Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Volkswagen blocks Home Assistant by requiring client assertion

github.com

Post reply on HN
Print view View original

81–90 of 203 posts

Re: Volkswagen blocks Home Assistant by requiring client assertion

#81

Post by aenis »

V1ndaar wrote: post #47
aenis wrote: post #11

Garmin recently did something similar, resorting to tls fingerprinting to prevent unofficial logins to their api (via the popular garth library). They lost a lifetime customer in me - i think i have spent close to 20k on garmin gear between my wife and myself, watches, gps devices for cars, boats, and hiking gear. If they refuse to give me access to my data, i will (a) lobby for laws to be passed to make this mandato…

Huh, I completely missed that. I've been using python-garminconnect [0] for a few months without issues. I agree though that it's annoying, though not reason enough for me to switch away from Garmin yet. [0]: https://github.com/cyberjunky/python-garminconnect

Already minted tokens work, they broke the login process.

For now its just tls fingerprinting, not client attestation - so, I managed to implement a working solution. But I am sure they will tighten the screws still further.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#82

Post by ra »

vincnetas wrote: post #3

This comment has really nice translation of corpo-speek to human language : https://github.com/robinostlund/homeassistant-volkswagencarn... Why are they shooting them selves in the feet? Is this really a tangible income stream? Is it really increasing security?

wow - I was looking at moving from Tesla to Skoda for our next EV. Last month it was interceptor missiles for Israel and now this.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#83

Post by reactordev »

ornornor wrote: post #70
summm wrote: post #59

Earlier quoted context omitted.

They already add cryptographic authentication to some CAN messages, so you can't change them. It is only a matter of time until they add encryption. This is mostly a corporate problem of risk aversion in my opinion. Some department writes down a risk assessment with a list of miniscule risks, for example of some 3rd party app backend being hacked. Or just a headline "Tinkerer hacked his car to use with his home assis…

> draconian countermeasures are drafted and constructed one by one. Except when it’s about privacy or anything else we actually care about: then absolutely nothing is done because it would cost more than 0 to do anything.

On the contrary, lots are being done about it, they have to update their terms of service…

Re: Volkswagen blocks Home Assistant by requiring client assertion

#84

Post by joe_mamba »

mschuster91 wrote: post #63
joe_mamba wrote: post #29

Earlier quoted context omitted.

The question is why doesn't Germany have any young upstart auto companies when the US and China do? The question being the rhetorical kind.

Access to capital, mostly. The US has always been willing to grant hefty amounts of taxpayer money to startups, something culturally foreign to Germany (startups are risky, Germans don't want taxpayer money to be spent on risky adventures that might bring losses) and the US also has dozens of billions of dollars a month in 401k pension savings making their way into the asset markets. And China, well, it's a dictators…

>Access to capital, mostly.

German auto makers were wealthier than the US auto makers. Germany's GDP is now third in the world. There is capital.

>Germans don't want taxpayer money to be spent on risky adventures

But they wanted it to be spent on Russian gas pipelines, foreign aid, anti nuclear activism, and in the pockets of politically connected multinationals like T-systems to build another "government digitalization project" while their internet speed lacks behind developing nations?

>that might bring losses

If they hate losses, why do they keep losing? Germany decline in past 15 years seems like its a self fulfilling prophecy. The more risk averse they are to avoid change or losses, the more they keep losing to economies who embraced change, disruption and risk.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#85

Post by joe_mamba »

tormeh wrote: post #49
joe_mamba wrote: post #29

Earlier quoted context omitted.

The question is why doesn't Germany have any young upstart auto companies when the US and China do? The question being the rhetorical kind.

It's not like the US has that many either. It's not the kind of winner-takes-all network effects industry that attracts venture capital outside of the Musk reality distortion field.

>It's not like the US has that many either.

Math was never my strong point, but AFAIK the "not that many" of the US is still a greater number than the zero of Germany.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#86

Post by [deleted] »

qmarchi wrote: post #71
Retr0id wrote: post #64

Client Assertion is an OAuth feature, but that is not at all what is being discussed here, if anyone else was confused. It is only present in the HN title and is not mentioned on the page.

The apps now require the use of "Security Assertion" from the client. In this case, it's by Play Protect on Android, and whatever they use on iOS.

[deleted]

Re: Volkswagen blocks Home Assistant by requiring client assertion

#87

Post by spaqin »

verisimi wrote: post #62

Where's the 'Open Source Car'? Where's the open source phone? The open source washing machine?

We used to have them. Devices so simple anyone with a hammer could fix. Maybe not open source as we understand it today, but rather - trivially reverse engineerable, often with schematics included. Most complex would be rewiring the motor on a washing machine. Did their job fine, but you can't sell them forever, so more complex devices were introduced. Nowadays motorcycles would probably be the closest equivalent, they're often very simple to work on.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#88

Post by Retr0id »

brabel wrote: post #58
londons_explore wrote: post #34

Seems doubtful that this security will be very strong. It won't be hard to spoof an official client.

If they’ve done it using Secure Enclave it’s essentially physically impossible to spoof.

The github OP reports that browser-based login still works, so it'll likely be circumventable.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#89

Post by vincnetas »

vincnetas wrote: post #3

This comment has really nice translation of corpo-speek to human language : https://github.com/robinostlund/homeassistant-volkswagencarn... Why are they shooting them selves in the feet? Is this really a tangible income stream? Is it really increasing security?

By the way, regarding additional profit stream, to access VW data before you still needed WeConnect subscription (100€ a year), just that before you could use another app or automation to access the data. Now you MUST use exclusively WeConnect and partners to access same data even though you paying already for subscription.

Re: Volkswagen blocks Home Assistant by requiring client assertion

#90

Post by 3form »

rurban wrote: post #68
pojntfx wrote: post #5

There needs to be a law that makes remote attestation - no matter who provides the root certificates, Google/Apple/GrapheneOS - illegal. There is only one use for this technology right now, and it is to prevent people from doing what they want to do with the devices they own, while also making interoperability cryptographically impossible. This is anti-competitive and should simply be illegal.

It already is illegal in the EU under the EU Data act. The VW executives are just criminals who don't care about the law, because they can bend it like before.

How so? Do you have rights to your data in secure enclaves?
Post reply on HN