News for hackers. Stuff that matters.

A comment on My car insurance exposed my location.

Re:My car insurance exposed my location by sebazzz on Saturday December 09, 2017 @11:43AM (#15886559)
I have not seen him mentioning that the web service is apparently invoked over unsecure http. You can still add authentication, but if the service is running over http yu might as well not have any authentication at all.
[ Parent | on HN ]
Re:My car insurance exposed my location by alasdair_ on Saturday December 09, 2017 @12:08PM (#15886719)
>I have not seen him mentioning that the web service is apparently invoked over unsecure http.

It's mentioned. From the blog post: "besides the ugliest formatting ever and the fact the request uses plain HTTP"

[ Parent | on HN ]
Re:My car insurance exposed my location by empthought on Saturday December 09, 2017 @11:48AM (#15886588)
In theory you could encrypt the payloads via some other means and use something like HTTP digest authentication, but I'm sure that's not what happens here.
[ Parent | on HN ]