29 ms·

A CBP contract shows the risks in connecting your vehicle and your smartphone

246 points by jbegley 6y ago

gowld 6y ago
"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." CBP's warrantless searches are plainly unconstitutional.
- mondoshawan 6y ago
  The constitution is dead, and we the people, are left holding the bag.
- WarOnPrivacy 6y ago
  Hence why land within 100mi of the border is known as the US Constitution Free Zone. ref: https://duckduckgo.com/?q=+constitution+free+zone https://duckduckgo.com/?q=+constitution+free+zone
  - heavyset_go 6y ago
    Which also contains areas within 100 miles of the coasts, international airports, and other "ports of entry".
- toss1 6y ago
  Probably true, but good luck with that. As my grandfather said: "You might be right, but you don't want to be dead right." CBP already have extra authorities due to border control because crossing the border is not a constitutional right. The most egregious expansion was the declaration that all territory within 100 miles of the border is 'authorized' for all CBP's nonsense. That happens to cover about 90% of the US population. There is a lot of anguish about the intelligence agencies doing their jobs against very serious threats, including Nuclear, Biological, Chemical. Meanwhile the real damage to civil liberties is from the CBP and INS, who literally storm homes every day, and engage in this kind of 4th amendment trashing.
  - mssundaram 6y ago
    I'm having trouble understanding how 100 miles from the border covers 90% of the US population? Edit: I see - I was thinking only in terms of e.g. the Arizona southern border, however looking up the Constitution Free Zone shows that it means the entire US - California, all states connected to Cananda etc. Eidt 2: Would this mean ALL of Hawaii is in this Constitution Free Zone?
    - triceratops 6y ago
      Don't international airports count as "the border" too?
      - heavyset_go 6y ago
        Yes, they're considered "ports of entry".
    - toss1 6y ago
      Hawaii? yup, I'd expect that is a solid YES. I'm curious how much and how long it takes for this to drive migrants inland away from the border... and then how long it will take for them to make an excuse to make it 200mi...
    - quickthrowman 6y ago
      It is all of the US land, sea, and lake (Great Lakes) borders.
    - heavyset_go 6y ago
      > Eidt 2: Would this mean ALL of Hawaii is in this Constitution Free Zone? And the entirety of a handful of states in the Northeast US, as well.
  - rsync 6y ago
    " ... because crossing the border is not a constitutional right." Yes, it is. "In Nguyen v. INS (2001), on a separate matter of citizenship, the Supreme Court put down, in writing, that citizens of the US have the absolute right to enter its borders. It was in recent times more or less presumed to be the case, though historically there have been a wide range of decisions that did deny entry by citizens, mainly by denying the underlying citizenship. This right extends to lawful permanent residents, so long as they maintain their status."[1] [1] https://www.quora.com/Can-a-U-S-citizen-be-denied-entry-into-the-United-States https://www.quora.com/Can-a-U-S-citizen-be-denied-entry-into...
- cronix 6y ago
  NSA has been illegally spying on US citizens for 20+ years, in direct violation of the constitution. https://arstechnica.com/tech-policy/2020/09/nsa-spying-exposed-by-snowden-was-illegal-and-not-very-useful-court-says/ https://arstechnica.com/tech-policy/2020/09/nsa-spying-expos... President Obama signed off on a drone strike on foreign soil targeting and killing a US citizen, in direct violation of the constitution depriving a citizen of a fair trial. https://en.wikipedia.org/wiki/Anwar_al-Awlaki https://en.wikipedia.org/wiki/Anwar_al-Awlaki We didn't collectively do anything about it then, except cheer it on or say nothing, so it will continue and expand until, and if, we do.
  - klyrs 6y ago
    A few months later, Obama codified indefinite detention without trial. Some of us sounded the alarm, but it seems that politicians are still drunk on power post-9/11 and neither party is interested in the "rule of law" as set out by the constitution. https://www.aclu.org/issues/national-security/detention/indefinite-detention-endless-worldwide-war-and-2012-national https://www.aclu.org/issues/national-security/detention/inde...
neither_color 6y ago
Looks like I'm switching back to AUX. I had no idea cars were scooping up this much data. I wish the article went into more detail about what the attack vector is, what permissions, if any can mitigate this, etc but I understand that's not the point of this piece.
- salawat 6y ago
  If it has a USB port, it can get data. If you have Android auto or native iOS integration, same story. People need to understand, despite the efforts of sticks in the mud like me, industry should be considered malicious by default. If you don't pay attention to what people are doing and call it out, nobody even raises a finger. Those that do are ignored, or told there's a place for people like them with a condescending smirk.
  - soco 6y ago
    Via USB you can still use a USB blocker, but if you connect via Bluetooth, nothing can protect you, correct?
    - philsnow 6y ago
      see https://news.ycombinator.com/item?id=27041032 https://news.ycombinator.com/item?id=27041032 , maybe this isn't universal but in all the cars I've paired my phone to, you can choose both on the phone and on the car whether you want contacts to sync. I don't trust the car to get it right, but I do trust apple to get it right.
    - StavrosK 6y ago
      You have to explicitly allow contact/phone/sms sharing on the phone when you pair it.
IshKebab 6y ago
Is there any surprising data? I'm not surprised it records destinations entered into satnav for example. I mean that's a fairly common trick in TV shows. > MSAB claims that this data can include “Recent destinations, favorite locations, call logs, contact lists, SMS messages, emails, pictures, videos, social media feeds, and the navigation history of everywhere the vehicle has been.” MSAB even touts the ability to retrieve deleted data, divine “future plan[s],” and “Identify known associates and establish communication patterns between them.” I seriously doubt my car has records of my emails, pictures, videos, and social media feeds even though it has Android Auto.
- pessimizer 6y ago
  > I seriously doubt my car has records of my emails, pictures, videos, and social media feeds even though it has Android Auto. Why?
  - IshKebab 5y ago
    Because I didn't give it access to any of that and Android Auto runs on the phone, not on the car. The car essentially becomes a glorified touchscreen.
- salawat 6y ago
  Have you checked? Look up https://cccis.com/ https://cccis.com/ Mobile/automotive networking has been a big thing for a while now, and there is no dearth of software people who will predate on most people's expectations that software only does what the UI makes apparent to them. Even if they don't realize they are contributing to it because they've been hired to do a job, but don't take the time to grok the consequences of the business model. Never assume. Trust, but verify.
- indymike 6y ago
  > I seriously doubt my car has records of my emails, pictures, videos, and social media feeds even though it has Android Auto. Even if you car does not, your phone does. So the phone being connected to the car during the time when the accident occurred, could lead to checking that you were in fact, watching unboxing videos on Netflix at the moment the wreck occurred while you were in the driver's seat.
novok 6y ago
One day, I hope radios / networking off, telemetry off and logs off and still as functional as possible with those options off will all be legally mandatory options in any device that can do any of those things.
- salawat 6y ago
  You better fight for it. Otherwise industry is likely to lobby those become mandatory to prevent competition from heopardizing potential revenue streams by couching them as public safety and sustainibility features.
- velosol 6y ago
  I remember reading about being able to pull a fuse to disable cellular connectivity on Teslas a few years back and you could also opt-out of data collection but it was apparently an involved process over email. Has anyone been through going 'radio silent' in a Tesla more recently?
a_e_k 6y ago
I live in Washington State, where the state legislature recently voted to ban sales of gasoline powered cars after 2030. Aside from the fact that I enjoy drives through some pretty empty parts of the country, especially in the Southwest, where range is a concern (e.g., I drove the Great Basin Highway a few years ago), what bothers me about that measure is this sort of data collection thing. I wouldn't mind a move to all-electric vehicles nearly so much if it were possible to get a "dumb" electric and the range was better.
- grecy 6y ago
  Think about how much the iPhone improved over 9 years of sales from the original in 2007 to whatever model they had in 2016. Given how many manufacturers are jumping on the electric bandwagon, the extremely fast decline in the cost of batteries, the rate of progress to date AND these kinds of laws to give some good motivation, I think it's very safe to say the electric vehicles on sale 9 years from now (2030) will be vastly superior to today's offerings.
  - pgrote 6y ago
    >on sale 9 years from now (2030) will be vastly superior to today's offerings I hope you are right. Discounting the environmental and societal impact of mining the materials needed for these advancements and the electrical generation, my concern is selfish. We drive for vacations and sometimes push 12 hours a day. A quick fill up of gas in the minivan seems better than an hour or two of charging. Others have mentioned hybirds alleviate the long distance concern. There are minivan and larger vehicles already using hybird technology, so it should work out. It is such a wild change to think about.
    - Forbo 6y ago
      The environmental and societal impact of EVs are largely localized. The impacts of internal combustion engines have been almost entirely externalized. While EVs will still have some negative impacts, it's a huge improvement over the status quo.
  - 6y ago
Animats 6y ago
“Your phone died, you’re gonna get in the car, plug it in, and there’s going to be this nice convenient USB port for you. When you plug it into this USB port, it’s going to charge your phone, absolutely. And as soon as it powers up, it’s going to start sucking all your data down into the car.” That used to be just something seen in hostile devices. Now it's standard equipment.
- maze-le 6y ago
  I'd still call it hostile though...
- LinuxBender 6y ago
  You can get a USB Condom [1] for this purpose. [1] - https://www.amazon.com/PortaPow-3rd-Gen-Data-Blocker/dp/B06XGM6LJB https://www.amazon.com/PortaPow-3rd-Gen-Data-Blocker/dp/B06X...
  - soco 6y ago
    Thank you, I just bought two! But any idea for if you're connected via Bluetooth?
    - LinuxBender 6y ago
      Probably not without controlling one side of the communication. On the cell phone, you would need something that enforces mandatory access controls on what data can be sent over Bluetooth. Ideally a smart phone hacker could chime in. I've never owned one. Another potential option would be to root the car, likely voiding any warranty and potentially creating other liability implications.
      - sagarm 6y ago
        You have to ok sharing contacts with "normal" bluetooth pairing. For a personal vehicle most people would.
    - throwawayboise 6y ago
1024core 6y ago
From the marketing material: iVe currently supports AUDI, BMW, Buick, Cadillac, Chevrolet, Chrysler, Dodge, FIAT, Ford, GMC, HUMMER, Hyundai/Kia, INFINITI, Jeep, Lincoln, Mercedes-Benz, Maserati, Mercury, Nissan, Pontiac, Ram, Saturn, SEAT, Skoda, SRT, Toyota and Volkswagen Now you know which brands to avoid!
- kgwxd 6y ago
  So that leaves Hot Wheels.
  - 1024core 6y ago
    Honda, Subaru, Tesla too.
    - twobitshifter 6y ago
      Tesla may not work with this tool but they’re definitely beaming data home all the time. If your privacy Conscious I wouldn’t think Tesla spoiled be on your list.
      - brokenmachine 5y ago
        Also if your Tesla crashes itself, Tesla will release only enough data to tarnish you, even if you weren't actually driving.
    - quickthrowman 6y ago
      Don’t forget Mazda!
    - SyzygistSix 5y ago
      Volvo is not on the list. Yet.
- soco 6y ago
  Any one left out of that list? Should I assume if I see one PSA-owned brand (for example), all PSA will be under contract and just not named because the list was too big? I'm just confused...
wolverine876 6y ago
Is there a reliable list of cars that do not surveil me, or that can be modified to not surveil me? I read a Bruce Schneier article a little while ago (maybe the article was much older) where he said that he looked, but didn't find one that met his other needs.
- marcod 6y ago
  https://ondatashop.com/ive-vehicle-system-forensics/ https://ondatashop.com/ive-vehicle-system-forensics/ says "iVe currently supports BMW, Buick, Cadillac, Chevrolet, Chrysler, Dodge, Fiat, Ford, GMC Hummer, Jeep, Lincoln, Maserati, Mercury, Pontiac, Ram, Saturn, Seat, Skoda, SRT, Toyota and Volkswagen vehicles generally as far back as 2008 models" - so older might be better :)
  - harikb 6y ago
    Used cars are already selling like hot cakes! now this!
    - crocodiletears 5y ago
      Admin's talking about bringing back cash for clunkers. Just strap yourself into the matrix so your social credit score doesn't flag you for resisting.
  - SyzygistSix 5y ago
    Interesting that I don't see Tesla on the list.
- mywittyname 6y ago
  Unlikely. Based on the article, it sounds like the data they are "vacuuming" up is telemetry data captured and stored by the car itself. Every manufacture is different, but they all are storing at least some information. I suspect there are regulatory requirements to keep such information for the purposes of public safety (see: analysis of Toyota unintended acceleration situations) This information has been captured, stored, and made available for analysis since at least the early 00s. I remember the first time I hooked up VAGCOM to my 03 VW, it has data from so many sensors available for the tech to look up and could turn on and off hundreds of different features, it was like going into the VW equivalent of chrome://flags. And this was in a 2003 car! You'd probably have to go back to pre-ODBII days (mandated in 1996 for the US) to really get away from this. In my experience (which is not comprehensive) 90s cars tended to keep telemetry mostly on engine performance (timing advance, cam/crank sensor positions, throttle position, etc).
deleted 6y ago
[deleted]
thinkling 6y ago
How do CarPlay and Android Auto integrate with the car's entertainment system? My sense is that CarPlay mostly treats the car as an external display (and input device) and I would hope that Apple has thought about the amount of data that is exposed.
jmnicolas 6y ago
So do I have to ride horses to get my privacy back now? I would totally buy a brand new car without all the "visible" electronics (by visible I mean all the screens and doodads. I don't mind ABS and other "invisible" electronics as long as they are reliable which is not a given nowadays). I don't get the point of turning the interior of a car into a smartphone experience. I watched a YT video of a Mercedess class S review. So many screens, leds, buttons etc. The reviewer was so busy fiddling with the controls that he never saw a pedestrian woman wanting to cross the road. If she hadn't payed attention he would probably have hit her.
- Loughla 6y ago
  Honestly, non-tactile buttons on a car seems ridiculous. You HAVE to look away from the road to do anything. Tactile buttons let you feel around to do things if you need to. That change has made zero sense to me.
  - virtue3 6y ago
    Especially with the shit microcontrollers they put into the toyota mid range cars and their lack of responsiveness. Really forces you to look at the screen when you fidget with it.
    - kevin_thibedeau 5y ago
      Those shit micros in the infotainment system are still running at least in the hundreds of MHz. PCs from 25 years ago with equivalent performance were responsive. It's poor software development practices that makes good enough hardware crawl at a snail's pace.
  - Silhouette 5y ago
    It's also scary just how many controls there are now, tactile or otherwise, that have little to do with safely driving the car and navigating efficiently to your destination. Until we have truly autonomous vehicles, all those distractions are accidents waiting to happen (or sometimes, sadly, not waiting). Touch controls for anything a driver needs to manipulate while driving are obviously ridiculous, so there's not much else to say there. But given how dangerous using a phone while driving is under most circumstances, what on earth are phone-related controls doing taking up prime real estate on a steering wheel in so many modern vehicles, even if they're tactile? Either way, it's like the car makers said "OK, we get that using these features while driving is about as dangerous as driving while you're drunk, but the kind of person who will buy our premium vehicles is going to be grossly irresponsible anyway, so they might as well have an easy time doing it." And then after distracting the driver's attention and giving them lots to look at other than what they actually need for driving, they act all surprised that the driver who was "required to be fully aware and able to take over control of the vehicle immediately at any time" was messing around with the infotainment system with lane keeping, cruise control and automatic distance keeping turned on instead of watching the road, and point to the legal small print when the inevitable tragedy happens because of course the driver was not actually able to take over immediately when something unexpected happened. This whole issue makes my blood boil. It's like the worst example of prioritising flash and gimmicks at the expense of making something that actually works properly, and in a context where safety is a huge factor and people are literally dying unnecessarily every day. These kinds of idiocy should have been regulated out of existence the day after they were announced.
yardie 6y ago
One of the cars I rented (A Ford using the Sync console) had bluetooth contacts synced from the previous renter. It was just sitting there: names, phone numbers, addresses, email addresses. Being privacy conscious I deleted the contacts and the 20+ bluetooth profiles stored in the console.
- ocdtrekkie 6y ago
  I am always shocked when people make these sorts of pairings with devices they don't even own. I often see employees pairing person phones with corporate fleet vehicles too. It's unfortunately an example of where people rank convenience over privacy almost every single time.
  - spookthesunset 6y ago
    I mean, most people wouldn’t suspect all their contacts would get copied over to the rental car. Before CarPlay I’d routinely “just hit okay” my way though pairing my phone to the rental car.
    - FreakyT 6y ago
      Agreed, this seems more like a UX problem than a "people don't value privacy" problem. No reasonable person would ever expect that connecting your phone to a car's wireless audio system would transfer all your contacts -- but that's Bluetooth for you!
      - calvano915 6y ago
        Every phone I've ever had on every car system I've ever paired to via Bluetooth has requested permission for contact sync before it would happen. Windows Phone and Android. Perhaps iOS works differently.
        yardie 6y ago
        It's the same for iOS. But, I'm also guilty, most users configure their bluetooth while leaving the parking lot. If you're reading the request you aren't looking at the road, and vice versa. I've been quick to press OK before fully reading what the car is asking simply because the car and the phone are asking similar questions.
swader999 6y ago
Slightly off this topic. What amazes me is that our phones are surely capable of knowing when we are driving but they still allow texting. Seems like an easy win for safety yet crickets is all we get here.
- eikenberry 6y ago
  How would they know we are driving and not a passenger?
  - swader999 5y ago
    GPS, accelerometer, AI. It can't be impossible.
    - frankydp 5y ago
      More importantly who cares, a couple 10k dead people a year is probably worth a tiny bit of inconvenient, not to mention the 500B in insurance waste.
      - swader999 5y ago
        Bring back drunk driving too while your at it! Fail.
RyJones 6y ago
I included a sample of what Honda[0] records when you pay for Honda Navigation System. It spams your VIN every minute it’s on WiFi, though, regardless of trim level. [0]: https://gist.github.com/ryjones/73739f6a7e662b9ed9ba64d9141ffcc9 https://gist.github.com/ryjones/73739f6a7e662b9ed9ba64d9141f...
- brokenmachine 5y ago
  Wow, that's a fair bit of data to send home for a "feature" that you don't even have. "TripDate": "", "FuelUsed": "", "StartPos": { "Lat": "", "ODO": "", "Time": "", "Lon": "", "Datum": "" , and some scoring on your driving style. This should be illegal.
dimmke 6y ago
This is one of the many reasons that adding screens to cars has been such a failure. All these carmakers were deluded and couldn’t even build custom systems that were pleasant to use, much less secure. The problem is only partially solved by CarPlay.
gkfasdfasdf 6y ago
And yet, hitting 'next track' on the bluetooth audio still takes 1-2 seconds to register?
_Microft 6y ago
I wonder if there are ways to ... improve the aesthetics of the files in the infotainment system.
fencepost 5y ago
"I do not consent to any searches." You can't prevent them, but don't consent to a search just because you don't do drugs, transport drugs, transport anyone who does drugs. Carrying cash is considered a valid pretext for a search (have any coins in a change tray?), as is being too polite or not being polite enough (maybe because you're annoyed at being stopped). Now that a search of your vehicle also includes a search of any information it's received from any connected devices as well as a history of your locations and speeds you need to make sure you preserve any and all possible avenues to challenge anything found. "Your honor, we didn't find any drugs but during the search he consented to we found evidence that he was driving far in excess of the posted speed limits on these 20 occasions so we're charging him with 20 counts of reckless driving. He confirmed to us during the initial stop that he is the only driver of the vehicle. He was also carrying cash so we're moving to seize those funds and the vehicle." Who, what, when, where and how fast, all neatly tied into one package.
- ojbyrne 5y ago
  “US Customs and Border Patrol” https://www.aclu.org/other/constitution-100-mile-border-zone https://www.aclu.org/other/constitution-100-mile-border-zone
  - fencepost 5y ago
    What are the odds that this remains within the CBP? If police departments decide they can suck all this data from a car without a warrant on a pretext search of a vehicle so you think they won't at least try?
snapetom 5y ago
Interesting this is paid software. Given automakers sad security practices, I wonder how hard it is for some hacker to make a kit using off the shelf products and release the software open source.
- SyzygistSix 5y ago
  It'd be a shame if a Berla kit happened to fall off the back of a truck.
34679 5y ago
It amazes me that people load all their contacts into the infotainment system of rental vehicles, let alone ones they own. Some individuals have no concept of or desire for privacy.

246 points by jbegley 6y ago

"The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized." CBP's warrantless searches are plainly unconstitutional.

mondoshawan 6y ago
The constitution is dead, and we the people, are left holding the bag.
WarOnPrivacy 6y ago
Hence why land within 100mi of the border is known as the US Constitution Free Zone. ref: https://duckduckgo.com/?q=+constitution+free+zone https://duckduckgo.com/?q=+constitution+free+zone
- heavyset_go 6y ago
  Which also contains areas within 100 miles of the coasts, international airports, and other "ports of entry".
toss1 6y ago
Probably true, but good luck with that. As my grandfather said: "You might be right, but you don't want to be dead right." CBP already have extra authorities due to border control because crossing the border is not a constitutional right. The most egregious expansion was the declaration that all territory within 100 miles of the border is 'authorized' for all CBP's nonsense. That happens to cover about 90% of the US population. There is a lot of anguish about the intelligence agencies doing their jobs against very serious threats, including Nuclear, Biological, Chemical. Meanwhile the real damage to civil liberties is from the CBP and INS, who literally storm homes every day, and engage in this kind of 4th amendment trashing.
- mssundaram 6y ago
  I'm having trouble understanding how 100 miles from the border covers 90% of the US population? Edit: I see - I was thinking only in terms of e.g. the Arizona southern border, however looking up the Constitution Free Zone shows that it means the entire US - California, all states connected to Cananda etc. Eidt 2: Would this mean ALL of Hawaii is in this Constitution Free Zone?
  - triceratops 6y ago
    Don't international airports count as "the border" too?
    - heavyset_go 6y ago
      Yes, they're considered "ports of entry".
  - toss1 6y ago
    Hawaii? yup, I'd expect that is a solid YES. I'm curious how much and how long it takes for this to drive migrants inland away from the border... and then how long it will take for them to make an excuse to make it 200mi...
  - quickthrowman 6y ago
    It is all of the US land, sea, and lake (Great Lakes) borders.
  - heavyset_go 6y ago
    > Eidt 2: Would this mean ALL of Hawaii is in this Constitution Free Zone? And the entirety of a handful of states in the Northeast US, as well.
- rsync 6y ago
  " ... because crossing the border is not a constitutional right." Yes, it is. "In Nguyen v. INS (2001), on a separate matter of citizenship, the Supreme Court put down, in writing, that citizens of the US have the absolute right to enter its borders. It was in recent times more or less presumed to be the case, though historically there have been a wide range of decisions that did deny entry by citizens, mainly by denying the underlying citizenship. This right extends to lawful permanent residents, so long as they maintain their status."[1] [1] https://www.quora.com/Can-a-U-S-citizen-be-denied-entry-into-the-United-States https://www.quora.com/Can-a-U-S-citizen-be-denied-entry-into...
cronix 6y ago
NSA has been illegally spying on US citizens for 20+ years, in direct violation of the constitution. https://arstechnica.com/tech-policy/2020/09/nsa-spying-exposed-by-snowden-was-illegal-and-not-very-useful-court-says/ https://arstechnica.com/tech-policy/2020/09/nsa-spying-expos... President Obama signed off on a drone strike on foreign soil targeting and killing a US citizen, in direct violation of the constitution depriving a citizen of a fair trial. https://en.wikipedia.org/wiki/Anwar_al-Awlaki https://en.wikipedia.org/wiki/Anwar_al-Awlaki We didn't collectively do anything about it then, except cheer it on or say nothing, so it will continue and expand until, and if, we do.
- klyrs 6y ago
  A few months later, Obama codified indefinite detention without trial. Some of us sounded the alarm, but it seems that politicians are still drunk on power post-9/11 and neither party is interested in the "rule of law" as set out by the constitution. https://www.aclu.org/issues/national-security/detention/indefinite-detention-endless-worldwide-war-and-2012-national https://www.aclu.org/issues/national-security/detention/inde...

neither_color 6y ago

Looks like I'm switching back to AUX. I had no idea cars were scooping up this much data. I wish the article went into more detail about what the attack vector is, what permissions, if any can mitigate this, etc but I understand that's not the point of this piece.

salawat 6y ago
If it has a USB port, it can get data. If you have Android auto or native iOS integration, same story. People need to understand, despite the efforts of sticks in the mud like me, industry should be considered malicious by default. If you don't pay attention to what people are doing and call it out, nobody even raises a finger. Those that do are ignored, or told there's a place for people like them with a condescending smirk.
- soco 6y ago
  Via USB you can still use a USB blocker, but if you connect via Bluetooth, nothing can protect you, correct?
  - philsnow 6y ago
    see https://news.ycombinator.com/item?id=27041032 https://news.ycombinator.com/item?id=27041032 , maybe this isn't universal but in all the cars I've paired my phone to, you can choose both on the phone and on the car whether you want contacts to sync. I don't trust the car to get it right, but I do trust apple to get it right.
  - StavrosK 6y ago
    You have to explicitly allow contact/phone/sms sharing on the phone when you pair it.

IshKebab 6y ago

Is there any surprising data? I'm not surprised it records destinations entered into satnav for example. I mean that's a fairly common trick in TV shows. > MSAB claims that this data can include “Recent destinations, favorite locations, call logs, contact lists, SMS messages, emails, pictures, videos, social media feeds, and the navigation history of everywhere the vehicle has been.” MSAB even touts the ability to retrieve deleted data, divine “future plan[s],” and “Identify known associates and establish communication patterns between them.” I seriously doubt my car has records of my emails, pictures, videos, and social media feeds even though it has Android Auto.

pessimizer 6y ago
> I seriously doubt my car has records of my emails, pictures, videos, and social media feeds even though it has Android Auto. Why?
- IshKebab 5y ago
  Because I didn't give it access to any of that and Android Auto runs on the phone, not on the car. The car essentially becomes a glorified touchscreen.
salawat 6y ago
Have you checked? Look up https://cccis.com/ https://cccis.com/ Mobile/automotive networking has been a big thing for a while now, and there is no dearth of software people who will predate on most people's expectations that software only does what the UI makes apparent to them. Even if they don't realize they are contributing to it because they've been hired to do a job, but don't take the time to grok the consequences of the business model. Never assume. Trust, but verify.
indymike 6y ago
> I seriously doubt my car has records of my emails, pictures, videos, and social media feeds even though it has Android Auto. Even if you car does not, your phone does. So the phone being connected to the car during the time when the accident occurred, could lead to checking that you were in fact, watching unboxing videos on Netflix at the moment the wreck occurred while you were in the driver's seat.

novok 6y ago

One day, I hope radios / networking off, telemetry off and logs off and still as functional as possible with those options off will all be legally mandatory options in any device that can do any of those things.

salawat 6y ago
You better fight for it. Otherwise industry is likely to lobby those become mandatory to prevent competition from heopardizing potential revenue streams by couching them as public safety and sustainibility features.
velosol 6y ago
I remember reading about being able to pull a fuse to disable cellular connectivity on Teslas a few years back and you could also opt-out of data collection but it was apparently an involved process over email. Has anyone been through going 'radio silent' in a Tesla more recently?

a_e_k 6y ago

I live in Washington State, where the state legislature recently voted to ban sales of gasoline powered cars after 2030. Aside from the fact that I enjoy drives through some pretty empty parts of the country, especially in the Southwest, where range is a concern (e.g., I drove the Great Basin Highway a few years ago), what bothers me about that measure is this sort of data collection thing. I wouldn't mind a move to all-electric vehicles nearly so much if it were possible to get a "dumb" electric and the range was better.

grecy 6y ago
Think about how much the iPhone improved over 9 years of sales from the original in 2007 to whatever model they had in 2016. Given how many manufacturers are jumping on the electric bandwagon, the extremely fast decline in the cost of batteries, the rate of progress to date AND these kinds of laws to give some good motivation, I think it's very safe to say the electric vehicles on sale 9 years from now (2030) will be vastly superior to today's offerings.
- pgrote 6y ago
  >on sale 9 years from now (2030) will be vastly superior to today's offerings I hope you are right. Discounting the environmental and societal impact of mining the materials needed for these advancements and the electrical generation, my concern is selfish. We drive for vacations and sometimes push 12 hours a day. A quick fill up of gas in the minivan seems better than an hour or two of charging. Others have mentioned hybirds alleviate the long distance concern. There are minivan and larger vehicles already using hybird technology, so it should work out. It is such a wild change to think about.
  - Forbo 6y ago
    The environmental and societal impact of EVs are largely localized. The impacts of internal combustion engines have been almost entirely externalized. While EVs will still have some negative impacts, it's a huge improvement over the status quo.
- 6y ago

Animats 6y ago

“Your phone died, you’re gonna get in the car, plug it in, and there’s going to be this nice convenient USB port for you. When you plug it into this USB port, it’s going to charge your phone, absolutely. And as soon as it powers up, it’s going to start sucking all your data down into the car.” That used to be just something seen in hostile devices. Now it's standard equipment.

maze-le 6y ago
I'd still call it hostile though...
LinuxBender 6y ago
You can get a USB Condom [1] for this purpose. [1] - https://www.amazon.com/PortaPow-3rd-Gen-Data-Blocker/dp/B06XGM6LJB https://www.amazon.com/PortaPow-3rd-Gen-Data-Blocker/dp/B06X...
- soco 6y ago
  Thank you, I just bought two! But any idea for if you're connected via Bluetooth?
  - LinuxBender 6y ago
    Probably not without controlling one side of the communication. On the cell phone, you would need something that enforces mandatory access controls on what data can be sent over Bluetooth. Ideally a smart phone hacker could chime in. I've never owned one. Another potential option would be to root the car, likely voiding any warranty and potentially creating other liability implications.
    - sagarm 6y ago
      You have to ok sharing contacts with "normal" bluetooth pairing. For a personal vehicle most people would.
  - throwawayboise 6y ago

1024core 6y ago

From the marketing material: iVe currently supports AUDI, BMW, Buick, Cadillac, Chevrolet, Chrysler, Dodge, FIAT, Ford, GMC, HUMMER, Hyundai/Kia, INFINITI, Jeep, Lincoln, Mercedes-Benz, Maserati, Mercury, Nissan, Pontiac, Ram, Saturn, SEAT, Skoda, SRT, Toyota and Volkswagen Now you know which brands to avoid!

kgwxd 6y ago
So that leaves Hot Wheels.
- 1024core 6y ago
  Honda, Subaru, Tesla too.
  - twobitshifter 6y ago
    Tesla may not work with this tool but they’re definitely beaming data home all the time. If your privacy Conscious I wouldn’t think Tesla spoiled be on your list.
    - brokenmachine 5y ago
      Also if your Tesla crashes itself, Tesla will release only enough data to tarnish you, even if you weren't actually driving.
  - quickthrowman 6y ago
    Don’t forget Mazda!
  - SyzygistSix 5y ago
    Volvo is not on the list. Yet.
soco 6y ago
Any one left out of that list? Should I assume if I see one PSA-owned brand (for example), all PSA will be under contract and just not named because the list was too big? I'm just confused...

wolverine876 6y ago

Is there a reliable list of cars that do not surveil me, or that can be modified to not surveil me? I read a Bruce Schneier article a little while ago (maybe the article was much older) where he said that he looked, but didn't find one that met his other needs.

marcod 6y ago
https://ondatashop.com/ive-vehicle-system-forensics/ https://ondatashop.com/ive-vehicle-system-forensics/ says "iVe currently supports BMW, Buick, Cadillac, Chevrolet, Chrysler, Dodge, Fiat, Ford, GMC Hummer, Jeep, Lincoln, Maserati, Mercury, Pontiac, Ram, Saturn, Seat, Skoda, SRT, Toyota and Volkswagen vehicles generally as far back as 2008 models" - so older might be better :)
- harikb 6y ago
  Used cars are already selling like hot cakes! now this!
  - crocodiletears 5y ago
    Admin's talking about bringing back cash for clunkers. Just strap yourself into the matrix so your social credit score doesn't flag you for resisting.
- SyzygistSix 5y ago
  Interesting that I don't see Tesla on the list.
mywittyname 6y ago
Unlikely. Based on the article, it sounds like the data they are "vacuuming" up is telemetry data captured and stored by the car itself. Every manufacture is different, but they all are storing at least some information. I suspect there are regulatory requirements to keep such information for the purposes of public safety (see: analysis of Toyota unintended acceleration situations) This information has been captured, stored, and made available for analysis since at least the early 00s. I remember the first time I hooked up VAGCOM to my 03 VW, it has data from so many sensors available for the tech to look up and could turn on and off hundreds of different features, it was like going into the VW equivalent of chrome://flags. And this was in a 2003 car! You'd probably have to go back to pre-ODBII days (mandated in 1996 for the US) to really get away from this. In my experience (which is not comprehensive) 90s cars tended to keep telemetry mostly on engine performance (timing advance, cam/crank sensor positions, throttle position, etc).

deleted 6y ago

[deleted]

thinkling 6y ago

How do CarPlay and Android Auto integrate with the car's entertainment system? My sense is that CarPlay mostly treats the car as an external display (and input device) and I would hope that Apple has thought about the amount of data that is exposed.

jmnicolas 6y ago

So do I have to ride horses to get my privacy back now? I would totally buy a brand new car without all the "visible" electronics (by visible I mean all the screens and doodads. I don't mind ABS and other "invisible" electronics as long as they are reliable which is not a given nowadays). I don't get the point of turning the interior of a car into a smartphone experience. I watched a YT video of a Mercedess class S review. So many screens, leds, buttons etc. The reviewer was so busy fiddling with the controls that he never saw a pedestrian woman wanting to cross the road. If she hadn't payed attention he would probably have hit her.

Loughla 6y ago
Honestly, non-tactile buttons on a car seems ridiculous. You HAVE to look away from the road to do anything. Tactile buttons let you feel around to do things if you need to. That change has made zero sense to me.
- virtue3 6y ago
  Especially with the shit microcontrollers they put into the toyota mid range cars and their lack of responsiveness. Really forces you to look at the screen when you fidget with it.
  - kevin_thibedeau 5y ago
    Those shit micros in the infotainment system are still running at least in the hundreds of MHz. PCs from 25 years ago with equivalent performance were responsive. It's poor software development practices that makes good enough hardware crawl at a snail's pace.
- Silhouette 5y ago
  It's also scary just how many controls there are now, tactile or otherwise, that have little to do with safely driving the car and navigating efficiently to your destination. Until we have truly autonomous vehicles, all those distractions are accidents waiting to happen (or sometimes, sadly, not waiting). Touch controls for anything a driver needs to manipulate while driving are obviously ridiculous, so there's not much else to say there. But given how dangerous using a phone while driving is under most circumstances, what on earth are phone-related controls doing taking up prime real estate on a steering wheel in so many modern vehicles, even if they're tactile? Either way, it's like the car makers said "OK, we get that using these features while driving is about as dangerous as driving while you're drunk, but the kind of person who will buy our premium vehicles is going to be grossly irresponsible anyway, so they might as well have an easy time doing it." And then after distracting the driver's attention and giving them lots to look at other than what they actually need for driving, they act all surprised that the driver who was "required to be fully aware and able to take over control of the vehicle immediately at any time" was messing around with the infotainment system with lane keeping, cruise control and automatic distance keeping turned on instead of watching the road, and point to the legal small print when the inevitable tragedy happens because of course the driver was not actually able to take over immediately when something unexpected happened. This whole issue makes my blood boil. It's like the worst example of prioritising flash and gimmicks at the expense of making something that actually works properly, and in a context where safety is a huge factor and people are literally dying unnecessarily every day. These kinds of idiocy should have been regulated out of existence the day after they were announced.

yardie 6y ago

One of the cars I rented (A Ford using the Sync console) had bluetooth contacts synced from the previous renter. It was just sitting there: names, phone numbers, addresses, email addresses. Being privacy conscious I deleted the contacts and the 20+ bluetooth profiles stored in the console.

ocdtrekkie 6y ago
I am always shocked when people make these sorts of pairings with devices they don't even own. I often see employees pairing person phones with corporate fleet vehicles too. It's unfortunately an example of where people rank convenience over privacy almost every single time.
- spookthesunset 6y ago
  I mean, most people wouldn’t suspect all their contacts would get copied over to the rental car. Before CarPlay I’d routinely “just hit okay” my way though pairing my phone to the rental car.
  - FreakyT 6y ago
    Agreed, this seems more like a UX problem than a "people don't value privacy" problem. No reasonable person would ever expect that connecting your phone to a car's wireless audio system would transfer all your contacts -- but that's Bluetooth for you!
    - calvano915 6y ago
      Every phone I've ever had on every car system I've ever paired to via Bluetooth has requested permission for contact sync before it would happen. Windows Phone and Android. Perhaps iOS works differently.
      - yardie 6y ago
        It's the same for iOS. But, I'm also guilty, most users configure their bluetooth while leaving the parking lot. If you're reading the request you aren't looking at the road, and vice versa. I've been quick to press OK before fully reading what the car is asking simply because the car and the phone are asking similar questions.

swader999 6y ago

Slightly off this topic. What amazes me is that our phones are surely capable of knowing when we are driving but they still allow texting. Seems like an easy win for safety yet crickets is all we get here.

eikenberry 6y ago
How would they know we are driving and not a passenger?
- swader999 5y ago
  GPS, accelerometer, AI. It can't be impossible.
  - frankydp 5y ago
    More importantly who cares, a couple 10k dead people a year is probably worth a tiny bit of inconvenient, not to mention the 500B in insurance waste.
    - swader999 5y ago
      Bring back drunk driving too while your at it! Fail.

RyJones 6y ago

I included a sample of what Honda[0] records when you pay for Honda Navigation System. It spams your VIN every minute it’s on WiFi, though, regardless of trim level. [0]: https://gist.github.com/ryjones/73739f6a7e662b9ed9ba64d9141ffcc9 https://gist.github.com/ryjones/73739f6a7e662b9ed9ba64d9141f...

brokenmachine 5y ago
Wow, that's a fair bit of data to send home for a "feature" that you don't even have. "TripDate": "", "FuelUsed": "", "StartPos": { "Lat": "", "ODO": "", "Time": "", "Lon": "", "Datum": "" , and some scoring on your driving style. This should be illegal.

dimmke 6y ago

This is one of the many reasons that adding screens to cars has been such a failure. All these carmakers were deluded and couldn’t even build custom systems that were pleasant to use, much less secure. The problem is only partially solved by CarPlay.

gkfasdfasdf 6y ago

And yet, hitting 'next track' on the bluetooth audio still takes 1-2 seconds to register?

_Microft 6y ago

I wonder if there are ways to ... improve the aesthetics of the files in the infotainment system.

fencepost 5y ago

"I do not consent to any searches." You can't prevent them, but don't consent to a search just because you don't do drugs, transport drugs, transport anyone who does drugs. Carrying cash is considered a valid pretext for a search (have any coins in a change tray?), as is being too polite or not being polite enough (maybe because you're annoyed at being stopped). Now that a search of your vehicle also includes a search of any information it's received from any connected devices as well as a history of your locations and speeds you need to make sure you preserve any and all possible avenues to challenge anything found. "Your honor, we didn't find any drugs but during the search he consented to we found evidence that he was driving far in excess of the posted speed limits on these 20 occasions so we're charging him with 20 counts of reckless driving. He confirmed to us during the initial stop that he is the only driver of the vehicle. He was also carrying cash so we're moving to seize those funds and the vehicle." Who, what, when, where and how fast, all neatly tied into one package.

ojbyrne 5y ago
“US Customs and Border Patrol” https://www.aclu.org/other/constitution-100-mile-border-zone https://www.aclu.org/other/constitution-100-mile-border-zone
- fencepost 5y ago
  What are the odds that this remains within the CBP? If police departments decide they can suck all this data from a car without a warrant on a pretext search of a vehicle so you think they won't at least try?

snapetom 5y ago

Interesting this is paid software. Given automakers sad security practices, I wonder how hard it is for some hacker to make a kit using off the shelf products and release the software open source.

SyzygistSix 5y ago
It'd be a shame if a Berla kit happened to fall off the back of a truck.

34679 5y ago

It amazes me that people load all their contacts into the infotainment system of rental vehicles, let alone ones they own. Some individuals have no concept of or desire for privacy.