6 ms·

Let me just say this: If you need to log into your google account on a weird touch screen device(looking at you, Honda's android auto implementation), do NOT h

Let me just say this: If you need to log into your google account on a weird touch screen device(looking at you, Honda's android auto implementation), do NOT have a super long random string password with a bunch of special characters in it. It will make your life hell whenever you have to type it. Its much easier to type in 8 words separated by dashes on a touch screen.

Mathnerd314 7y ago
It's not hard to get KeepassXC to generate a medium-length alphanumeric password, which is IMO easier to tap-type than a passphrase, and it also has a passphrase generator.
jankiehodgpodge 7y ago
Like hell I'd type my Gmail password into some presumably highly insecure software like a car audio system.
- sp332 7y ago
  Yeah, this would be weird. Doesn't Android Auto just use the account that's already logged in on your phone?
  - vel0city 7y ago
    Android Auto is essentially just using your car's screen as a remote display. I don't believe any of the real processing actually happens on your car's head unit. Your data doesn't get shared with the head unit at all.
    - yjftsjthsd-h 7y ago
      > Your data doesn't get shared with the head unit at all. As it should be.
zentiggr 7y ago
Yeah, no, not doing that unless I get to security audit their code end-to-end. Have you seen the stories of auto APIs being completely unsecured, or just flat broken? No password, no.
- diminoten 7y ago
  You are paranoid. Do you inspect every plane you board? Every car you ride in? Every room you sleep in?
  - Avamander 7y ago
    The planes or cars most people ride in don't ask those details to be fair.
  - zentiggr 7y ago
    No, but I have read stories of auto APIs that are as broken as "change the user ID at the end of the request string, and you can see the entire account details of any other registered user". That sort of incompetence makes me pause and think.
    - diminoten 7y ago
      "I've read stories that people are able to take things out of cars if they're left unlocked." Okay, got it...
      - zentiggr 7y ago
        False equivalency: When the manufacturer fails to secure PII, plus location history, plus control points of the car's internals, etc etc... that's far worse, more obscured, and much more in need of public disclosure than "door's unlocked, free contents!"
        diminoten 7y ago
        It's neither far worse, nor more in need of public disclosure, at all, because it's the exact same, consequentially. Literally, even! In order to take advantage of your "exposed" PII, the adversary needs physical access to your car. Nothing false, it's actually equivalent.
dessant 7y ago
Needing to link your car to your Google account already sounds like living in hell. ;)
- farisjarrah 7y ago
  I was actually trying to hack the head unit and it made my life easier by being able to log into google drive on the onboard browser and download some files.
- sk84life 7y ago
  Yes..These Google devices scares shit out of me.. to be honest.
bdcravens 7y ago
you can create “app specific” passwords for situations like this https://support.google.com/accounts/answer/185833?hl=en https://support.google.com/accounts/answer/185833?hl=en
- pm7 7y ago
  It's designed for devices which cannot do Google's 2FA, not for normal use.

Mathnerd314 7y ago

It's not hard to get KeepassXC to generate a medium-length alphanumeric password, which is IMO easier to tap-type than a passphrase, and it also has a passphrase generator.

jankiehodgpodge 7y ago

Like hell I'd type my Gmail password into some presumably highly insecure software like a car audio system.

sp332 7y ago
Yeah, this would be weird. Doesn't Android Auto just use the account that's already logged in on your phone?
- vel0city 7y ago
  Android Auto is essentially just using your car's screen as a remote display. I don't believe any of the real processing actually happens on your car's head unit. Your data doesn't get shared with the head unit at all.
  - yjftsjthsd-h 7y ago
    > Your data doesn't get shared with the head unit at all. As it should be.

zentiggr 7y ago

Yeah, no, not doing that unless I get to security audit their code end-to-end. Have you seen the stories of auto APIs being completely unsecured, or just flat broken? No password, no.

diminoten 7y ago
You are paranoid. Do you inspect every plane you board? Every car you ride in? Every room you sleep in?
- Avamander 7y ago
  The planes or cars most people ride in don't ask those details to be fair.
- zentiggr 7y ago
  No, but I have read stories of auto APIs that are as broken as "change the user ID at the end of the request string, and you can see the entire account details of any other registered user". That sort of incompetence makes me pause and think.
  - diminoten 7y ago
    "I've read stories that people are able to take things out of cars if they're left unlocked." Okay, got it...
    - zentiggr 7y ago
      False equivalency: When the manufacturer fails to secure PII, plus location history, plus control points of the car's internals, etc etc... that's far worse, more obscured, and much more in need of public disclosure than "door's unlocked, free contents!"
      - diminoten 7y ago
        It's neither far worse, nor more in need of public disclosure, at all, because it's the exact same, consequentially. Literally, even! In order to take advantage of your "exposed" PII, the adversary needs physical access to your car. Nothing false, it's actually equivalent.

dessant 7y ago

Needing to link your car to your Google account already sounds like living in hell. ;)

farisjarrah 7y ago
I was actually trying to hack the head unit and it made my life easier by being able to log into google drive on the onboard browser and download some files.
sk84life 7y ago
Yes..These Google devices scares shit out of me.. to be honest.

bdcravens 7y ago

you can create “app specific” passwords for situations like this https://support.google.com/accounts/answer/185833?hl=en https://support.google.com/accounts/answer/185833?hl=en

pm7 7y ago
It's designed for devices which cannot do Google's 2FA, not for normal use.