content: Troy Hunt reported that a flaw with the electric vehicle's companion app also meant data about drivers' recent journeys could be spied on. Mr Hunt said he gave the firm a month to fix the issue before he decided to make it public. Nissan said there was no safety threat.  I'd say this is pretty significant, and Nissan is thumbing its nose at its customers.  Mr Hunt said the root of the problem was that the firm's NissanConnect app needed only a car's vehicle identification number (Vin) to take control. The code is usually stencilled into a car's windscreen, making it relatively easy to copy. The initial characters of a Vin refer to the brand, make of car, and country of manufacture/location of the firm's headquarters. So, Mr Hunt said, it would only be the final numbers that varied between different Nissan Leafs based in the same region. "Normally it's only the last five digits that differ," he explained. "There's nothing to stop someone from scripting a process that goes through every 100,000 possible cars and tries and turn the air conditioning on in every one. They would then get a response that would confirm which vehicles exist."  I'd say that this is seriously alarming, and the fact that nobody caught this mistake speaks to Nissan's lack of elementary security design. If they would do something as stupid as print the password required to access the car ON THE CAR ITSELF IN PLAIN VIEW, I think we need to seriously reconsider whether they should even be trusted with control of air conditioning.