Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Toyota: Car location data and videos of 2M customers exposed for ten years

bleepingcomputer.com

Post reply on HN
Print view View original

271–280 of 314 posts

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#271

Post by froh »

peeters wrote: post #262
froh wrote: post #140

Earlier quoted context omitted.

in Europe, eCall is part of the homologation and must not be deactivated, by law. https://en.m.wikipedia.org/wiki/ECall

Do you have a source for it being illegal for an owner to disable it on their own vehicle? Your link talks about it being required in new cars but I didn't see anything that said you couldn't deactivate it.

the logic is this:

ecall is a functional safety feature of your vehicle, which, like tire pressure sensors or abs or ESR or whathaveyou has been prescribed to save human life's. it only phones home, so the logic, in case of a severe accident. automatic registry of any sim card with mobile network towers is just a technicality, according to that logic.

ecall is a prescribed feature for homologation (German: Typzulassung). if you manipulate a homologation relevant feature of the vehicle, your general operating license becomes void ("allgemeine Betriebserlaubnis erlischt")

in other words: you can sure disable it on your own car --- but that car in that moment loses insurance and you're no longer allowed to operate it on the road, except to bring it to the workshop.

that's the mechanics of "homologation" and "general operating license", i.e. the mechanics of road safe vehicles.

now, are you looking for a source of these mechanics? or a source for where ecall is listed as generic mandatory feature?

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#272

Post by zirgs »

wlesieutre wrote: post #86
dapearce wrote: post #53

> It is important to note that the exposed details do not constitute personally identifiable information, so it wouldn't be possible to use this data leak to track individuals The data included timestamped GPS data, which has been demonstrated to be easy to de-anonymize.

All of five seconds. Where does the car park at night? Put the address into https://www.fastpeoplesearch.com/address

Can't believe that this stuff is legal.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#273

Post by sufehmi »

thewataccount wrote: post #23

Their privacy policy is wild and every customer is opted into the connect services by default. Interior images, exterior images, facial geometry, voice recordings, location/driving data, "multimedia screen data", https://www.toyota.com/privacyvts/ https://web.archive.org/web/20230512182022/https://www.toyot...

Totally different than the one for their Europe market: https://www.toyota-europe.com/legal/privacy-policy

US lawmakers : you suck.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#274

Post by _hypx »

shortcake27 wrote: post #266
_hypx wrote: post #260

Earlier quoted context omitted.

1,000 mile road trips actually happen, and until recently it was never a problem we had to deal with. I very much doubt we will ever get over it. We are specifically asked to abandon a feature we enjoyed for a century. We will likely only get over it when there are EVs that simply do not have this sacrifice.

I never said they don’t happen. I said it isn’t average to take one, and the average person is concerned about their ability to do something they’ll never do. The average person doesn’t need hundreds of miles of range on a single charge assuming the charging infrastructure is there, and it’s getting there. I’m not sure what your point is. You are in favour of wasting limited non-renewable resources because you person…

"Never" is a strong word. People do need it every once in a while. You are taking the idea that people don't drive that much too far.

The point is that the convention BEV is not that desirable, and that people will never accept its limitations. The solution is simply producing another kind of zero emissions vehicle without this problem. That is something we can easily do now. The only opposition at this point seems to be BEV fanatics who have basically closed their minds to this fact in the same way ICE car fanatics closed their minds to EVs a decade ago.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#275

Post by franga2000 »

actionfromafar wrote: post #269
gambiting wrote: post #186

Earlier quoted context omitted.

>>What is Microsoft's position on you selling your windows license to a third party? It's 100% allowed within the EU, even for OEM licences. There have been multiple court cases about this and microsoft lost every single one. But I guess that's not what you were implying?

I wonder why I can’t buy a game license in a similar way from somebody.

You absolutely can. If a game comes with a real license key (not an [insert platform here] activation/import key), you are entirely free to sell it the same way you can sell your Windows key.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#276

Post by davidMC1982 »

I think there are two key aspects to data breaches; privacy and fraud. The solution for the latter is simple; the liability is on the organisation that uses that identity data rather than the one that stores it. If the bank lends money to a criminal using my data, that's on them. I see no reason why any of the random bits of data that identify me should be of any use to someone else claiming they are me. These things shouldn't be considered secrets as they're always shared with at least one other party.

Just this would reduce the value of obtaining such data.

The privacy aspect is harder to deal with, but it's not obviously clear that a majority of people care. GDPR helps focus minds in large corporations s and maybe that's enough.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#277

Post by gambiting »

actionfromafar wrote: post #269
gambiting wrote: post #186

Earlier quoted context omitted.

>>What is Microsoft's position on you selling your windows license to a third party? It's 100% allowed within the EU, even for OEM licences. There have been multiple court cases about this and microsoft lost every single one. But I guess that's not what you were implying?

I wonder why I can’t buy a game license in a similar way from somebody.

Because while the courts agree that legally licences are transferable, they haven't ruled that Valve and others should build a technical facility to allow this. Microsoft put themselves in this position by accident because they allow licence keys to be activated multiple times - so you're free to sell your licence to someone else and Microsoft has to activate it. While Valve can just refuse to build this functionality into Steam and no court has ordered them to do so.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#279

Post by matheusmoreira »

ren_engineer wrote: post #191
thewataccount wrote: post #23

Their privacy policy is wild and every customer is opted into the connect services by default. Interior images, exterior images, facial geometry, voice recordings, location/driving data, "multimedia screen data", https://www.toyota.com/privacyvts/ https://web.archive.org/web/20230512182022/https://www.toyot...

if you own a car from 2008 or newer the government essentially mandates it to be a privacy nightmare. If you care about privacy don't buy a modern car. Throw in the Vault 7 CIA leaks about how they explicitly had programs to research how they could hack modern cars remotely https://en.wikipedia.org/wiki/Vault_7 you have to wonder how many vehicle 0-days nation state actors have saved up for when they need them, even…

Thanks!! I didn't know about these leaks.

Re: Toyota: Car location data and videos of 2M customers exposed for ten years

#280

Post by Springtime »

ummonk wrote: post #202
thewataccount wrote: post #23

Their privacy policy is wild and every customer is opted into the connect services by default. Interior images, exterior images, facial geometry, voice recordings, location/driving data, "multimedia screen data", https://www.toyota.com/privacyvts/ https://web.archive.org/web/20230512182022/https://www.toyot...

The privacy policy looks really reasonable and mostly only collecting the data that it needs to provide the services. And the most cloud-based / privacy concerning stuff (e.g. external video capture, and usage-based auto insurance) is listed as opt-in.

I'm not sure the location data aspects are great but yeah, there is some discrepancy between what the parent post was claiming and the policy states:

> Certain vehicles equipped with an interior, driver-facing camera [...] If you opt-in and link your user profile using the in-vehicle “Setup Face” process, the Face Identification feature may use your Facial Geometric Features and Profile Data... Your Facial Geometric Features will only be stored on your vehicle.

> External Vehicle Video Capture. Owners of certain vehicles equipped with [...] may also opt-in to participate in External Vehicle Video Capture...

> To use the App Suite, you must download the application and accept the End User License Agreement... We will use Voice Recordings to improve our responses and voice recognition. To facilitate functionality of your App Suite and linked third party services, your vehicle may share your Location Data and Voice Recordings transcriptions with your third party services...

(Emphasis mine)

Post reply on HN