171–180 of 203 posts
Earlier quoted context omitted.
Which brand are you thinking of, then?
Done buying new cars in general. It was always a sucker's game, and now a new car offers little besides various unwanted features and added restrictions, all in support of misguided regulations and other peoples' business models.
Quite a few other manufacturers have done the same thing. I use a reverse engineered Polestar library to get charging status but I'm in the middle of building a CANBUS sniffer to do the same job because I don't trust they won't do the same thing as this. I don't really understand it, it doesn't seem to offer a huge potential revenue stream and it pisses off the people who are most invested in your product.
They already add cryptographic authentication to some CAN messages, so you can't change them. It is only a matter of time until they add encryption. This is mostly a corporate problem of risk aversion in my opinion. Some department writes down a risk assessment with a list of miniscule risks, for example of some 3rd party app backend being hacked. Or just a headline "Tinkerer hacked his car to use with his home assis…
https://www.thedrive.com/news/shadetree-hackers-are-stealing...
/me scratches VAG cars from a possible new EV purchase. I hate Elon as much as the next guy, but Tesla is still playing the API game way better than the rest of the pack (even with the "not so new" Tesla Fleet API change)
Volvo is also doing pretty good with offering an official API
If you want a real Volvo get an old one.
Earlier quoted context omitted.
You should email Louis Rossmann, he's been helping people in similar situations.
I cannot figure out of Louis is Batman or Don Quixote, charging at the "windmills" of MAMAA: (Meta, Apple, Microsoft, Amazon, Alphabet).
Quite a few other manufacturers have done the same thing. I use a reverse engineered Polestar library to get charging status but I'm in the middle of building a CANBUS sniffer to do the same job because I don't trust they won't do the same thing as this. I don't really understand it, it doesn't seem to offer a huge potential revenue stream and it pisses off the people who are most invested in your product.
I've been doing smart home stuff for a long time. This is one of the reasons why I got off of Home Assistant. It's a very cool and functional project but it is entirely dependent on companies keeping their APIs open, or, more commonly, companies not patching teh magic that makes reverse-engineered APIs possible. Unfortunately, developments over the years have NOT gone in their favor. Tesla, Ring, MyQ, Ecobee and prob…
Earlier quoted context omitted.
If the data is going through the air or a wire it can be sniffed, right? Is every message signed or encrypted like ssl/tls, or is this just some kind of extra header(s)?
Wrong.
Earlier quoted context omitted.
Done buying new cars in general. It was always a sucker's game, and now a new car offers little besides various unwanted features and added restrictions, all in support of misguided regulations and other peoples' business models.
Used cars also have brands! Which one would you be thinking of? Just curious!
If you like traditional coupes/sedans, Toyota or Lexus are probably good bets. I just read about a guy who is making a career out of restoring and reselling a specific Lexus model, which I thought was pretty cool: https://www.roadandtrack.com/news/a71435133/wisconsin-dealer... That kind of effort is going to become more common over the next few years, IMO.
If you like sports cars, Porsche peaked in the early-to-mid 2010s in terms of both quality and features.
If you like SUVs, I would think Japanese legacy brands would still be a good way to go. The last car on earth will probably be somebody's Toyota pickup or Land Cruiser from c. 2010.
Earlier quoted context omitted.
Used cars also have brands! Which one would you be thinking of? Just curious!
That's a matter of taste, really. Good-quality brands with historically-good parts support are what I stick with. If you like traditional coupes/sedans, Toyota or Lexus are probably good bets. I just read about a guy who is making a career out of restoring and reselling a specific Lexus model, which I thought was pretty cool: https://www.roadandtrack.com/news/a71435133/wisconsin-dealer... That kind of effort is going…
Earlier quoted context omitted.
If they’ve done it using Secure Enclave it’s essentially physically impossible to spoof.
If the data is going through the air or a wire it can be sniffed, right? Is every message signed or encrypted like ssl/tls, or is this just some kind of extra header(s)?
And then, even if you could look inside, there's another type of asymmetric cryptography going on: the remote attestation itself. Again, if properly designed and possibly backed by a hardware security chip, it cannot be spoofed. This isn't something trivial like a shared secret in an HTTP header.