4 ms·

> Notwithstanding anything in the preceding paragraph, motor vehicle owners’ and independent repair facilities’ access to vehicle on-board diagnostic systems sh

by judge2020 3y ago

> Notwithstanding anything in the preceding paragraph, motor vehicle owners’ and independent repair facilities’ access to vehicle on-board diagnostic systems shall be standardized and not require any authorization by the manufacturer, directly or indirectly, unless the authorization system for access to vehicle networks and their on-board diagnostic systems is standardized across all makes and models sold in the Commonwealth and is administered by an entity unaffiliated with a manufacturer. So the manufacturer cannot use their own software to manage authn/authz to their cars? What would stop the unaffiliated entity from giving anyone access to anyone's car? They wouldn't even have a financial stake in making sure they implement proper authn/authz and internal access controls to stop employees/contractors from accessing this information improperly. https://web.archive.org/web/20230510205950/https://malegislature.gov/Laws/SessionLaws/Acts/2020/Chapter386 https://web.archive.org/web/20230510205950/https://malegisla... The NHTSA complaint: https://s3.documentcloud.org/documents/23846284/nhtsa-letter.pdf https://s3.documentcloud.org/documents/23846284/nhtsa-letter... (bump from a comment further down by Simulacra )

58028641 3y ago
Why couldn’t it be authorized by the owner of the car?
- judge2020 3y ago
  It sounds like the actual software that facilitates giving third parties access to remotely access car diagnostics can't be ran by the car manufacturer. So while they likely envision the user controlling the authorization for their car, my point is that this third party likely has little reason or obligation to safeguard access and authorization to this data and ensure only the user can authorize access to their car. If the automaker themselves ran the software for this, they have a financial stake to make sure it's done right, since "hyundais being remotely controlled due to bad hyundai 2fa" is not a good headline. But with a third party, it'll have to be a de-facto monopoly over access to a manufacturer's cars, so once they have the contract and are years after the initial rollout, they might cut costs and leave the authorization/authentication system to rot, or have support agents incorrectly "recovering" user accounts for themselves or being phished into doing so.

58028641 3y ago

Why couldn’t it be authorized by the owner of the car?

judge2020 3y ago
It sounds like the actual software that facilitates giving third parties access to remotely access car diagnostics can't be ran by the car manufacturer. So while they likely envision the user controlling the authorization for their car, my point is that this third party likely has little reason or obligation to safeguard access and authorization to this data and ensure only the user can authorize access to their car. If the automaker themselves ran the software for this, they have a financial stake to make sure it's done right, since "hyundais being remotely controlled due to bad hyundai 2fa" is not a good headline. But with a third party, it'll have to be a de-facto monopoly over access to a manufacturer's cars, so once they have the contract and are years after the initial rollout, they might cut costs and leave the authorization/authentication system to rot, or have support agents incorrectly "recovering" user accounts for themselves or being phished into doing so.