2 ms·

Honestly it's on the less severe side of data leaks considering what could have been leaked. No location history at least. Really the only improvement (besides

Honestly it's on the less severe side of data leaks considering what could have been leaked. No location history at least. Really the only improvement (besides not getting hacked) would be not storing the license plate numbers/vales. They could be hashed just like passwords using bcrypt. What's interesting is they say the salt values were not stored which is odd as typically password hashes use per input unique salts that have to be stored. Not sure if that means they used an additional salt or if they reused the same salt.

dreadlordbone 6y ago
My guess it they have a static salt for all passwords in code somewhere (newbie mistake I made years ago).
- jpalomaki 6y ago
  Static salt is called pepper [1]. It's not a bad idea - but it would be better used with the regular salt. Some people don't seem to like the idea, but I think it adds an easy additional layer of protection. At least in the past many of the password leaks seemed to be due SQL injections and only leaking the database content. Pepper stored in the code would have protected the passwords. https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography)
timthorn 6y ago
I don't think you could hash the registration plates. Users need to see the vehicles that are associated with their account, not least to select the car that the parking session is to be associated with. Although an app could maintain an internal database, the service also has a web interface and the UX that would result from only storing hashed VRNs would be pretty awful.
- KingMachiavelli 6y ago
  You could just name the vehicle with a nickname and also have the color, make, and model. I figure most people don't even know their license plate number from memory. The app could let you "lookup" an existing entry from the license plate since it would then just be checking if the entered plate value matches one of the existing hash values. I guess the part that would be weird is if your license plate # changed but you kept the same vehicle. e.g kid driver their 'parents' car but one year registers it under their own name.

dreadlordbone 6y ago

My guess it they have a static salt for all passwords in code somewhere (newbie mistake I made years ago).

jpalomaki 6y ago
Static salt is called pepper [1]. It's not a bad idea - but it would be better used with the regular salt. Some people don't seem to like the idea, but I think it adds an easy additional layer of protection. At least in the past many of the password leaks seemed to be due SQL injections and only leaking the database content. Pepper stored in the code would have protected the passwords. https://en.wikipedia.org/wiki/Pepper_(cryptography) https://en.wikipedia.org/wiki/Pepper_(cryptography)

timthorn 6y ago

I don't think you could hash the registration plates. Users need to see the vehicles that are associated with their account, not least to select the car that the parking session is to be associated with. Although an app could maintain an internal database, the service also has a web interface and the UX that would result from only storing hashed VRNs would be pretty awful.

KingMachiavelli 6y ago
You could just name the vehicle with a nickname and also have the color, make, and model. I figure most people don't even know their license plate number from memory. The app could let you "lookup" an existing entry from the license plate since it would then just be checking if the entered plate value matches one of the existing hash values. I guess the part that would be weird is if your license plate # changed but you kept the same vehicle. e.g kid driver their 'parents' car but one year registers it under their own name.