I might be soon moving to Europe and would need to get a new car, replacing my (mostly) beloved Toyota bz4x.
Well I guess VW is out.
Volkswagen started blocking GrapheneOS users
301–310 of 497 posts
Re: Volkswagen started blocking GrapheneOS users
#302Earlier quoted context omitted.
If they have concerns about the security of their app on some platform, they have the choice to either put "security" into the app, or to trust the platform vendor to provide the security. The correct solution is the first way. Deferring trust to the platform provider is the lazy way. If their APIs are done correctly, they shouldn't be afraid to expose them.
How else would you build "security" into the app (in the sense of not allowing third-party modifications of it that would open them up to liability), except relying on hardware attestation that the app has not been modified? That attestation necessarily requires the platform provider to be involved.
You don't, the app runs on a user-supplied device. They should secure the part that runs on the car and consider the interface between the app and the api to be a user interface.
Re: Volkswagen started blocking GrapheneOS users
#303It is amazing how Volkswagen keeps messing up. I am currently in the market for a new car, an EV specifically. Volkswagen brands were at the top of my list for many reasons, among them the excellent driving assist implementation. I got an offer from a dealer three weeks ago and was going to order the car, then the API for the community integration got turned off. I decided to hold back and see what comes from it. Now…
German companies, especially old school industrial ones like VW, have a very hard time understanding open platforms. The view everything through the lense of liability and compliance first. Their thinking is that if someone runs their app on a custom ROM and uses that to manipulate the app in any way, and that causes some extremely hypothetical damage, that they might be held liable for not having prevented this situ…
Germans will talk a lot about data privacy but then do stuff like this regularly.
Re: Volkswagen started blocking GrapheneOS users
#304Earlier quoted context omitted.
The GrapheneOS supporters are not on our sides, apparently. The seem to actually like remote attestation. They just don't like that they are not in on Play Integrity. But what is won if attestation includes official GrapheneOS releases but would still otherwise be exactly the same evil stuff that takes control of the user's device? I still am hoping that at one point they understand the full consequences of remote at…
Note that I am a GrapheneOS supporter. You seem to have a few misconceptions. GrapheneOS is one of, if not the most vocal organization against the abuse of attestation mechanisms. GrapheneOS and its userbase feel the consequences of play integrity every single day. Im not sure where you got the idea that all GrapheneOS wants is to be accepted by play integrity, because that is not the case. GrapheneOS has been workin…
My opinion: Any kind of attestation that is delivered to a non-user-controlled server about the state of a user's end device that the user (possibly using means outside of the end device) cannot change will be abused, e.g for anti-competitve purposes.
I am hearing lots of arguments that grapheneOS is more secure (it is) and should therefore be included in remote attestation.
The pinning you are proposing, does it imply that there is again some certification of the "official" GrapheneOS, versus e.g. the user's own fork of GrapheneOS?
How would any of the existing proponents of remote attestation agree to anything like this, given what we consider abuse is exactly their reason of implementing it in the first place? Here, VW wants to stop use of the API by anything else than their App, in order to stop hobbyists and sell API access to commercial middle men. If the user could pin their own software's attestation or even register an arbitrary public key to cover updates, then the user would as well be able to code his own API client that just emulates the attestation. Is there any write up or discussion of the pinning you propose?
I am really not yet convinced how you want to counter the inevitable abuse that app developers and service providers will subject the user to if the OS security model gives them that kind of power over the user's end device.
Re: Volkswagen started blocking GrapheneOS users
#305Earlier quoted context omitted.
> also, what scale of harm do you think exists from those people? Serious health complications, particularly to cyclists and pedestrians. Significant pollution surges: > According to government estimates, the practice can increase nitrogen oxide emissions as much as 310 times, non-methane hydrocarbons 1,400 times, and carbon monoxide 120 times. [ https://www.rawstory.com/raw-investigates/rolling-coal-donal... ] > AED…
The reason diesel folks delete emissions is because the way the new diesel motors are set up actually kills the motor. Buying a new motor (or a whole truck!) is extremely expensive. Now if the automotive industry came out with an efficient diesel that also ran well for more than 100k miles, we’d see a lot less deletions.
It's far more expensive to run a chemical plant where you just dump your waste products in the river, but that doesn't make it right or legal.
Re: Volkswagen started blocking GrapheneOS users
#306Earlier quoted context omitted.
> also, what scale of harm do you think exists from those people? Serious health complications, particularly to cyclists and pedestrians. Significant pollution surges: > According to government estimates, the practice can increase nitrogen oxide emissions as much as 310 times, non-methane hydrocarbons 1,400 times, and carbon monoxide 120 times. [ https://www.rawstory.com/raw-investigates/rolling-coal-donal... ] > AED…
All 550K diesels with modded emissions are not rolling coal, that is a wild extrapolation I didn’t ask the multiplier of badness of a single individual doing a bad and stinky thing, I asked what you think the _scale_ is. Do you believe that all people with trucks modified to do this are doing it at all times? Or even half the time? How many people do you think are doing it?
I am absolutely certain that more people are rolling coal than are tinkering with their engine timings for benign performance reasons.
Re: Volkswagen started blocking GrapheneOS users
#307Isn't this for the same reason why you can't do banking on an unlocked bootloader phone? There's no way to verify the integrity of the system, and any malicious app can just grab your banking credentials or enable criminals to unlock and drive away with your car.
> There's no way to verify the integrity of the system, and any malicious app can just grab your banking credentials or enable criminals to unlock and drive away with your car.
I don't see how the second half of the sentence follows from the first half.
Re: Volkswagen started blocking GrapheneOS users
#308Earlier quoted context omitted.
I have a GTI and with cruise control on, the speedo and my phone's gps reads exactly the same speed.
I have a Audi A3, speedometer reads ~6km/h too high compared to GPS and various "speed-showing signs" I've driven past.
My 18 year old A3 reads about 1mph higher than the true speed at motorway speeds. It's pretty spot-on, which is very unusual.
Re: Volkswagen started blocking GrapheneOS users
#309Earlier quoted context omitted.
How are all these "broken and dangerous"? In my car (Volvo) they work rather well. Perhaps sign detection sometimes misses signs, but so do I so I can't fault it. The others though, I rank them all somewhere between "genuinely useful" and "absolutely awesome"
N.B. I didn't write /all/ were "broken and dangerous" But some personal examples: - Auto high beam assist saw a car at a side junction, turned off high beam, then turned back on, mimicking a 'flash' to let the car out, which they acted on by pulling out. I had to brake hard to avoid them. I was doing 60 mph - I was on the motorway and a stranded vehicle was on the hard shoulder and the driver decided to exit from the…
PSA: Flashing someone is never a signal that you're giving them priority. That is explicitly forbidden in the highway code and dangerous. Flashing someone, like using the horn, only means "I'm here, just in case you didn't see me". If someone flashes you, you should make your own determination whether it is safe to perform a manoeuvre, making no assumptions about anything that the person who flashed you might be seeming to be promising.
Re: Volkswagen started blocking GrapheneOS users
#310Earlier quoted context omitted.
I have a Audi A3, speedometer reads ~6km/h too high compared to GPS and various "speed-showing signs" I've driven past.
My 18 year old A3 reads about 1mph higher than the true speed at motorway speeds. It's pretty spot-on, which is very unusual.
Ah, mine is quite precisely 10 years younger, and also European if that matters, sounds like yours might be Mexican if it's in the US unless I'm mistaken. I guess there is some tuning process at the end of fabrication/production, maybe just "wild luck" either way.