Earlier quoted context omitted.
In a lot of cars you can pull the fuse that powers the cellular modem without any side effects
you're taking to a bunch of old men shouting (literally) at clouds
Pulling a fuse in a car is peak old maning.
VW breach exposes location of 800k electric vehicles
161–170 of 317 posts
Re: VW breach exposes location of 800k electric vehicles
#162Earlier quoted context omitted.
What, exactly, makes it hard to get this to work reliably in the real world? The app already won’t work without a valid login session. The car is already sending a little blob of data to the mothership containing a location. If the communication to the mothership changes to having the mothership send a list of keys and the car encrypt its blob, that’s basically it. The total increase in communication needed is one ro…
The app and car will have intermittent connection to the internet. My car for example doesn't have reliable connection when it's parked in the garage, which is where I charge it. Your solution would add a lot of extra edge cases that needs to be considered. You have to ensure the updated key is reliably transferred to the mothership in a timely fashion, and subsequently that the key is reliably transferred to the car…
If the car has enough signal to report, it has enough signal to get the key update. I don't see the problem.
Losing connection for extended periods of time can get in the way of "timely" key updates but they won't cause the encryption to fail.
> That's the back-end stuff. There's also the front-end stuff, like will my SO understand why her app isn't showing the car's location but mine is?
Well the reasons I can think of are either things like the server being broken, which can happen without any encryption, or she didn't finish setting up her app and waiting for it to sync which can also happen without encryption. Or she was removed from the list because she didn't open the app for a year... which can also happen without encryption.
Re: VW breach exposes location of 800k electric vehicles
#163Earlier quoted context omitted.
I can even keep driving while the whole system is rebooting At least you're still acknowledging the abysmal state of modern cars by including this statement. Why on earth would anyone expect otherwise from a car?
if you are ever in the middle of highway (especially if you are traveling with loved ones) when your EV suddenly reboots you will understand why one does not expect shit to work… the anxiety is unlike most thing one can experience… I think 100% reverse of your comment but talking from a different real experiences. EVs are computers on wheels, expecting them to work during reboot is not unlike expecting vim to work du…
I would expect the drivetrain components (including computers) to be essentially bulletproof and only the unnecessary components like infotainment and maybe the dashboard displays to even have the option of crashing.
Re: VW breach exposes location of 800k electric vehicles
#164Why the sideways fuck did they even have location data to begin with? It's like the checklist for buying a new car starts with figuring out what circuit drives the cell modem and pop that fuse out before taking a test drive to confirm it doesn't brick anything critical. Fucking ridiculous.
Most new cars have features that require it such as onboard GPS, speed limits on the dash, OnStar and similar features.
None of that requires cellular connectivity. It can and was accomplished using only wifi sync at home. Live traffic information is (was?) broadcast on AM radio.
Re: VW breach exposes location of 800k electric vehicles
#165Earlier quoted context omitted.
After a certain point, parts just aren't made. I drive a 1997 ES300 that needs a new left rear taillight lens. The new part doesn't exist anymore, and I can't find a used part in Canada.
So uhhhh, buy one from USA?
They may very well be a different part. The USA and Canada have different regulations.
Re: VW breach exposes location of 800k electric vehicles
#166Earlier quoted context omitted.
You cannot establish a private channel between app and car if you don’t already have either a pre-shared secret, or pre-shared trusted certification authority keys (such as to allow TLS-like tamper-resistant encrypted communication between app and car) that VW can’t replace. Otherwise, if there is no pre-existing private channel, the key (which by the way would have to be the public key, not the private key) could be…
This argument seems like a fairly extreme example of the perfect being the enemy of the good. Sure, it would require a more advanced system for VW to prevent themselves from silently compromising their own system to learn everyone’s location. But the design I outlined will prevent a passive compromise of VW, and even possibly a court order, from learned everyone’s location, and it prevents even an active and highly m…
"Shipping the private key" does not meet the bar for "good". You still need a way to establish trust in your key distribution and also implement the system correctly. The proper way to secure access to a physical thing you own is to only communicate directly with that thing.
Re: VW breach exposes location of 800k electric vehicles
#167We need a way to disable vehicle telemetry. No, a software switch is not enough. We need to be able to physically unplug the cellular modem entirely and have the vehicle work with 100% functionality (barring features which inherently require cellular connectivity like turning the heating on remotely) Car manufacturers' features are mostly useless anyway thanks to Android Auto/Apple CarPlay
In many (all?) cars with cellular modems you can remove the SIM card to have this effect.
I would love a wiki of vehicles for simply 'how to rip out the SIM card'
I thought I saw instructions somewhere for my 2020 prius but can't find it now. a few reddit threads asking about it, I like the suggestion that even if its eSim or somehow embedded in the cellular modem, "Disconnect the antenna! / shunt the telecommunication modems antenna with a resistor shunt. It will trick the radio into thinking the antennas still connected but won't allow any data to be going out they just won't get signal"
https://www.reddit.com/r/Toyota/comments/1be9zuc/wheres_the_...
Re: VW breach exposes location of 800k electric vehicles
#168The answer is simple: No matter the reason, if you have a data breach you must pay each person 100$ min with higher amounts depending on the information lost. Additionally, if that information is used in a crime then you are liable for further damages. Car companies, and other data vacuums, will just stop collecting it if they are liable for what happens to it. I will not buy a car that does this. I am starting to tu…
The $100 thing is kind of a standard that a European court just established in a Facebook data leak case! In the case of full location data, it would need to be a lot more though. Yes, that might bankrupt the company. They should have thought about that before they illegally stalked nearly a million people then put their highly sensitive data on the Internet. If I did this to one person, I'd probably (and rightfully)…
[deleted]
Re: VW breach exposes location of 800k electric vehicles
#169Earlier quoted context omitted.
Again, that's the easy part. The hard part is making it work reliably in the real world.
What, exactly, makes it hard to get this to work reliably in the real world? The app already won’t work without a valid login session. The car is already sending a little blob of data to the mothership containing a location. If the communication to the mothership changes to having the mothership send a list of keys and the car encrypt its blob, that’s basically it. The total increase in communication needed is one ro…
> I realize that modern development has layers and layers of documents
Where do you work and are you hiring?
Re: VW breach exposes location of 800k electric vehicles
#170We need a way to disable vehicle telemetry. No, a software switch is not enough. We need to be able to physically unplug the cellular modem entirely and have the vehicle work with 100% functionality (barring features which inherently require cellular connectivity like turning the heating on remotely) Car manufacturers' features are mostly useless anyway thanks to Android Auto/Apple CarPlay
I believe my new car has a fuse you can pull to disable the remote telemetry. However, it disables some useful features, like being able to set valet mode from the Toyota app (useful because some dealer service departments will take cars joy riding) and track the car usage. it also tracks tire pressures. sure the tire pressure can easily be checked manually with my Slime gauge but having it on the phone is handy.
I've read disabled cellular modem on toyota prius also disables the microphone for bluetooth phone calls / handsfree commands. funny that.