Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota: Car location data and videos of 2M customers exposed for ten years

bleepingcomputer.com

Post reply on HN
Print view View original

211–220 of 314 posts

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#211

Post by dendrite9 »

brewdad wrote: post #131
wlesieutre wrote: post #86

Earlier quoted context omitted.

All of five seconds. Where does the car park at night? Put the address into https://www.fastpeoplesearch.com/address

This is why I park in front of my neighbor's house. :) While I don't do that, I do always use a nearby neighbor's address for my Google Maps directions. I'm sure Google isn't fooled but it amuses me.

I do the same thing, there's a small historic landmark several blocks from me but on the right streets to be useful for traffic scanning. I'm not really sure why I do it, it can't fool anyone, but it also amuses me slightly.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#212

Post by dendrite9 »

macintux wrote: post #152
TheCapn wrote: post #134

Earlier quoted context omitted.

So I don't work in automotive domain, but I work in Controls Engineering. Basically everything you just said relates to my work as well, and based on tidbits of anecdotal info I've picked up through various technical forums it sounds like automotive & controls are quite similar in that regard. The dirty truth is often times these domains were designed and chiefly operated by non-software people. Not to say a mechanic…

ICYMI, this piece is a really good conversation starter about software safety that was sadly mostly ignored on HN recently. - https://noidea.dog/#/fires/ - https://news.ycombinator.com/item?id=35885982

Thanks, I missed that but it was worth reading!

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#213

Post by dylan604 »

tinco wrote: post #138
dylan604 wrote: post #67

Earlier quoted context omitted.

I've purchased a few Toyota models, with the first having the connect service being a 2014 model. The sales rep asked for my phone so they could download the app that works with their system. The manner in which it was asked was interesting to me in that they clearly had not had someone so much as flinch as to giving them their unlocked phone and access to an app store. Maybe I was the first person not a grandparent…

That sounds perfect. How could a car system be better than just be a screen and interface for the functionality your phone provides? It's literally the dream. If it's a particularly cheap car I wouldn't even mind if it doesn't have a screen or interface, and just supplies an API to the phone and a holder for it. Either way would be a million times better than any car made between 2005 and 2015 has to offer.

The caveat being that it requires the use of their app to run the system. Using an app is exactly the thing that gives them access to so much personal data.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#214

Post by AlbertCory »

It's bad enough if you know you're being tracked for some kind of "customer service."

But I've asked people who work with automotive computers whether any cars just automatically track you and store the information in some on-vehicle storage. No one seems to know, but they all think if any did, it would be manufacturer- and model-specific.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#217

Post by [deleted] »

StillBored wrote: post #139

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

[deleted]

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#218

Post by iisan7 »

bboygravity wrote: post #157
mpol wrote: post #147

Earlier quoted context omitted.

What does this mean? How do you "not accept this"? Are you jumping up and down now interior pictures are leaked from your Toyota? Do you not pay for recurring fees of licenses? Do you send an angry phone call in the general direction of Toyota HQ?

I drive a 30+ year old car. It can easily last another 10 years. 0 tracking by the manufacturer. No subscription services needed. No annoying beeping when you forget to put on your seatbelt for 10 seconds. No touchscreen, all physical buttons. No Android/Apple spyware. No cameras. No ads on any display. No car-key that can run out of battery. It's nice.

Same bucket here. But what do we do when it does need replacing? I don't own an old car because it's a hobby, I don't have a garage, and I also think that safety has improved a lot. There's a sweet spot to be found for cars with modern safety technology but without telemetry, subscriptions, or computerization (other than OBD-II). But these kind of cars seem to be on their way out. For now, I'll enjoy my manual transmission and roll-up windows!

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#219

Post by batch12 »

StillBored wrote: post #139

"It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals unless the attacker knew the VIN (vehicle identification number) of their target's car." Am I dumb or are they? If you know someones home address, then all you need is a geo lookup, and a filter which selects for cars parked near that address at…

In my state you can look up the vehicle property tax records of anyone by name or VIN.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#220

Post by smcin »

thewataccount wrote: post #16
meghan_rain wrote: post #3

Why does Toyota even have this data?

Checkout their privacy policy, it includes biometrics and facial scans, and microphone data. It's absolutely wild. https://www.toyota.com/support/privacy-notice/ https://web.archive.org/web/20230512181415/https://www.toyot...

Look at the really opaque language in the table under 12. DISCLOSURES FOR INDIVIDUALS IN THE UNITED STATES: Summary of Prior 12-Month Personal Information Handling Practices

For example, under the category: Sensitive personal information or data, such as precise geolocation data, biometric information for the purpose of uniquely identifying an individual, account login information, driver's license, and financial information.

... > Purpose of Processing: For location tracking, to identify you, and to provide services to you.

> Other: We may have used and disclosed your Personal Information for other reasons described in the How We Use the Information We Collect and How We Disclose Information sections.

...and the section 'Sensitive Personal Information' for their explanation of limits on what they do with it.

...and:

Your Privacy Rights: 4. Right to Know and Access... You may have the right to request that we provide you with the Personal Information we have collected about you, including the categories of Personal Information; the categories of sources from which the Personal Information is collected; the business or commercial purpose for collecting, selling, or sharing Personal Information; the categories of third parties to whom we disclose Personal Information; and the specific pieces of Personal Information we have collected about you.

Post reply on HN