<story><title>Student says he was unwitting drug mule, sues Ford</title><url>http://news.msn.com/us/student-says-he-was-unwitting-drug-mule-sues-ford</url></story><parent_chain><item><author>cperciva</author><text>It makes sense for dealerships to have codes for cars &lt;i&gt;in their lot&lt;/i&gt;.  But it sounds like dealerships have access to codes for &lt;i&gt;all&lt;/i&gt; Ford cars, which is a pretty clear least-privilege violation.</text></item><item><author>toki5</author><text>I&amp;#x27;m not sure I&amp;#x27;d call this Ford&amp;#x27;s fault.&lt;p&gt;&amp;gt;Lopez said the smuggling organization was able to get a duplicate key from a locksmith in El Paso, who got the codes after calling up a Ford dealership.&lt;p&gt;&amp;gt;An FBI affidavit says someone at a Dallas auto dealer accessed the codes in Ford&amp;#x27;s database, giving out more than 2,300 codes over an 18-month period.&lt;p&gt;I think dealerships, of all places, would be (should be) allowed to have codes for cars in their lot. I trust dealerships to have these codes. If they do nefarious things with them, they should be punished, but I don&amp;#x27;t think Ford should be punished for having a dealership-accessible database of key codes. Whoever was cooperating with the criminals is, to me, the person to blame here (along with the criminals).&lt;p&gt;I&amp;#x27;d have sued that dealership, not Ford itself.</text></item></parent_chain><comment><author>jcampbell1</author><text>A Ford dealer must be able to service any Ford vehicle, including replacing lost keys.  The dealers have access to the central database.&lt;p&gt;Ford failed to monitor access to the database.  The whole problem would have been avoided if they just emailed the service manager every time a database lookup is made.   Unfortunately he is in Texas, so Ford needs to be 51% at fault for a judgement.  The lawyers are playing this out in the press so Ford will pay to make it go away, even though they would likely prevail in a Texas court.&lt;p&gt;Ford needs to cut this kid a check for $500k, and implement some better auditing of access to the database.</text></comment>
<story><title>Student says he was unwitting drug mule, sues Ford</title><url>http://news.msn.com/us/student-says-he-was-unwitting-drug-mule-sues-ford</url></story><parent_chain><item><author>cperciva</author><text>It makes sense for dealerships to have codes for cars &lt;i&gt;in their lot&lt;/i&gt;.  But it sounds like dealerships have access to codes for &lt;i&gt;all&lt;/i&gt; Ford cars, which is a pretty clear least-privilege violation.</text></item><item><author>toki5</author><text>I&amp;#x27;m not sure I&amp;#x27;d call this Ford&amp;#x27;s fault.&lt;p&gt;&amp;gt;Lopez said the smuggling organization was able to get a duplicate key from a locksmith in El Paso, who got the codes after calling up a Ford dealership.&lt;p&gt;&amp;gt;An FBI affidavit says someone at a Dallas auto dealer accessed the codes in Ford&amp;#x27;s database, giving out more than 2,300 codes over an 18-month period.&lt;p&gt;I think dealerships, of all places, would be (should be) allowed to have codes for cars in their lot. I trust dealerships to have these codes. If they do nefarious things with them, they should be punished, but I don&amp;#x27;t think Ford should be punished for having a dealership-accessible database of key codes. Whoever was cooperating with the criminals is, to me, the person to blame here (along with the criminals).&lt;p&gt;I&amp;#x27;d have sued that dealership, not Ford itself.</text></item></parent_chain><comment><author>toki5</author><text>A couple years ago, my used &amp;#x27;98 CRV&amp;#x27;s battery died. I got it replaced, and when I started it back up, the radio was locked out; I needed an unlock code that they&amp;#x27;d have given me when I bought the car, if the car hadn&amp;#x27;t passed through at least a dozen hands before finally reaching me.&lt;p&gt;I called up my nearest Honda dealership, gave them the VIN, and they gave me the radio code.&lt;p&gt;I like that they can do that. Maybe it makes more sense from a security standpoint if I would&amp;#x27;ve had to call some centralized Honda location, but that doesn&amp;#x27;t really solve the problem, does it? I have the VIN -- so does anyone who looks through my windshield. I have the title number -- so does the dealership who originally sold the car. We&amp;#x27;d have to enter a few concurrent bits of information to verify that I own it, that this car I&amp;#x27;m calling about is mine, and I can identify both it and myself, and then the centralized Honda location would have to be able to verify all that on their end.&lt;p&gt;Or we can assume some modicum of trust at dealerships, and accept the fringe cases where criminals use information they wouldn&amp;#x27;t have access to in a perfect world.</text></comment>