12 ms·
Totaled Teslas contain unencrypted and personally revealing data about owners
- siruncledrew 8y agoIt seems like cars should have some sort of “remote wipe” feature that is automatically triggered by the owner or insurance after a vehicle is totalled and sold/scrapped. It’s an interesting thought to get a junk car a rich person owned for cheap and then trace the location data back to their house and other places they frequently visit. It could be useful for espionage, extortion, theft, etc.
- lozaning 8y agoI like the idea of a remote wipe, but foresee issues if the part of the car required for remote connectivity gets broken in the crash too. It would be nice to have a way to physically remove the data from the car if remote connectivity is down. Some kind of FRU part in the trunk where all the user specific data for the car lives. Get in a crash and just make sure to take the "hard drive" out of the car and then you dont have to worry.
- skookumchuck 8y agoA USB thumb drive. But that would be too easy.
- rzzzt 8y agoStore it in the ignition key.
- frosted-flakes 8y agoAren't the 3 models keyless, and you have to use your phone? I seem to remember reading that a while back.
- rzzzt 8y agoNot totally: https://www.tesla.com/support/model-3-key-fob https://www.tesla.com/support/model-3-key-fob But they can also store the content on the phone, and then we have gone full circle with the idea. :)
- digitalixus 8y agoOr car markers could just stop being stubborn and greedy with their proprietary trash and just support Car Play/Android Auto. That way the car acts as a dumb terminal for displaying stuff from the phone and nothing is actually stored in the car. But no, gotta charge hundreds for in-car map updates (that only get updated as often as you purchase them) and radio/traffic subscription that mobile apps charge a fraction of and always up-to-date for as long as you keep the apps updated.
- cptskippy 8y agoI agree with you that car makers should stop trying to provide piss poor alternatives to our phones and instead acts as conduits for them and I remember things like PlaysForSure so I am much more in favor of an open standard like Bluetooth that doesn't live or die by one company.
- voltagex_ 8y agoI'm pretty sure the phonebook thing is OBEX. You probably don't want the car hitting your phone for the phonebook every time you want to make a call. IVI systems are slow enough as it is.
- cptskippy 8y agoYeah, I was reluctant to say Bluetooth because it implied that we should stick with existing protocols but that isn't exactly what I meant to say. Rather we should have some forward thinking protocol that works over multiple interfaces and is still open and platform independent like Bluetooth. Maybe even just a baseline Car Dock standard requiring Microphone, Speakers, and a Touch Display. Bluetooth is just so encumbered with legacy concepts and limitations. It hosts a myriad of protocols that don't benefit users but are easy to implement to check the Bluetooth feature checkbox. There's a full generation of Bluetooth equipped cars that only support headset or handsfree protocols but not A2DP or other useful protocols people want.
- ndnxhs 8y agoYou just listed 2 more bits of proprietary crap though.
- Spooky23 8y agoThis is a dumb story, ginned up because it’s “<bad thing> + <apple|tesla>”. This happens with any rental car or and car transaction. Also, end of the day, this data isn’t particularly sensitive. Your state DMV provides your registration and license data in real-time to third party data brokers. Cellular carriers sell geo data. Its pretty common for folks to have contact lists slurped up by third parties.
- CamperBob2 8y agoIf I were a young turk looking to get started in a life of crime, I could do worse than to get a job washing cars at a high-end dealership. Never mind the customer cars, the various telematics memories in the service loaners are always fun to surf through. When I take my car in for service, they get the address of a gas station down the street.
- alasdair_ 8y agoI bought my tesla used, directly from Tesla (for the warranty etc.) The previous owner's address and other sensitive information was still listed on the "My Tesla" pages at tesla.com when I logged in to my own account. Comically, on the car itself, the previous navigation searches were not cleared and included a nearby strip club that my wife found before I did. On my wife's X (also bought from tesla.com second-hand), she was sent a whole bunch of financial information about the previous owner, both through text messages and on the online portal. They really don't do an especially good job of securing customer information.
- riffraff 8y ago> the previous navigation searches Sure, "previous"... ;)
- cptskippy 8y agoRegarding the car itself, shouldn't some responsibility lie with the previous owner? The first thing I do before selling a phone or laptop is wipe or factory reset it. We rented a car last week that had 11 paired Bluetooth devices and like 1400 entries in the phone book. I was kind of jealous because my Leaf only allows 3 devices. I wiped it all out before returning the car.
- qball 8y ago>Regarding the car itself, shouldn't some responsibility lie with the previous owner? The first thing I do before selling a phone or laptop is wipe or factory reset it. Sure, but considering that most users don't even know how to pair a device without step-by-step instructions, I find it highly unlikely that they'll understand the implications of the car reading and storing personal information provided by their phone much less how to delete it. And given that this is Tesla we're talking about, whose products directly encourage you to have your phone paired (more than any other car of its type), even more people would be affected than they would be from, say, a Leaf (where you don't have to do that, and where it's unlikely to be as easy as it is on a Tesla).
- 8y ago
- gumby 8y agoThe way the article frames it, Tesla is vary careful about data it can monetize while is careless with PII.
- misterdoubt 8y agoIs there an alternative frame consistent with this pattern?
- gumby 8y agoThere is: the author of the article could be cherry picking the data. TTT the article is pretty convincing to me and its conclusion doesn't surprise me. But I thought rather than be immediately downvoted for criticizing T I could pose a more open-ended statement and see if anyone had a counterexample. Doesn't look like there is one.
- daferna 8y agoAccording to the same guy Tesla uploads WiFi passwords in plaintext to their servers and this database has been leaked already: https://www.reddit.com/r/teslamotors/comments/b7383h/cnbc_tesla_cars_keep_more_data_than_you_think/ejptmh3/?context=3 https://www.reddit.com/r/teslamotors/comments/b7383h/cnbc_te...
- alphabettsy 8y agoEvery modern used car on every lot in the country still has the previous owners phone book transferred via Bluetooth along with their navigation destinations and probably garage programmed too. This isn’t new or unique to Tesla.
- 0xADEADBEE 8y agoYour statement is hyperbolic but I take your point. I think we all expected a little better from Tesla though!
- ryanlol 8y agoThat is rather bizarre, did you set an encryption passphrase for your tesla at any point?
- cheerlessbog 8y agoAnd many rentals too. It's easy to hit yes transfer contacts when you pair to play music...then forget to wipe before you return it. Easy to sleuth who that person likely was based on their contacts...and their favorite strip club. Not that wipe always wipes. In my second hand BMW i3, I wiped it to delete the last owners contacts. The wipe missed one thing : the map locations it was charged at. Likely that included their home. Ideally there's a standardized wipe feature that really does it.
- threeseed 8y agoBut this is unique to Tesla: "video, location and navigational data showing exactly what happened leading up to a crash"
- Spooky23 8y agoIs that really unique? My Honda has a continuously operating camera, I would be shocked if it didn’t record a few seconds of video.
- alphabettsy 8y agoMost modern vehicles have event data recorders built-in. The video is somewhat new, but other new vehicles have built-in dash cams as well including GM vehicles like the Corvette which has had it since 2014. So also not unique to Tesla.
- yardstick 8y agoGDPR anyone? I wonder if Telsa’s European operations address any of this or (more likely) they are in the same privacy violating boat.
- raverbashing 8y agoGood question, but theoretically the user is in possession of that data (while the car is with them). Allow for the user to be able to extract the data might be mandated by it though.
- mattmanser 8y agoExtract doesn't mean wipe, it means transferrable.
- raverbashing 8y agoYes, hence the obstacles and limited data export by Tesla tools might be in violation of it.
- yardstick 8y agoI expect that a company buying a car and onselling it to a new customer has a duty of care to not expose the data of the original seller to the new buyer. So that’s the dealer’s responsibility. It sounds like Tesla itself also has some work to do given other comments in this thread indicating they could see the previous owners info on the My Tesla website.
- ryanlol 8y agoWhy is the headline about totaled Teslas and not cars in general? Nothing about this is unique to Tesla.
- netsharc 8y agoThe recorded video seems unique to Tesla, or do you know another car that does this?
- ryanlol 8y agoI guess, but I worry more about the car sucking out data from my phone than I worry about it potentially recording a video of me driving. It really feels like a minor detail compared to everything else.
- dawnerd 8y agoAny car with lane assist has a camera that presumably buffers video. Higher end luxury cars also include dash cams built in. Too many to list.
- jaimex2 8y agoNo one cares about other brands. Wouldn't get the clicks.
- stesch 8y agoA Tesla car is a data center on wheels.
- sschueller 8y agoAccording to some insiders Tesla is also able to ssh into every car on the network. I wonder how well those keys are managed and if any are shared.
- jaimex2 8y agoI'm an insider. The SSH keys are all on Google Doc, but its only shared with Elon and need to know staff.
- zaroth 8y ago> You can opt out of all data collection. But then you lose [over-the-air software updates] and a bunch of other functionality. So, understandably, nobody does that, and I also begrudgingly accepted it. Here is the relevant passage from Tesla’s owner’s manual; “Our collection of Tesla vehicle data. If you no longer wish us to collect Telematics Log Data or any other data from your Tesla vehicle, please contact us as indicated in the "How to Contact Us" section below. Please note that, if you opt out from the collection of Telematics Log Data or any other data from your Tesla vehicle, we will not be able to notify you of issues applicable to your vehicle in real time, and this may result in your vehicle suffering from reduced functionality, serious damage, or inoperability, and it may also disable many features of your vehicle including periodic software and firmware updates, remote services, and interactivity with mobile applications and in-car features such as location search, Internet radio, voice commands, and web browser functionality.” Also worth nothing that agreeing to the telematics / monitoring is part of the purchase agreement.
- bo1024 8y agoWow, this sounds especially egregious. 1. The language is not far from "this car might kill you if you don't let us collect data." 2. I can't see a technical reason that opting out of telemetry means opting out of software updates --- it just seems like a cynical disincentive. (I was already very critical of Tesla for Stallman-esque reasons, but this particularly stands out.)
- BillinghamJ 8y agoYeah... at least in the EU, that doesn't sound compatible with GDPR.
- zaroth 8y ago“Telemetry” in this case is the entire uplink functionality. You are severing the entire connection with the mothership, so of course you lose all the cloud functionality that goes with it. I actually really like that they offer the option to run the car totally dark. Of course you don’t get your GPS maps, or streaming radio, or software updates in that case. I would assume software updates could still be installed by a service tech using a direct connection if the remote uplink is severed. Obviously automatic updates are a non-starter for a system which you are not connected to. Keep in mind this opt-out is separate from the auto-pilot opt-in which lets your share short video clips and associated sensor data with Tesla to help them improve their lane tracking and feature detection algorithms.
- interfixus 8y agoCan someone knowledgeable explain to me: How offline can you run a Tesla? Is there an off button? Can you disconnect the networking entirely? Can you download updates externally, review them, and somehow manually feed them to the car? Does the owner have access - read and write - to logs and video and whatever else gets stored onboard? For that matter, what is the situation with other newer cars, electrical or of the exploding chemicals persuasion?
- jaimex2 8y agoCompletely if you want to. You can disable the mobile data and disconnect it from wifi. If you want the updates you MUST be connected somehow. You can get a copy of the videos via USB.
- interfixus 8y agoThanks. [And may I say: This is the strangest thingI have ever had downvoted. A simple question. At times I simply do not grasp the HN dynamics].
- jaimex2 8y agoOh no. Someone might get my music playlist and navigation history along with dash cam footage. This is deeply personal to me. I would die if the next owner finds out I like Roxette, drive to places and take two attempts to parallel park. What 2019 car should I buy to avoid this?
- mtmail 8y agoAnother commenter on this thread said "the previous navigation searches were not cleared and included a nearby strip club that my wife found before I did." In one previous comment you say you're an [Tesla] insider. I'd rather see data encryption being used, even for music titles and dash cam footage, then dismissed as non-issue (at every car company).
- gregoriol 8y agoAre you sure you live in 2019? Seems like you are a visitor for the 1990s
- caboteria 8y agoFunny coincidence - I went to see a talk by Rich Benoit (of Rich Rebuilds fame) just the other day. Rich used this security loophole to find the key for one of the donor cars that he used to build his franken-tesla. After he swapped the electronics from a crashed car into a water-damaged car he was able to power it up enough to get the navigation to work but couldn't drive it without a key. The previous owner's house was still listed as "Home" in the nav system so he was able to get in touch with him and get the key.
- gregoriol 8y agoThis is really problematic with totaled/stolen cars, but really not specific to Tesla as other brand cars have a significant amount of information in there too. When you sell a device, any kind of device (car but also computer, hard drive, TV, ... event flat!), you reset it or remove all your stuff. That's your responsibility. But when the car (or device) is not going out of your hands while you manage it, it's a totally different question and not a simple one. Of course on computers/phones/hard drives we have encryption now, maybe it's time for cars to have that too? linked to the finger of the driver? maybe time for something like Touch/FaceID? Otherwise it'll be fun to wander in a scrapyard in the next few years with a computer and see what you can gather... won't be for spare-parts anymore :-/
- ec109685 8y agoExactly this. All the security features apple and google have put in to their devices need to be done by car manufacturers.
- ourmandave 8y agoIt's like an old iPhone with a 4000 lb curb weight.
- deleted 8y ago[deleted]