Remember folks, "token exchange" does *not* mean "let me ... • Aaron Parecki

Remember folks, "token exchange" does *not* mean "let me exchange a customer ID for a token"!

Good thread on how remotely connected Honda, Nissan, Infiniti, and Acura cars were all able to be remotely controlled knowing only the VIN.

https://twitter.com/samwcyo/status/1597792145691246593

Portland, Oregon, USA • 38°F

Thu, Dec 1, 2022 11:36am -08:00 #security

20 likes 10 reposts 3 replies 1 mention
Have you written a response to this? Let me know the URL:
- infosec.exchange/users/IDIMAndrew
  
  @aaronpk at the last internet identity workshop I ran a session called "Your greatest standardization regret" and Token Exchange was brought up by a few people 🙂 @Vibronet pointed out the dangers of doing weird things with it
  
  Thu, Dec 1, 2022 5:50pm -08:00
- carpetbomberz mastodon.online/users/carpetbomberz
  
  @aaronpk Thinking about the car factory slow-downs due to chip supply chain issues. I wonder if the SiriusXM radio receivers were part of that supply chain slowdown?
  Interesting pullquote: "We found the SiriusXM Connected Vehicle website and noticed the following quote:
  '[SiriusXM] is a leading provider of connected vehicles services to Acura, BMW, Honda, Hyundai, Infiniti, Jaguar, Land Rover, Lexus, Nissan, Subaru, and Toyota.'
  So many brands under one roof!"
  
  Thu, Dec 1, 2022 11:44am -08:00
- Olivier Forget social.tchncs.de/users/teleclimber
  
  @aaronpk Wow. 🤯
  
  Thu, Dec 1, 2022 11:43am -08:00
Other Mentions
- Andrew Hughes twitter.com/IDIMAndrew
  
  @vibronet I see what you were talking about at #iiw !
  
  Thu, Dec 1, 2022 8:03pm +00:00 (via brid.gy)

Posted in /notes using quill.p3k.io

Aaron Parecki

Other Mentions