Live data from Hacker News

Volkswagen blocks Home Assistant by requiring client assertion

github.com

101–110 of 203 posts

Re: Volkswagen blocks Home Assistant by requiring client assertion

#101

Quite a few other manufacturers have done the same thing. I use a reverse engineered Polestar library to get charging status but I'm in the middle of building a CANBUS sniffer to do the same job because I don't trust they won't do the same thing as this. I don't really understand it, it doesn't seem to offer a huge potential revenue stream and it pisses off the people who are most invested in your product.

Is there a repo for the new project?

Re: Volkswagen blocks Home Assistant by requiring client assertion

#102
post #58

Earlier quoted context omitted.

If they’ve done it using Secure Enclave it’s essentially physically impossible to spoof.

Wouldn’t any Volkswagen keys need to cross the network to get into the Secure Enclave? Or couldn’t you exploit the Volkswagen app itself?

Keys in the Secure Enclave never leave the device (or the SE for that matter) and cannot be extracted even physically.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#103
post #78

Earlier quoted context omitted.

This is not an intelligent comment. the Nazi parry and modern-day Volkswagen have nothing in common, whereas Tesla is currently^ actively^ run by someone morally reprehensible to many. If you had any actual understanding—:as opposed to just hearing this little factoid in passing and have been waiting for every opportunity to whip it out— you’d know that already. It’s funny as a quip, but don’t for a a second act like…

Stop pasting LLM replies through fake accounts. Dieselgate happened very recently (in this decade). Just research your stuff before you slap a prompt onto an LLM please.

[dead]

Re: Volkswagen blocks Home Assistant by requiring client assertion

#104
BYD DMCAd my whole repo to connect to their cars... https://github.com/github/dmca/blob/master/2026/05/2026-05-2... It's a shame these car makers are locking down their cars (which are brought for a premium!) and going on a crusade against open source.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#105

Quite a few other manufacturers have done the same thing. I use a reverse engineered Polestar library to get charging status but I'm in the middle of building a CANBUS sniffer to do the same job because I don't trust they won't do the same thing as this. I don't really understand it, it doesn't seem to offer a huge potential revenue stream and it pisses off the people who are most invested in your product.

The ability to interface with your car is fundamentally at odds with the regulatory momentum that's going towards encrypted everything.

Take a look what the automotive risc-v people are working on or the requirements of the EU cyber resilience act.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#106

Earlier quoted context omitted.

How is this a tangible income stream? I suspect that the amount of customers willing to pay for some weird API access or We Connect offering is rather limited. It would have to be bundled into some other solution, which again I'd guess have a limited customer base. I have VW and I suppose We Connect, there's not a single thing that's worth paying for, not when you have CarPlay and Android Auto (or whatever that's cal…

> I suspect that the amount of customers willing to pay for some weird API access or We Connect offering is rather limited I tend to agree. But the counterpoint is Tesla. They charge for API access, and there are several businesses that exist to make that data available to customers. I don’t know how valuable it really is, but it’s working. My wife would pay Ford for the level of data she was getting from TeslaFi but…

That's my line of thinking with the "bundled into some other solution". It doesn't make a ton of sense for an individual to buy API access, but other companies could provide a service built in the API, and they are the ones paying VW.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#107
post #59

Quite a few other manufacturers have done the same thing. I use a reverse engineered Polestar library to get charging status but I'm in the middle of building a CANBUS sniffer to do the same job because I don't trust they won't do the same thing as this. I don't really understand it, it doesn't seem to offer a huge potential revenue stream and it pisses off the people who are most invested in your product.

They already add cryptographic authentication to some CAN messages, so you can't change them. It is only a matter of time until they add encryption. This is mostly a corporate problem of risk aversion in my opinion. Some department writes down a risk assessment with a list of miniscule risks, for example of some 3rd party app backend being hacked. Or just a headline "Tinkerer hacked his car to use with his home assis…

It’s a fair assumption that most of these things are trickle-down effects of CMS/R155 and CRA combined with very high risk aversion on the company side. The less you expose, the lower the risk.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#108
post #59

Quite a few other manufacturers have done the same thing. I use a reverse engineered Polestar library to get charging status but I'm in the middle of building a CANBUS sniffer to do the same job because I don't trust they won't do the same thing as this. I don't really understand it, it doesn't seem to offer a huge potential revenue stream and it pisses off the people who are most invested in your product.

They already add cryptographic authentication to some CAN messages, so you can't change them. It is only a matter of time until they add encryption. This is mostly a corporate problem of risk aversion in my opinion. Some department writes down a risk assessment with a list of miniscule risks, for example of some 3rd party app backend being hacked. Or just a headline "Tinkerer hacked his car to use with his home assis…

> It is only a matter of time until they add encryption.

I hope I won't be in one of those cars when the in-memory encryption key gets bit-flipped by the unfortunate cosmic ray.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#109

This comment has really nice translation of corpo-speek to human language : https://github.com/robinostlund/homeassistant-volkswagencarn... Why are they shooting them selves in the feet? Is this really a tangible income stream? Is it really increasing security?

By the way, regarding additional profit stream, to access VW data before you still needed WeConnect subscription (100€ a year), just that before you could use another app or automation to access the data. Now you MUST use exclusively WeConnect and partners to access same data even though you paying already for subscription.

Pretty sure connect is free for like ten years.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#110
post #87

Where's the 'Open Source Car'? Where's the open source phone? The open source washing machine?

We used to have them. Devices so simple anyone with a hammer could fix. Maybe not open source as we understand it today, but rather - trivially reverse engineerable, often with schematics included. Most complex would be rewiring the motor on a washing machine. Did their job fine, but you can't sell them forever, so more complex devices were introduced. Nowadays motorcycles would probably be the closest equivalent, th…

> more complex devices were introduced

And people buys them because they don't care

Post reply on HN