Bugs allowed hackers to dox John Deere tractor owners
Having worked on a John Deere integration for an agtech company I can't say I'm surprised. The MyJohnDeere API had a lot of idiosyncrasies that smelled like inexperienced or mismanaged development, especially around authentication/authorization.<p>At the time I was working on it they had some extremely arcane authentication process that required round-trip emails, various link clicking and code entering, and all kinds of craziness. Toward the end of my tenure our point of contact finally told us they were moving to OAuth but they had nearly zero documentation on it.<p>For anyone who isn't knowledgable in the farming space, I'd highly recommend a browse through John Deere's API documentation [0]. Before the agtech gig I hadn't really given it a second though, but modern farms are very high tech operations. Really cool stuff happening in agtech.<p>[0] <a href="https://developer-portal.deere.com/#/myjohndeere/api-inventory" rel="nofollow">https://developer-portal.deere.com/#/myjohndeere/api-invento...</a>