

Post by dotancohen »

recursive wrote: post #12
skrtskrt wrote: post #8

Earlier quoted context omitted.

Toyota's hybrid tech is and has been the best and most reliable for a very long time. I think it's a shame that the EV regulations and incentives (at least in America) are not as friendly for traditional hybrids and plug-in hybrids. They have basically zero downsides compared to full ICE or full EV, and would still make a massive dent in emissions. PHEVs in particular - most people are going under 100 miles a day, so…

> They have basically zero downsides They need oil changes. Some don't mind, but I do. It's a downside.

This is a valid concern. My Tesla has had zero maintenance in the 50,000 km since I bought it. Even as a former gearhead, I love not thinking about it.
Post reply on HN