djc6

I reached out to them to get a refund for my Car Thing - and they actually sent me an email asking for my checking account number and routing number to be sent to them VIA EMAIL. And presumably into their ticket system where future hackers will find a nice collection of financial info.

I wonder if their CISO or security team is aware of this, I reached out to address found in https://www.spotify.com/.well-known/security.txt

Here is response I received:

Hello there,

Thanks for reaching out to us via messaging. Your case has been escalated to the highest tier of Customer Support here in Spotify. All communication within this email thread will be from the Escalation team from now on.

We can see that you've already sent a proof of purchase via chat. About refunding, please share the following details with us:

- Bank name - Bank Location - Account Holder Name - Routing & Account no - SWIFT - A screenshot of the required bank details on your online banking or bank letter (if it's possible).

Make sure to hide any sensitive payment information like your full card number for your security.

We'll keep an eye out for your response so we could sort this out.

Kind regards,

XXXX Escalations Team - Spotify Customer Support

Here is a poll on Spotify's community asking to open source it - already almost 800 "signatures":

https://community.spotify.com/t5/Live-Ideas/Car-Thing-Develo...

Seems maybe its already been hacked: https://www.xda-developers.com/spotify-car-thing-root/

Car Thing is just a bluetooth remote control for Spotify or other audio applications. The music still comes from the phone - to the car's speaker system via whatever method your phone is connected (bluetooth, aux jack, etc..)

I've really enjoyed using the Car Thing in my 14 year old Mazda CX9. My car shows no signs of failing, so I don't anticipate replacing it anytime soon for one with Carplay.

The Car Thing is so much more convenient than unlocking iPhone with my face, opening spotify, futzing around on the phone to change songs or playlists or whatever. And its easily accessible to my passenger. Its a far better interface than phone for use in the car! Its one of the main reasons I haven't switched to Apple Music which is bundled with my cell phone plan. I guess Spotify just wants me to got to Apple Music.