3 ms·
Security engineers, unfortunately, have a weaker voice at the table than do the marketers and bean-counters. The more secure means would be to require the car
by eplanit 5y ago
Security engineers, unfortunately, have a weaker voice at the table than do the marketers and bean-counters.
The more secure means would be to require the car be taken to a dealership -- but that's costly to the auto maker (they have to pay the dealers for updates they apply), and is deemed an inconvenience to the customer. They worry about the friction on the customer, and the cost.
With OTA updates, much of the security relies on using signed images. The SoCs in IVI systems are fused with the auto maker's key.
- bumby 5y ago>marketers and bean-counters Unfortunately, it's somewhat unfair to always blame the non-engineering folks. Many times is other engineering domains that run counter to good security. In my experience, cost or schedule are the leading factors but sometimes engineers want to push for certain features that are not compatible with good safety or security practices.