Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Internet-connected cars fail privacy and security tests conducted by Mozilla

gizmodo.com

Post reply on HN
Print view View original

371–380 of 660 posts

Re: Internet-connected cars fail privacy and security tests conducted by Mozilla

#371

Post by EricE »

ashafer wrote: post #247

Certain cars let you physically disable this. For example, the Tacoma has a "Data Communication Module" (DCM) that performs all of this and has a cell radio to phone home. There's a fuse in the fusebox you can pull to prevent the DCM from getting any power. Only side effect is the in-cabin microphone stops working and you can reconnect the fuse at any time. It's as if the engineering team didn't want to develop a spy…

lol - if they were only that altruistic. Toyota doesn't make the tech, they buy modules from suppliers and integrate the tech. Better hope someone doesn't come out with a fancy super module that has everything integrated because there will be no disabling it as soon as that happens :/

Don't forget Toyota was the manufacturer that was going to charge a monthly subscription just for the key fob (!) to work until they got a massive backlash over it. A freaking key fob that doesn't use cellular or the cloud at all - it's 100% local between the fob and the car. And don't think for one minute that they won't try to sneak it back in.

Re: Internet-connected cars fail privacy and security tests conducted by Mozilla

#372

Post by Pxtl »

cpursley wrote: post #143
tristor wrote: post #132

Of all the horrible things go on with privacy these days, this is the one I hate the most. I’m a “car guy”, but not the sort that obsesses over old cars (although I do love 60s and 80s cars). I like new tech, I like the advances in engineering we’ve made in new vehicles, I like EVs even. Nonetheless I’ve been in the market for a new car for months and haven’t bought because it’s hard to find any cars that meet my req…

The touchscreens are really a dealbreaker on new cars. They’re not just prone to quick obsolescence, they’re dangerous.

I drive a Prius and while the actual implementation of the touchscreen leaves a lot to be desired (dodgy software and usual issues with obsolescence), I do like the way it splits between touchscreen and buttons.

Buttons: all car controls, audio volume and selection, temperature.

Touchscreen: GPS, setting radio presets, changing climate mode.

Now, it's not perfect -- there are some climate options I'd like on buttons. But in general that's pretty good.

The big flaw is the lack of upgradeability. It felt a decade old, stylistically, when it was new, and it will never get newer. You can't even pop in a new car stereo to replace the whole thing anymore - and it's a massive chunk of the dash. And has no support for Android Auto.

Re: Internet-connected cars fail privacy and security tests conducted by Mozilla

#373

Post by OnionBlender »

spacemadness wrote: post #245
UtopiaPunk wrote: post #217

Who wants to see my impression of an HN commenter? OK, here it goes: "I'm tired of Mozilla's agenda and politics!! They should only make a web browser!!"

OK? I don’t think that sounds like an HN commenter at all.

The other thread delivers.

https://news.ycombinator.com/item?id=37406265

Re: Internet-connected cars fail privacy and security tests conducted by Mozilla

#374

Post by Kirby64 »

dylan604 wrote: post #278
ghaff wrote: post #229

Earlier quoted context omitted.

It's probably true that once you (more or less) need a screen for a decent backup camera and most people like a screen for at least GPS, it must be pretty tempting to at least think about what physical buttons can reasonably be eliminated given that the touchscreen is a given. And I do think a lot of designs go too far.

>and most people like a screen for at least GPS personal anecdotes, but the vast majority of me being a passenger to someone else's driving, they all used their mobile device for GPS. even the couple of cars i owned that had a nav system, the GPS came from the mobile device. it required their app to be installed to input the destination, making the internal unit just a second screen for your mobile.

That's because in car GPS tech has historically been absolutely atrocious. An example: 2008-2012ish Toyota Camrys had a GPS system that used a DVD for map data. Not only was it out of date immediately (and cost $150 per new DVD from the dealer), it was insanely slow.

Nowadays, there's a few companies that actually seem to do a decent job of GPS in the car itself: Mercedes has a good tech in their new EVs that seems smooth. Android automotive (not auto) cars have built in Google maps such as Polestar, the new Cadillac EVs, and some other Chevy products do well. Although it's not much different than just having an android phone with android auto. And, of course, Teslas own system which is all inhouse.

There's little reason to use a phone in the traditional phone holders if you own one of those cars.

Re: Internet-connected cars fail privacy and security tests conducted by Mozilla

#375

Post by absoluteharam »

yafbum wrote: post #231

The article is not very clear about whether this kind of abusive data collection is actually happening and they can prove it, or whether they found the text of the privacy policies to be overly broad. I have no idea how a car would infer my sexual orientation.

[dead]

Re: Internet-connected cars fail privacy and security tests conducted by Mozilla

#376

Post by thegrim000 »

hashtag-til wrote: post #3

I think it will be a good differentiation factor in a few years, that a brand comes up with an offline car, i.e. a car that you just refuel/charge and drive - no telemetry/connected features involved. It may be a niche thing in future, but certainly something that would be appealing to me as a consumer.

The major brands won't do it, there's no money in it for them to do so, and there's so much regulation, regulatory capture that it's virtually impossible to start a new auto manufacturer without having billions of dollars of private equity to flush down the toilet on it, to target a very small fraction of the market that would want such vehicles, and such a company would just be quickly regulated out of existence if it was ever actually created.

Re: Internet-connected cars fail privacy and security tests conducted by Mozilla

#377

Post by Nextgrid »

creeble wrote: post #340
sfaxon wrote: post #312

Earlier quoted context omitted.

I own a VW ID.4. For reasons I wanted to reverse engineer some of the API. After authenticating to the account tied to my car, the landing page ( https://www.vw.com/en/owners.html ) makes calls to a lot of analytics trackers. I'll just list what pi-hole defaults block: analytics.tiktok.com sp.analytics.yahoo.com googletagmanger.com universal.iperceptions.com cdn4.userzoom.com snap.licdn.com secure-ds.serving-sys.com…

Just to be clear, these are trackers from the web page , not trackers called by your car, correct? I'm never surprised by the web trackers (which my ad blocker generally filters too), but 3rd-party trackers called from devices/vehicles seems more insidious. Although the car / IoT companies can just as easily outsource the data once they have it anyway.

They however still have access to the JS context and thus the authenticated session when you are on the website. They can most likely exfiltrate all the data visible on the page and maybe even the auth token for further server-side misuse after you've closed the page.

Re: Internet-connected cars fail privacy and security tests conducted by Mozilla

#378

Post by [deleted] »

cpursley wrote: post #143
tristor wrote: post #132

Of all the horrible things go on with privacy these days, this is the one I hate the most. I’m a “car guy”, but not the sort that obsesses over old cars (although I do love 60s and 80s cars). I like new tech, I like the advances in engineering we’ve made in new vehicles, I like EVs even. Nonetheless I’ve been in the market for a new car for months and haven’t bought because it’s hard to find any cars that meet my req…

The touchscreens are really a dealbreaker on new cars. They’re not just prone to quick obsolescence, they’re dangerous.

[deleted]

Re: Internet-connected cars fail privacy and security tests conducted by Mozilla

#379

Post by ilikehurdles »

nojvek wrote: post #302
ilikehurdles wrote: post #205

Earlier quoted context omitted.

Auto margins are ridiculously thin, and if a manufacturer can trim 17 cents off a car’s manufacturing cost by removing a button, they usually will.

You have a source for that? I wish dealership margins were that thin. Cars are much more expensive post pandemic than pre-pandemic.

https://csimarket.com/Industry/industry_Profitability_Ratios... has some good data, as you see we’re talking mid to low single digits net, low teens gross. To your point, this is an increase that happened during the pandemic, interestingly.

Dealership margins, as I recall, are 10-20%, also not great.

Mfg margins have come up during the pandemic, interestingly, but historically have been very low[1]:

> While estimated aggregate industry operating profit margins are 6 to 7 percent (Exhibit 1), large variations in profitability exists across companies. For instance, some European niche, luxury companies make double-digit margins more akin to those of high-tech players, while mass-market (or value-focused) OEMs make 4 to 5 percent.

[1]: https://www.mckinsey.com/~/media/McKinsey/Industries/Automot...

Re: Internet-connected cars fail privacy and security tests conducted by Mozilla

#380

Post by kredd »

codedokode wrote: post #327

Isn't "free market" supposed to provide a choice between privacy-respecting and disrespecting products? No regulation required. Well, it seems like market forces do not work for minorities.

Free market can’t decide on things it doesn’t really understand consequences of. Ideally, that’s why we would have specialists from different fields in the government to make unbiased recommendations.
Post reply on HN