Live data from Hacker News

VW breach exposes location of 800k electric vehicles

cyberinsider.com

261–270 of 317 posts

Re: VW breach exposes location of 800k electric vehicles

#261

Earlier quoted context omitted.

My solution: Buy an old car...

modern cars are unfortunately much safer

There are “modern” cars (~5-10 years old) that fit most of the modern safety standards and are effectively not transmitting things due to 3G no longer being much of a thing, coupled with automakers being glacially slow at replacing certain electronic components.

Re: VW breach exposes location of 800k electric vehicles

#262

Earlier quoted context omitted.

The app and car will have intermittent connection to the internet. My car for example doesn't have reliable connection when it's parked in the garage, which is where I charge it. Your solution would add a lot of extra edge cases that needs to be considered. You have to ensure the updated key is reliably transferred to the mothership in a timely fashion, and subsequently that the key is reliably transferred to the car…

If the car has enough signal to report, it has enough signal to get the key update. I don't see the problem. Losing connection for extended periods of time can get in the way of "timely" key updates but they won't cause the encryption to fail. > That's the back-end stuff. There's also the front-end stuff, like will my SO understand why her app isn't showing the car's location but mine is? Well the reasons I can think…

> Losing connection for extended periods of time can get in the way of "timely" key updates but they won't cause the encryption to fail.

To be fair, if the car is offline while a newly installed app logs in, then the app won’t be able to locate the car until the car checks in. Which is not actually the end of the world, and there are ways to mitigate this. (See iMessage and Keybase for a couple of different approaches to this. See Signal for a shockingly poor group of bizarrely mutually incompatible solutions that barely work. I think that Matrix tries, too. MLS should be able to handle it, and piggybacking off an existing standard like MLS might be entirely reasonable albeit dramatically more complex than the simple solution I outlined.)

Re: VW breach exposes location of 800k electric vehicles

#263
post #169
post #131

Earlier quoted context omitted.

What, exactly, makes it hard to get this to work reliably in the real world? The app already won’t work without a valid login session. The car is already sending a little blob of data to the mothership containing a location. If the communication to the mothership changes to having the mothership send a list of keys and the car encrypt its blob, that’s basically it. The total increase in communication needed is one ro…

> I realize that modern development has layers and layers of documents Where do you work and are you hiring?

[deleted]

Re: VW breach exposes location of 800k electric vehicles

#264

Earlier quoted context omitted.

Hmm yeah but anything over 15 years isn't really viable as a daily driver anyway. Then you're getting to the point where you start having serious issues every year at the mandatory mechanical check. Then you're getting into old-timer drive once on a sunny day territory. I always bought medium sized cars at 10 years when they're already only a grand or two. The smallest ones are made so cheaply that they're already to…

>Then you're getting to the point where you start having serious issues every year at the mandatory mechanical check More like every couple months on the road, from my experience in having driven one. Just this year here are couple of things that have occurred: >glowplugs burnt out >air-mass sensor failure >faulty abs-sensor >fuel nozzle malfunction >brake failure >engine back support failure >short circuit after wor…

Yeah at that point I'd just go for another 10 year old car.

My last car was a Volvo S40, had really nice leather interior, nearly full option and cost me €2000.

I only had a few brake pads an a broken trunk cable to deal with (super common issue on this model), the latter I did myself for €40 in parts. Ran great for years. But yeah there's an element of luck also.

My previous car was an Octavia, that had more issues. Electric window broke and I replaced it all myself. But it was a pretty nasty job. Eventually the gearbox started whining and when I brought it to the shop it basically blew up. But it had served me 5 years at that point. Cost me €1200 to buy.

Re: VW breach exposes location of 800k electric vehicles

#266

Earlier quoted context omitted.

To a large extent this depends on the car and depends what you mean by "old". Modern cars vs. 1970s cars? The older cars are completely hopeless. Modern cars vs. 15 year old cars? The older cars may have had things like ABS and side airbags as options rather than as standard, but you can find one that has them that doesn't have cellular telemetry.

IIRC, there is for Europe a directive which requires 60/65% (?) of the force within a crash must be absorbed by the frame/chassis. It came into action around 2015, IIRC.

That's when it became mandatory on all vehicles, not when the first vehicle to satisfy the standard became available on the market.

As another example, side impact airbags have been mandatory in the US since 2013, but the Volvo 850 had them in 1995 and they were present on something like half of new cars a decade before they were mandatory and >97% of new cars three years before the mandate.

Re: VW breach exposes location of 800k electric vehicles

#267

Earlier quoted context omitted.

To a large extent this depends on the car and depends what you mean by "old". Modern cars vs. 1970s cars? The older cars are completely hopeless. Modern cars vs. 15 year old cars? The older cars may have had things like ABS and side airbags as options rather than as standard, but you can find one that has them that doesn't have cellular telemetry.

Cars from 2010 with optional ABS? Maybe domestic third world sub-$10k tuna cans? But the larger point is definitely true.

Apparently the 2010 Chevy Cobalt was available without ABS. Definitely in the minority even 15 years ago though.

Re: VW breach exposes location of 800k electric vehicles

#268

We need a way to disable vehicle telemetry. No, a software switch is not enough. We need to be able to physically unplug the cellular modem entirely and have the vehicle work with 100% functionality (barring features which inherently require cellular connectivity like turning the heating on remotely) Car manufacturers' features are mostly useless anyway thanks to Android Auto/Apple CarPlay

It's pretty much industry standard for all consumer products to deliver metrics back to home base. Honestly there are many good reasons to do so and it does result in finding real problems and solving them. While I understand the argument that we did fine in these products for decades without them, the complexity of the products was also a lot less back then. Finding issues via metrics from the production fleet is an…

> Honestly there are many good reasons to do so and it does result in finding real problems and solving them.

Tell that to Microsoft. Although their products have telemetry, they become shittier every day.

Re: VW breach exposes location of 800k electric vehicles

#269

Earlier quoted context omitted.

> Honestly there are many good reasons to do so and it does result in finding real problems and solving them. Honest question, what is a good reason to do this? My Logitech software sends telemetry to Logitech. My VW apparantly sends my GPS coordinates. How is this useful for improving their hardware?

I'm not sure I can defend all choices various vendors make, but there are plenty of signals that are helpful. Precise gps coordinates seem unnecessary, but some sort of region based information can help correlate whether there is a particular problem that might happen at far higher rates in hilly terrain or specific humidity levels. Users also often use products in a way that doesn't line up with how the product owne…

> some sort of region based information can help correlate whether there is a particular problem that might happen at far higher rates in hilly terrain or specific humidity levels.

You know what will help in those situations ? Testing.

It is expensive, i know. Why not skip it and just analyse the KPIs from the telemetry. /s

Re: VW breach exposes location of 800k electric vehicles

#270

Earlier quoted context omitted.

modern cars are unfortunately much safer

There are “modern” cars (~5-10 years old) that fit most of the modern safety standards and are effectively not transmitting things due to 3G no longer being much of a thing, coupled with automakers being glacially slow at replacing certain electronic components.

definitely
Post reply on HN