4 ms·

> Sick Codes said he could iterate and brute force all VIN numbers in the database, as they were "sequential," according to him Seems like they didn't think th

by torh 5y ago

> Sick Codes said he could iterate and brute force all VIN numbers in the database, as they were "sequential," according to him Seems like they didn't think that people would enter someone else's VIN. A few years back I discovered that I could get activation code for a map update in my car simply by entering my VIN and the product number of the DVDs with the map update. They gave me a list to choose from when I enterd my VIN, but that didn't stop me from asking for a different product -- and they gladly sent me an email with the matching code. PS: I'm also from Norway. I see that's a thing now.

bri3d 5y ago
This is pretty common, oftentimes cars with parts restricted to VIN (special editions, etc.) or online manual or software download portals will ask for a VIN. Sometimes this is to verify parts fitment and sometimes it is to attempt to rate-limit parts purchase (i.e. - to keep a dealer from buying 100 sets of "special edition" wheels and reselling them, they need to supply a unique VIN for each). The difference is that these are usually an extremely basic (and ultimately pointless) authentication test, not a way to download PII.
- torh 5y ago
  In my case I was able to get activation codes for product I hadn't purchased, but yeah, once personal information is involved, its a whole different game. There was a lawsuit in Norway a while back were the question essentially was: are you breaking the law if you change the URL? (no, it wasn't). More specifically, a guy logged into Norways DMV and looked up information about his own car and by changing the license plate in the URL he got information about other cars, including their owner. I guess the triggering factor was that he scraped this information into a big database. In Norway you can freely look up car information based on license plate, but it cost extra (?) to get the name of the owner. So the information wasn't secret in any way. But that brings us back to the question: where does the line go when scraping the web for information?

by torh 5y ago

bri3d 5y ago

This is pretty common, oftentimes cars with parts restricted to VIN (special editions, etc.) or online manual or software download portals will ask for a VIN. Sometimes this is to verify parts fitment and sometimes it is to attempt to rate-limit parts purchase (i.e. - to keep a dealer from buying 100 sets of "special edition" wheels and reselling them, they need to supply a unique VIN for each). The difference is that these are usually an extremely basic (and ultimately pointless) authentication test, not a way to download PII.

torh 5y ago
In my case I was able to get activation codes for product I hadn't purchased, but yeah, once personal information is involved, its a whole different game. There was a lawsuit in Norway a while back were the question essentially was: are you breaking the law if you change the URL? (no, it wasn't). More specifically, a guy logged into Norways DMV and looked up information about his own car and by changing the license plate in the URL he got information about other cars, including their owner. I guess the triggering factor was that he scraped this information into a big database. In Norway you can freely look up car information based on license plate, but it cost extra (?) to get the name of the owner. So the information wasn't secret in any way. But that brings us back to the question: where does the line go when scraping the web for information?