Monday edition of *Car privacy is an absolute nightmare*:
Subaru's employee portal holds a year's worth of location data for all internet-connected cars. 
We know this because it was vulnerable (now fixed). You could pull a year's worth of driving just with a license plate.
Props to Sam Curry & Shubham Shah for exposing it. Pic is a years' worth of Sam's mom's #Subaru locations.
I seriously doubt any owner has a clear idea that this data is being collected on them.
But the same thing is replicated for almost every car mfr (see the #Mozilla foundation report on car privacy link)
Literally no car owner has asked for their whip to be turned into a surveillance portal.
And yet..
Car companies feel basically no pressure to do right by customers, but experience a lot of incentives to mine their movements for money.
Sidenote: same (now closed) vulnerability also enabled remote unlocks & starts and a bunch of other highly undesirable things.
Reading list:
The Subaru research: https://samcurry.net/hacking-subaru
News report on it: https://www.wired.com/story/subaru-location-tracking-vulnerabilities/
Mozilla Foundation's key investigation into car privacy: https://foundation.mozilla.org/en/privacynotincluded/articles/its-official-cars-are-the-worst-product-category-we-have-ever-reviewed-for-privacy/
The engineers and managers responsible for this should spend the rest of their lives in prison, or be executed.
We do not want people willing to do this in society. It's obviously reckless and evil.
Quite likely this would mean the end of Subaru as a functioning company – good chance that knowledge and involvement of this goes all the way to the C-level management. That's fine. Fuck them.
if Subaru is doing this, I'd imagine most are doing this.
Yes, there's probably thousands of engineers across multiple companies that should be removed from society. That should not surprise you. A lot of people are evil.
Also, don’t connect your stuff to the Internet
Executed is a little harsh bro. Incarcerated and lambasted is adequate.
Any new vehicle is essentially a smart phone on wheels with the obvious privacy implications included.
What i've learned from other huge fails by huge companies is that they probably get a "bad company, continue as if nothing happened." And nothing changes..
Take Volkswagen for example. They intentionally cheat the system, fast forward 5 years and i really see no difference in the amount of new cars being sold by them nor did anybody and up in jail or anything.
Same goes for any banks when it comes to money laundering or big pharma when it comes to addictive drugs.
You're wrong with that example. Volkswagen the company paid billions of dollars in fines after pleading guilty to criminal charges, and on top of that, Volkswagen employees and executives were also charged with criminal charges. For example, engineer Oliver Schmidt was sentenced to 7 years in jail and served half of it before being released on probation.
I'm not arguing anything fundamentally new. I'm arguing that we should increase the effectiveness of penalties like this by throwing more people in jail with harsher sentences.
Hmm whoops i really fucked up my homework on this one then. 😅
I wish the punishment would come from the customer base instead though. But like with most other things the general public does not really seem to understand or care too much even though they are the victim.
They were not cheating. They were attempting to protect themselves from attackers. Unfortunately unsucessfully.
1980's toyotas are the bitcoin of cars
I have heard pf this app, but have not tried it.
Privacy4Cars: This app provides a "Vehicle Privacy Report" by analyzing your Vehicle Identification Number (VIN). It reveals what data your car collects, who it is shared with, and offers tools to delete personal informatiivacy Report" by analyzing your Vehicle Identification Number (VIN). It reveals what data your car collects, who it is shared with, and offers tools to delete personal information like call logs, navigation history, and biometrics from your vehicle.
The Privacy4Cars app helps users delete personal data stored in vehicle infotainment systems. Here's how it works:
Download and Setup: The app is available for free on iOS and Android. After downloading, users can register and access its features
VIN Scanning: Users scan their car's Vehicle Identification Number (VIN) or manually select the make, model, and year to identify the vehicle's infotainment system
Step-by-Step Tutorials: The app provides customized, visual instructions to erase Personally Identifiable Information (PII), such as call logs, navigation history, text messages, and garage door codes
Data Deletion: Following the guided process ensures data is permanently removed, protecting privacy when selling, renting, or returning a vehicle
Additional Features: Users can access Vehicle Privacy Reports to understand what data their car collects and who it is shared with
