Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Volkswagen blocks Home Assistant by requiring client assertion

github.com

Post reply on HN
Print view View original

131–140 of 203 posts

Re: Volkswagen blocks Home Assistant by requiring client assertion

#131

Post by joe_mamba »

mschuster91 wrote: post #117
lII1lIlI11ll wrote: post #95

Earlier quoted context omitted.

> The US has always been willing to grant hefty amounts of taxpayer money to startups Care to elaborate? I was under impression that absolute majority of startups in US are fully funded by a (private) venture capital. There are (were?) some exceptions like tax reductions on "green" projects, but they were not restricted to startups/small companies in any way.

> I was under impression that absolute majority of startups in US are fully funded by a (private) venture capital. Tesla got a shitload of government funding, including a 465 million dollar loan [1]. SpaceX was effectively funded by NASA in its early days. In total, the Muskverse alone got 38 billion dollars [2]. Bezos' Blue Origin got at least 1.5 billion dollars [3]. Sure, by number most startups are fully privatel…

>Tesla got a shitload of government funding, including a 465 million dollar loan

How much money, grants, tax-breaks, favorable loans and regulation, etc did the German, French, Italian car companies get from their local governments?

> But that doesn't mean the US government isn't willing to help things along, at least for those well connected.

As if Schroeder, Merkel, Scholz, etc didn't roll over backwards for their private industry political backers. The CEOs of VW, BMW and Daimler had those guys on speed dial.

Please, let's not pretend only the US government is helping its giants and the Europeans never.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#132

Post by joe_mamba »

mschuster91 wrote: post #121
joe_mamba wrote: post #84

Earlier quoted context omitted.

>Access to capital, mostly. German auto makers were wealthier than the US auto makers. Germany's GDP is now third in the world. There is capital. >Germans don't want taxpayer money to be spent on risky adventures But they wanted it to be spent on Russian gas pipelines, foreign aid, anti nuclear activism, and in the pockets of politically connected multinationals like T-systems to build another "government digitalizat…

> German auto makers were wealthier than the US auto makers. Germany's GDP is now third in the world. There is capital. The problem is, that capital is stuck in the bank accounts of the uber rich. > But they wanted it to be spent on Russian gas pipelines, foreign aid, anti nuclear activism, and in the pockets of politically connected multinationals like T-systems to build another "government digitalization project" w…

>- Germany has drastically cut back on foreign aid funding, which in return killed off a lot of the goodwill Germany enjoyed in the Global South, we all know that China and Russia filled the gap.

Germany now surpassed the US as the biggest foreign aid spender in the world, in absolute terms, not per capita

Re: Volkswagen blocks Home Assistant by requiring client assertion

#133

Post by cisophrene »

b3lvedere wrote: post #124
cisophrene wrote: post #108

Earlier quoted context omitted.

> It is only a matter of time until they add encryption. I hope I won't be in one of those cars when the in-memory encryption key gets bit-flipped by the unfortunate cosmic ray.

Proving that autopilot killed that poor old granny because of cosmic rays would be an interesting case study.

It actually happened with Toyota around 2010: they went into a settlement regarding an unintended acceleration issue because it was proven the code was terrible and a single bit-flip could cause the behaviour.

https://en.wikipedia.org/wiki/2009%E2%80%932011_Toyota_vehic...

Re: Volkswagen blocks Home Assistant by requiring client assertion

#134

Post by Confiks »

kuizu wrote: post #96

Wasn't the EU Data Act ( https://digital-strategy.ec.europa.eu/en/policies/data-act ) put in place to exactly prevent these kind of scenarios (Article 4 and 5)? "where the user cannot directly access the data from the connected product or related service, the data holder must make the readily available data and necessary metadata accessible to the user without undue delay, in the same quality as available to the data…

Indeed, this seems to be exactly the area where the Data Act could be used to regain access. Unfortunately it seems that it's not possible to directly sue (e.g.) Volkswagen to get access, unlike the GDPR where you have direct standing under article 79 [1].

There doesn't seem to be much written about enforcing the Data Act, so I looked at the regulation directly. Article 39 [2] seems to require to first lodge a complaint with the competent authority as designated by the member state of your residence. Then when that authority invariably fails to act – I have no idea which timeframe we're talking about here – you can "in accordance with national law, either have the right to an effective judicial remedy or access to review by an impartial body with the appropriate expertise". But then you are suing that authority, and not the company directly (edit: I was originally unsure about who to sue under article 39, but 39(3) does clarify that it is the authority).

I would very much like to be wrong about this. I can imagine Muñoz vs. Superior Fruiticola applies [3] ("it must be possible to enforce that obligation by means of civil proceedings"), but I'm not at all sure, and it's a much weaker route than the one which the GDPR explicitly describes.

Would anyone know or have better references on how to enforce the Data Act, preferably individually?

[1] https://gdpr-info.eu/art-79-gdpr/

[2] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=OJ:...

[3] https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELE...

Re: Volkswagen blocks Home Assistant by requiring client assertion

#135

Post by therealpygon »

summm wrote: post #59
venzaspa wrote: post #24

Quite a few other manufacturers have done the same thing. I use a reverse engineered Polestar library to get charging status but I'm in the middle of building a CANBUS sniffer to do the same job because I don't trust they won't do the same thing as this. I don't really understand it, it doesn't seem to offer a huge potential revenue stream and it pisses off the people who are most invested in your product.

They already add cryptographic authentication to some CAN messages, so you can't change them. It is only a matter of time until they add encryption. This is mostly a corporate problem of risk aversion in my opinion. Some department writes down a risk assessment with a list of miniscule risks, for example of some 3rd party app backend being hacked. Or just a headline "Tinkerer hacked his car to use with his home assis…

I suspect the manufacturer probably cares less about what you do to your own car and hacking it, than they do about the potential for security compromise of their products on a broader scale, where they will then get blamed and sued for not having closed said loopholes. It is a no-win situation when it comes to fault assignment.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#136

Post by Retr0id »

brabel wrote: post #102
dullcrisp wrote: post #76

Earlier quoted context omitted.

Wouldn’t any Volkswagen keys need to cross the network to get into the Secure Enclave? Or couldn’t you exploit the Volkswagen app itself?

Keys in the Secure Enclave never leave the device (or the SE for that matter) and cannot be extracted even physically.

Newer devices support Remote Key Provisioning (RKP), so you still can't export keys but you can import them. (Physical attacks are still possible, just very difficult)

Re: Volkswagen blocks Home Assistant by requiring client assertion

#137

Post by b3lvedere »

cisophrene wrote: post #133
b3lvedere wrote: post #124

Earlier quoted context omitted.

Proving that autopilot killed that poor old granny because of cosmic rays would be an interesting case study.

It actually happened with Toyota around 2010: they went into a settlement regarding an unintended acceleration issue because it was proven the code was terrible and a single bit-flip could cause the behaviour. https://en.wikipedia.org/wiki/2009%E2%80%932011_Toyota_vehic...

Very interesting read. Thank you for the link.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#138

Post by chadgpt3 »

msandford wrote: post #113
brabel wrote: post #58

Earlier quoted context omitted.

If they’ve done it using Secure Enclave it’s essentially physically impossible to spoof.

If the data is going through the air or a wire it can be sniffed, right? Is every message signed or encrypted like ssl/tls, or is this just some kind of extra header(s)?

Wrong.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#139

Post by stonogo »

neya wrote: post #39
charcircuit wrote: post #32

Earlier quoted context omitted.

Just because the Nsdap party created something that doesn't mean you can automatically treat it is bad. That is prejudice. Something bad happening decades and decades after the party's dissolution is not going to be directly related. It is a reach to think unsupported third party apps breaking is related.

While I agree with you in principle, I don't think this is followed equally. Tesla's are still being vandalized to date, though. Selective outrage is a dangerous thing.

More or less dangerous than non-selective outrage?

Re: Volkswagen blocks Home Assistant by requiring client assertion

#140

Post by Finnucane »

mcosta wrote: post #110
spaqin wrote: post #87

Earlier quoted context omitted.

We used to have them. Devices so simple anyone with a hammer could fix. Maybe not open source as we understand it today, but rather - trivially reverse engineerable, often with schematics included. Most complex would be rewiring the motor on a washing machine. Did their job fine, but you can't sell them forever, so more complex devices were introduced. Nowadays motorcycles would probably be the closest equivalent, th…

> more complex devices were introduced And people buys them because they don't care

And have been convinced there is no alternative. And if you suggest investing in public transit or building mixed-use neighborhoods that don't require car access they'll pop their suburbanite heads.
Post reply on HN