7 ms·

The current situation for third party apps (which do exist, plenty of them) is you either give them your Tesla account username/password (super bad) or an acces

The current situation for third party apps (which do exist, plenty of them) is you either give them your Tesla account username/password (super bad) or an access token that you get by signing into your Tesla account, which is less bad but still gives the app the same access as your full Tesla account. So yes, by building a framework to allow users to authorize third party apps to receive limited telemetry data without handing over their full Tesla account keys this may allow for an improvement in privacy for those who want to use such apps.

toomuchtodo 3y ago
Hard agree. I give my Tesla creds to other third party apps willingly, because I want the benefits those apps offer (we own several Teslas, and both the historical data and remote vehicle control has value add). The effort to move to a more secure auth mechanism is welcomed, and it's my data, so I don't get the outrage. This is part of the value in my purchase decisions, and within the risk appetite of my threat model. This is also more efficient on Tesla infra (streaming telemetry data), vs aggressive polling (what current apps do, typically slow polling when vehicle updates are minimal, such as when parked, and then switching up to aggressive polling when traveling at speed).
- sandworm101 3y ago
  And if your local police department wants to buy that data? What if a large law firm wants to buy all the data for use in lawsuits? Once you have pass it on to "third parties" then there isn't much you can do to stop such things. It happened a few decades ago as in-car GPS rolled out. Some rental car companies started issuing speeding tickets. That game lasted about a week. >> Feb. 2002. A Connecticut man has taken a local rental-car agency to court, after the company used Global Positioning System technology and fined him $450 for speeding. https://www.cnet.com/culture/rental-car-firm-exceeding-the-privacy-limit/ https://www.cnet.com/culture/rental-car-firm-exceeding-the-p...
  - toomuchtodo 3y ago
    I’m not ignorant of your concerns, but that’s what privacy laws are for. These third parties have been scrapping Tesla APIs at the behest of their customers for years. This is nothing new, simply more formalized. If the laws are insufficient, that’s a call for better laws (which I agree are needed). The apps I use do not sell their customer data, but Tesla should probably stipulate API integrations aren’t permitted to as extra guardrails (with violations being an API access death sentence, killing the app business).
    - sandworm101 3y ago
      Or forget the laws. I will buy a car that doesn't stream data. My current vehicle doesn't and I have never felt the need. My next one wont either ... not if I have anything to say about it.
      - deleted 3y ago
        [deleted]
      - fastball 3y ago
        That doesn't change the fact that this framework is an improvement on the status quo for Tesla owners. And presumably most Tesla owners are not like you, so what you would do is not super relevant to this discussion.
      - hef19898 3y ago
        The question is, why does a car have to at all? And no, the closest we are is a car that could share data with the OEM, if you wanted, and we don't. As long as possible, I'd pass hard on cars where you don't have that choice.
        dotancohen 3y ago
        With a Tesla you do have that choice. https://www.tesla.com/en_eu/legal/privacy https://www.tesla.com/en_eu/legal/privacy
- clouddrover 3y ago
  > both the historical data and remote vehicle control has value add What value does it add?
TOMDM 3y ago
Why not just an access token that only has certain perms?
- dylan604 3y ago
  Because the first party vendor, in this case Tesla, doesn't provide that kind of mechanism?
  - TOMDM 3y ago
    That's what I'm saying though, instead of allowing permissioned access to their existing telemetry, they're publishing a platform that duplicates all of that functionality.
- cottsak 3y ago
  Tesla doesn't provide this. Also, its beside the point... Which is: Tesla doesn't even want collect telemetry and then re-share it to 3rd parties. Tesla wants to provide a mechanism for the car to connect directly to a customer-authorised 3rd party telemetry collection service. This relieves Tesla from having to function as a middle-man and facilitate things like claims in tokens and granular permissions.
dylan604 3y ago
> The current situation for third party apps (which do exist, plenty of them) is you either give them your Tesla account username/password (super bad) or an access token that you get by signing into your Tesla account, which is less bad but still gives the app the same access as your full Tesla account. In 2023, I'm amazed that this is still a thing. I'm also sad that users are so uncaring about their data that they are cavalier to just provide credentials to 3rd parties just because they pinky swear they'll not be evil and the use of their app is super worth it. I still remember the first time a coworker was singing the praises of some money/finance app that I decided to try. I immediately stopped and said nope when I realized they needed my user/password to all of the banks I wanted to connect. I feel sorry for people that feel the juice is worth the squeeze, especially when they get squeezed dry. Maybe it's not the 3rd party company, but the possibility of hackers that attack said 3rd party. Just too big of an ask
NotYourLawyer 3y ago
> give them your Tesla account username/password (super bad) Only slightly related, but buying a Tesla they encourage you to use Plaid for payment. Which involves… giving your banking account username and password to a third party. Extremely bad. I can’t believe anyone would do this.
- dcow 3y ago
  First off, Plaid uses OAuth when possible to do things the right way. So you really have nothing to worry about if your bank is competent. Second, Plaid will use app passwords if you have 2FA enabled and your bank supports them. This is the correct way to handle that scenario. Third, Plaid saves me a lot of trouble and I have come to trust them. I am happy to delegate responsibility to them. Why is it inherently bad to trust a 3rd party?
  - KennyBlanken 3y ago
    > So you really have nothing to worry about if your bank is competent. US Banks not only use SMS for 2FA, many of them REQUIRE it for 2FA. They also tend to require "security questions" that are usually easily guessed or researched. Again, information that makes it easier, not harder, to get into your account. Good luck trying to find a bank that uses hardware tokens. > Why is it inherently bad to trust a 3rd party? Because doing so substantially increases the attack surface and historically third parties have done a terrible job. For example: every app that uses SMS 2FA inherently trusts the customer's cell phone company. Companies which have done little to address identity thiefs porting out numbers, requesting replacement SIMs, etc.
    - dcow 3y ago
      Sorry that US Bank leaves you exposed to a sim-jacking attack which, if they use Twilio, is mitigated by their verify API. I don't need hardware tokens and full custody of my financial information. I Just Don't. That's literally the entire point of a bank. They do that for me. You don't need to lecture me on how trust delegation works. I mean you use a bank right? You trust a 3rd party with your actual cash. Plaid hasn't demonstrated incompetence, have they? In fact it seems quite the opposite. There isn't any legitimate case against using them aside from "I literally don't trust anybody" which is hypocritical if you use a bank in the first place.

toomuchtodo 3y ago

Hard agree. I give my Tesla creds to other third party apps willingly, because I want the benefits those apps offer (we own several Teslas, and both the historical data and remote vehicle control has value add). The effort to move to a more secure auth mechanism is welcomed, and it's my data, so I don't get the outrage. This is part of the value in my purchase decisions, and within the risk appetite of my threat model. This is also more efficient on Tesla infra (streaming telemetry data), vs aggressive polling (what current apps do, typically slow polling when vehicle updates are minimal, such as when parked, and then switching up to aggressive polling when traveling at speed).

sandworm101 3y ago
And if your local police department wants to buy that data? What if a large law firm wants to buy all the data for use in lawsuits? Once you have pass it on to "third parties" then there isn't much you can do to stop such things. It happened a few decades ago as in-car GPS rolled out. Some rental car companies started issuing speeding tickets. That game lasted about a week. >> Feb. 2002. A Connecticut man has taken a local rental-car agency to court, after the company used Global Positioning System technology and fined him $450 for speeding. https://www.cnet.com/culture/rental-car-firm-exceeding-the-privacy-limit/ https://www.cnet.com/culture/rental-car-firm-exceeding-the-p...
- toomuchtodo 3y ago
  I’m not ignorant of your concerns, but that’s what privacy laws are for. These third parties have been scrapping Tesla APIs at the behest of their customers for years. This is nothing new, simply more formalized. If the laws are insufficient, that’s a call for better laws (which I agree are needed). The apps I use do not sell their customer data, but Tesla should probably stipulate API integrations aren’t permitted to as extra guardrails (with violations being an API access death sentence, killing the app business).
  - sandworm101 3y ago
    Or forget the laws. I will buy a car that doesn't stream data. My current vehicle doesn't and I have never felt the need. My next one wont either ... not if I have anything to say about it.
    - deleted 3y ago
      [deleted]
    - fastball 3y ago
      That doesn't change the fact that this framework is an improvement on the status quo for Tesla owners. And presumably most Tesla owners are not like you, so what you would do is not super relevant to this discussion.
    - hef19898 3y ago
      The question is, why does a car have to at all? And no, the closest we are is a car that could share data with the OEM, if you wanted, and we don't. As long as possible, I'd pass hard on cars where you don't have that choice.
      - dotancohen 3y ago
        With a Tesla you do have that choice. https://www.tesla.com/en_eu/legal/privacy https://www.tesla.com/en_eu/legal/privacy
clouddrover 3y ago
> both the historical data and remote vehicle control has value add What value does it add?

TOMDM 3y ago

Why not just an access token that only has certain perms?

dylan604 3y ago
Because the first party vendor, in this case Tesla, doesn't provide that kind of mechanism?
- TOMDM 3y ago
  That's what I'm saying though, instead of allowing permissioned access to their existing telemetry, they're publishing a platform that duplicates all of that functionality.
cottsak 3y ago
Tesla doesn't provide this. Also, its beside the point... Which is: Tesla doesn't even want collect telemetry and then re-share it to 3rd parties. Tesla wants to provide a mechanism for the car to connect directly to a customer-authorised 3rd party telemetry collection service. This relieves Tesla from having to function as a middle-man and facilitate things like claims in tokens and granular permissions.

dylan604 3y ago

> The current situation for third party apps (which do exist, plenty of them) is you either give them your Tesla account username/password (super bad) or an access token that you get by signing into your Tesla account, which is less bad but still gives the app the same access as your full Tesla account. In 2023, I'm amazed that this is still a thing. I'm also sad that users are so uncaring about their data that they are cavalier to just provide credentials to 3rd parties just because they pinky swear they'll not be evil and the use of their app is super worth it. I still remember the first time a coworker was singing the praises of some money/finance app that I decided to try. I immediately stopped and said nope when I realized they needed my user/password to all of the banks I wanted to connect. I feel sorry for people that feel the juice is worth the squeeze, especially when they get squeezed dry. Maybe it's not the 3rd party company, but the possibility of hackers that attack said 3rd party. Just too big of an ask

NotYourLawyer 3y ago

> give them your Tesla account username/password (super bad) Only slightly related, but buying a Tesla they encourage you to use Plaid for payment. Which involves… giving your banking account username and password to a third party. Extremely bad. I can’t believe anyone would do this.

dcow 3y ago
First off, Plaid uses OAuth when possible to do things the right way. So you really have nothing to worry about if your bank is competent. Second, Plaid will use app passwords if you have 2FA enabled and your bank supports them. This is the correct way to handle that scenario. Third, Plaid saves me a lot of trouble and I have come to trust them. I am happy to delegate responsibility to them. Why is it inherently bad to trust a 3rd party?
- KennyBlanken 3y ago
  > So you really have nothing to worry about if your bank is competent. US Banks not only use SMS for 2FA, many of them REQUIRE it for 2FA. They also tend to require "security questions" that are usually easily guessed or researched. Again, information that makes it easier, not harder, to get into your account. Good luck trying to find a bank that uses hardware tokens. > Why is it inherently bad to trust a 3rd party? Because doing so substantially increases the attack surface and historically third parties have done a terrible job. For example: every app that uses SMS 2FA inherently trusts the customer's cell phone company. Companies which have done little to address identity thiefs porting out numbers, requesting replacement SIMs, etc.
  - dcow 3y ago
    Sorry that US Bank leaves you exposed to a sim-jacking attack which, if they use Twilio, is mitigated by their verify API. I don't need hardware tokens and full custody of my financial information. I Just Don't. That's literally the entire point of a bank. They do that for me. You don't need to lecture me on how trust delegation works. I mean you use a bank right? You trust a 3rd party with your actual cash. Plaid hasn't demonstrated incompetence, have they? In fact it seems quite the opposite. There isn't any legitimate case against using them aside from "I literally don't trust anybody" which is hypocritical if you use a bank in the first place.