7 ms·
What is your phone telling your rental car?
- taprun 10y agoMy phone isn't telling my rental car anything. I turned bluetooth off.
- nxzero 10y agoAt the very least, it's telling them you turn off Bluetooth.
- dalke 10y agoOr have a feature phone with no Bluetooth.
- skafjvhs 10y agoAre you saying the car has a mechanism to catalogue different drivers without bluetooth?
- hackuser 10y agoWifi MAC address or other identifier is one method.
- bsilvereagle 10y agoI'm not sure why you're being downvoted, some 2015 Chevys have the option for built-in wi-fi (4G LTE) making MAC tracking a legitimate concern. Granted, the rental isn't getting contacts/texts/etc like this article is talking about, but your rental could guess at the number of passengers or determine how long you spend parked outside of Starbucks based on how long it sees Starbucks wi-fi (assuming the vehicle doesn't have GPS), etc.
- fwr 10y agoI never thought about it, but it would make a lot of sense that since both Android and iOS ask for application permissions, the same would happen for a Bluetooth session. My guess is that it's not done because receivers were never supposed to handle missing data for something that shows up in device capabilities.
- nxzero 10y agoGiven this is by the a US federal agency, it's interesting to me how the US federal consumer protection agencies never look at how much data the federal, state, local, etc. governments leak on the average person; for example, federal citizen identifiers reused as consumer identifiers, that is SSN numbers.
- hackuser 10y ago> it's interesting to me how the US federal consumer protection agencies never look at how much data the federal, state, local, etc. governments leak ... And the private businesses security help, such as Google's, only talks about government and not business attackers.
- delinka 10y ago"Reuse" of SSNs is not a 'leak' of privacy by government. They're not the ones giving SSNs to whomever asks.
- mindslight 10y agoBy creating a system whereby everybody can be assumed to have a certain unique identifier, they put people in a situation where they can be made to divulge that number of various private purposes. For instance, if a drivers' license didn't have a unique number, then stores couldn't be tempted to demand said number when processing a return. It's akin to the difference between naive full disk encryption, and a true steganographic filesystem.
- nxzero 10y agoThere's zero reason that SSN per entity shouldn't be unique, official use only, expire, etc. Currently, SSN reveal detailed personal history when used by someone who knows how to read the encoding, which is public information. Beyond that, use of SSN for non-official use is illegal, but the government doesn't do enforcement.
- JadeNB 10y ago> how much data the federal, state, local, etc. governments leak on the average person; for example, federal citizen identifiers reused as consumer identifiers, that is SSN numbers. Is it really the government doing this? It seems to me that it's businesses, not the government, that insist on using SSNs as consumer identifiers. While this drives me crazy, I'm not sure that it's reasonable to pin it on the government (which, essentially by definition, is the party that is intended to use them as identifiers). EDIT: What delinka (https://news.ycombinator.com/item?id=12425976 https://news.ycombinator.com/item?id=12425976) said.
- Animats 10y agoMaybe doing charging through a data connector wasn't such a good idea after all. We need more dumb inductive charging. And no, the charger does not need a data connection.
- badwolf 10y agoYou could even just use a small USB condom, or cable adapter. There's several retail ones, all shiny and easy to use. I keep several of these in my bag http://syncstop.com http://syncstop.com
- alonmower 10y agoRandom thought: couldn't one start making charging cables that only had power/ground pins present (but were still shaped like the apple/micro usb connectors)?
- caseysoftware 10y agoYes but now you're training people to trust the "safe" cables. So the first time they get a cable the think is safe, they don't even think about it, they just plug it in and go. It's a minor annoyance not being able to sync up your own music or handle calls through the system but it's much safer. Charge off your computer or a cigarette adapter. They're always safe... as far as I know.
- labster 10y agoThe cigarette adapter is much safer than the cigarette lighter, that's for sure. Safe cables represents a much smaller attack surface than "plug into random ports" which sounds like an improvement to me.
- Animats 10y agoYes. They're called "Charge Only Hardware Firewalls", and they are way overpriced.[1] [1] https://lockedusb.com/ https://lockedusb.com/
- Hydraulix989 10y agoThey really need to have a "rental car mode" in the infotainment center that provides a good UX for not leaking user information. I've seen TVs with a "kiosk mode" option that do things like disable channel switching. My most recent rental car (a Dodge Caravan) had a USB port on the center console that mounted the phone as a USB drive for media playback.
- thaw13579 10y agoAt the very least, there should be a mode to charge via USB while disabling the data pins at the hardware level
- runeb 10y agoThis is a feature on computers (Macs at least), where on iOS you'll be prompted if you trust the device before it connects to it. If you choose "No" it will only charge. Edit: Which of course is not hardware level per se, but something similar should be possible to implement on iOS for anything it connects to. Trust this? Enable data.
- mjevans 10y agoRecent versions of Android (I think anything >=4.4) also defaults to charging only mode, and makes you pick which type of data connection you want to offer. I detest that MTP is the 'best' protocol offered for sharing the filesystem. I find it incredibly buggy and limited. (I would like to be able to use some of that filesystem for carrying around large files!)
- voltagex_ 10y agoI'm not sure how good that charging only mode is - it still presents an (empty?) MTP device to the host PC.
- sithadmin 10y agoThis is why I carry around a 'USB condom' (in particular, a PortaPow FastCharge) for use whenever I want to charge from an untrusted USB port.
- joeyrideout 10y agoThis reminds me of the privacy concerns surrounding printers/copiers, which can hold onto sensitive data after you or your organization are done using them [1]. This also begs the question of how secure these "infotainment" systems are in the first place. Physical access to individual cars' data histories is relatively limited, but if these connected machines are remotely accessible then the resulting attack surface might be scary. [1] https://www.ftc.gov/tips-advice/business-center/guidance/copier-data-security-guide-businesses https://www.ftc.gov/tips-advice/business-center/guidance/cop...
- colejohnson66 10y ago> Physical access to individual cars' data histories is relatively limited, but if these connected machines are remotely accessible then the resulting attack surface might be scary. Cars are already beginning to be connected to the internet. Just wait a few years; they'll fall victim to the IoT epidemic soon enough.
- maxerickson 10y agoYeah, the Jeep hack last year (https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig... ) got into the infotainment system over the cellular network. They've made the network side of the attack a lot harder than it used to be, the vehicles are no longer visible to anyone with a Sprint cell phone.
- zeta0134 10y agoI discovered this the first time I had to rent a car from my dealer. There were about 12 other phones connected in, and my phone would have ended up with all of their contacts if I hadn't thought to disable contact sharing. (Fortunately the Mazda UI asks before doing that.) I went through that list and un-paired every phone, and cleared out the contacts list in the entertainment center. I also informed my dealer of the issue, and I hope they are a bit more mindful of it going forward. Cars are basically designed to only ever be used by one or two people at a time, so this isn't a huge risk for most owners, but for rentals it's kind of a privacy risk.
- deleted 10y ago[deleted]
- enobrev 10y agoI generally clear everyone out in a rental as well. I should start letting the rental company know, thoug. That's a great idea. Fortunately, Android asks if you want to sync contacts, to which I always reply "No". It seems like that should be the default with an option to enable specific cars.
- oDot 10y agoA dongle[0] can be connected to the car's aux port, giving a nice wireless solution (and bypassing the phone's usually terrible amp) [0]: http://www.ebay.com/itm/Wireless-Bluetooth-V4-1-3-5mm-AUX-Audio-Stereo-Music-Home-Car-Receiver-Adapter-/281993125798 http://www.ebay.com/itm/Wireless-Bluetooth-V4-1-3-5mm-AUX-Au...
- fma 10y agoShould be more appropriately titled "What is your phone telling the next rental car driver"
- hackuser 10y ago... "and the rental car agency and everyone they share data with."
- fma 10y agoTBH I doubt the rental car agency cares. They would rather not deal with it since their business is renting cars. Any word that gets out that they even use that data without your permission is going to be very bad press. But on the other hand, for corporate espionage...if I know a certain company's employees rent cars from a certain location...I'd be poking around.
- hackuser 10y ago> They would rather not deal with it since their business is renting cars. Every company's business is collecting data on their customers. It's very widespread. > Any word that gets out that they even use that data without your permission is going to be very bad press I disagree. Word on such behavior gets out all the time and few people care.
- dogma1138 10y agoWhich is why I never sync my phone with it or use the onboard GPS. I'm honestly surprised that leasing agencies have not implemented some sort of a wipe procedure even if it's not a forensically secure wipe when a car is returned. That said I once picked up a car at the airport that had someone's passport tucked into the overhead sun protector shade thingie.
- heffer 10y agoWith 185 rental days and counting this year I had my fair share of these kinds of situations. I made fully resetting all electronic systems in the car as much as possible (which sometimes ends up being not at all) a ritual before returning cars. Some cars offer a master reset (such as Ford with their SYNC system), some don't (such as BMW's iDrive). Some cars can have their multimedia systems reset but retain some information about the paired phones and some history as fragments on their SD card (such as the Nissan Maxima, where the multimedia system also malfunctions by forgetting all settings between power cycles if no SD card is present, make sure you check before you pick one up). But in 95% of cases people don't give a damn and I would get a car that has all the previous customers' data in it. Phone logs, Navigation history, sometimes even contacts and text messages. I think it's scary.
- danepowell 10y agoWhen I pair my Android phone with a rental car via Bluetooth, the phone asks permission to share contacts and messages with the car (of course I deny them). Are folks saying that sensitive data is still shared in spite of this access control? This seems like a problem with Android / iOS rather than the car.
- greenyoda 10y ago"This seems like a problem with Android / iOS rather than the car." Or with the user who unthinkingly allows their phone to share contacts without considering the possible ramifications. Most users are accustomed to just saying "yes", like when an app asks them for permissions, etc.
- jedateach 10y agoI had a similar situation using a replacement phone whilst mine got repaired. A factory reset had been performed, but the Android OS still contained some quite sensitive WhatsApp sent images, including personal photos and even a credit card balance screenshot. Businesses need to get more savvy in this area.
- eximius 10y agoHopefully nothing since I don't connect it via anything.
- nullsocket 10y agoExactly, why would I sync my anything to something that isn't mine? That's like checking your bank account from a kiosk.. All the NOPEs.
- paulsutter 10y agoI really want a setting for the phone to block all sharing with other systems. No prompt "do you trust?", just a blanket setting that I dont want to trust any system. There's no longer any reason to tether the phone back to your Mac for backups or updates, so why is the phone so eager to share data? All of that can be accomplished with iCloud authentication.
- andrewfromx 10y agoyou humans are so funny. you think you still have privacy. that ended in 2008.
- houssc 10y agoI've been doing these security steps every single time since rentals got bluetooth. Every rental unless it's brand new has dozens of people's contacts and other data in it.
- eyelidlessness 10y agoTrying to load this page consistently crashes my Safari tab. Anyone else?
- yason 10y agoI have seen other people's trails on rental cars and I've always wondered why would they connect their phones to basically what is an unknown system, exposed to just about anyone. Maybe I'm just weird. Never had any reason to connect my phone to the car, not rental nor my own. I make phonecalls from my... well, phone, not the car. I use my phone's Google Maps if I need to refresh my memory to get driving instructions. I don't have music on my phone either. It seems that being a bit ignorant to new technology does pay off at times.