6 ms·

We're the Researchers who looked into the privacy of 25 of the top car brands

114 points by consumer451 3y ago

mindslight 3y ago
My biggest question is which makes/models can have the surveillance anti-features disabled by unplugging a specific module or two, while losing as little legitimate functionality as possible. Using products the ways we want rather the way manufacturers tell us to is what the tech community used to focus on. It's certainly not a panacea, but it is better than news articles remarking how everything is so broken but in the end just giving in. Barring something like a non-loopholed US GDPR making the surveillance business illegal, self help against corporate control is all we've got. Also there are a lot of people comfortable working on cars for which this could be a gateway to seeing tech as something that can be modded and controlled rather than an impenetrable black box.
- autoexec 3y ago
  > My biggest question is which makes/models can have the surveillance anti-features disabled by unplugging a specific module or two, while losing as little legitimate functionality as possible. Onstar usually lives in a box that can be physically disconnected. That'll keep them from spying on you/your car even if you've never activated or used their service. I never enable bluetooth on my phone, but my car still has an AUX port and I'll plug my phone into that. If I charge my phone by plugging it into the car's USB ports I use a data blocker.
snapetom 3y ago
Geez, that's a horrible graphic. Is the top good or bad? Are the X's good or bad? There's a bunch of logos I don't even recognize.
a_c 3y ago
I wonder if there is an open source community for making cars. And if so, is it legal to drive such a car. Anyway, at the end of the day, no one cares about privacy. Any company had consequences by screwing up privacy I would love to know.
- s_dev 3y ago
  >Anyway, at the end of the day, no one cares about privacy. Everyone cares about their privacy especially those who claim not to. What they really mean is they don't care for the privacy of others. Privacy is simply the right to be left alone. To do your own business without intrusion from family, friends, the public or government or anything.
  - Goronmon 3y ago
    "Cares about privacy" in the sense that they purchase products specifically with that being one of the top concerns?
    - JohnFen 3y ago
      Most normal people I've talked to about this have a deep sense of defeat. They care a lot, but also don't think that there's anything they can do about it -- so it often doesn't figure into their purchasing decisions. It's a position I can understand. How can anyone who doesn't do a deep dive like sniffing network traffic actually know that they're not being sold down the river, privacy-wise? They can't.
      - mindslight 3y ago
        Agreed on how I feel most people perceive this stuff - they care but they are also resigned, whether that's expressed as active disapproval or accepting cognitive dissonance. To me the real crux of the matter is how to turn that caring into any sort of feeling of having choices. It's not even a terribly hard model - if a device has an Internet connection and is running proprietary software, it's only a matter of time until it spies on you or otherwise betrays your trust. But it sounds way too abstract and technical for the average person to act on it. And even in the case that there are off the shelf libre solutions, they still don't compete against all of the advertising pushing surveillance based solutions.
        Silhouette 3y ago
travisporter 3y ago
How would it go if I bought a Tesla and somehow disabled the cellular antenna?
- sneak 3y ago
  The problem you run into is warranty - if you take it in for any kind of service, they will still have access to all data logged locally on flash.
  - travisporter 3y ago
    Good point. Is servicing still needed for Tesla? I know there’s no oil changes but if the tires can be handled by a tire company could you get by without Tesla getting involved
    - ok123456 3y ago
      If not for the battery, charging system, range problems, and components breaking because they didn't use automotive grade parts. The car is basically inoperable if the big tablet stops working.
tpmx 3y ago
Scope creep in the Mozilla Foundation. (Useful research for sure though.)
- autoexec 3y ago
  this is the kind of scope creep I love to see!
- unethical_ban 3y ago
  Mozilla's brand is not a browser, it's privacy and digital freedom.
  - sickofparadox 3y ago
    I would agree that it's brand isn't a browser, considering most people have never heard of it. Makes me wonder what they could do if they actually advertised it.
    - unethical_ban 3y ago
      Most people don't give a shit about browsers and only know about chrome because the multi-tens-of-billions of dollars advertising and web search behemoth plastered ads on every search for a decade.
      - clbrmbr 3y ago
        I really did try to switch to Firefox, but it’s buggy on macOS. Tabs keep hanging in air. Also screen sharing is primitive compared to Chrome…
        wintermutestwin 3y ago
        huh? My main browser is FF on macOS. I currently have ~350 tabs open across multiple windows. I have zero bugginess. I consider Chrome primitive because it lacks vertical tabs (kinda necessary with >10 tabs open at once). You can't even get workable vertical tabs with an extension on Chrome!
sudobash1 3y ago
This is the part I have been most curious about. How does the data get exfiltrated. Here is their link to explain the different levels of car connectivity. https://privacy4cars.com/data-in-cars/p4cs-five-levels-of-vehicle-connectivity/ https://privacy4cars.com/data-in-cars/p4cs-five-levels-of-ve... According to that link, the majority of cars on the road are currently "level 1." Which can connect to phones, but cannot use them to "phone home". But that is of course changing with the cars sold today.
- dmckeon 3y ago
  From that link: > Level 3 and above Connected Vehicles constitute almost the totality of new vehicles produced today.
slg 3y ago
The question that is always missing from these conversations is "Why should we care?" That isn't a popular question in communities like HN, but it is how the average person thinks. On a philosophical level the "if you have nothing to hide" argument is flawed, but from a practical perspective it is kinda true (edit: in the context of corporate data collection). People who actually want change need to be able to communicate this to the average person in a clear and concrete manner how this negatively impacts their life. Once that reasoning starts getting into hypotheticals about a future totalitarian government or philosophical points about the nature of privacy, you have already lost people. You need to be able to tell normal people why they should care about their privacy before they are motivated to protect it.
- mbauman 3y ago
  > from a practical perspective it is kinda true Folks don't realize all the things they are hiding — and can be extraordinarily important to hide — even when they're actively hiding them! My personal favorite anecdote here is comes from a debate with a friend who was staunchly asserting that she had nothing to hide. I just blindly suggested — hypothetically — that one example would be if she were in early stages of pregnancy. Seven months later, guess what she was hiding during the argument.
  - slg 3y ago
    This is part of what I'm talking about. Hiding something from an individual you know is very different from hiding something from a faceless corporation. There are obvious practical implications from someone you know finding out that you are pregnant before you want them to know. Why does it matter whether your car manufacturer knows if you are pregnant?
    - kevincox 3y ago
      The problem is that the more people know a secret the less likely it is to stay secret. I don't want the people I know to be able to download a profile about my from their local data broker. Even if my car company doesn't sell my data (which they probably will) one of the companies that do know it will eventually leak it and it will be slurped up and be made available to people that I don't want it available to.
rkagerer 3y ago
From what I can tell they basically just went and read all the manufacturers privacy policies - that seems to be the primary source of their data. With some background sprinkled in of known breaches / past news. I was hoping there may have been more reverse engineering or packet sniffing going on, or some other deeper means of investigation. Don't get me wrong I care about privacy and this is important information which is great to highlight to the average Joe. But it's not like it was hidden (some of us actually do read, care about, and even send critiques back to vendors about their legal policies).
- Springtime 3y ago
  The way that multiple (I counted 4) articles of theirs talked about it as though it was a report I was expecting a deeper analysis but they just presented keywords pulled from privacy policies and extrapolated. The tone used was also oddly casual and blog-like for an important topic ('ugh', 'yikes', 'wtf', liberal use of exclamations—even double exclamations), apart from hypothetical scenarios which don't help ground their points. In the AMA they admit they're unaware what various aspects mean yet the articles present findings emphatically. Mozilla recently published[1] a page about how they had four lawyers and three 'privacy experts' analyze a Microsoft service agreement and yet the page contains zero comments or analysis from them, merely containing two paragraphs that the conclusion was indecisive. I do appreciate Mozilla bringing attention to such topics, though for all the money and effort they put in getting people to analyze things I kinda hoped their articles would be more substantive than what a reader can similarly determine. [1] https://foundation.mozilla.org/en/campaigns/microsoft-ai/ https://foundation.mozilla.org/en/campaigns/microsoft-ai/
rkagerer 3y ago
Did I blink and miss when cars stopped being purchased, and started being licensed like software? Most of this research is about manufacturers' legal cover (privacy policies). If I owned a car like this I would have my lawyer send a formal letter to the manufacturer explaining that I disagree with their terms, and opt out of all this garbage. Clarifying they do NOT have my consent, regardless of what buttons their UI forces me to push to drive my vehicle. If they tried to tell me I'm no longer allowed to use the vehicle, it would be a delicious lawsuit over what exactly my $50k or whatever bought me (that they'd effectively sold me a lemon).
- kwiens 3y ago
  You blinked and missed it. This has been a systematic trend since software licenses started infecting vehicles. I've been writing about this for a decade now: https://www.wired.com/2014/01/174071/ https://www.wired.com/2014/01/174071/ Followup from law Professor Aaron Perzanoswky: https://www.wired.com/story/plaintext-turns-out-you-own-nothing/ https://www.wired.com/story/plaintext-turns-out-you-own-noth... He even wrote a book on it! https://mitpress.mit.edu/9780262535243/the-end-of-ownership/ https://mitpress.mit.edu/9780262535243/the-end-of-ownership/
- deleted 3y ago
  [deleted]
toss1 3y ago
Seem like time to start prioritizing projects like restoring an old car, maybe even pre-ECU/fuel injected, or doing an electric conversion, just so we an have a car that is a car and not a spyware platform. I can certainly appreciate how a car company would find all the data fantastic for legit purposes of understanding how their products are used and improving the products. But the externalized costs on the customer of the inevitable data breaches... at least make the data connection and collection opt-in.
- ornornor 3y ago
  Was looking into this a few motnsh ago, but a conversion kit for an ICE car was around 10–20k + labor (or tools if you’re DIYing it)… that’s pretty steep.
  - toss1 3y ago
    Seems steep, but since good used cars are well into 5 figures, but one with a blown motor can be had for a few $k, add $10-20k and we're still in range of a good used car or bottom-of-the-barrel new car, and below most electrics... and batteries are getting cheaper, e.g., by 10% in August alone [0] — this could be good! [0] https://www.reuters.com/technology/ev-energy-storage-battery-prices-set-fall-more-report-2023-09-07/ https://www.reuters.com/technology/ev-energy-storage-battery...

114 points by consumer451 3y ago

My biggest question is which makes/models can have the surveillance anti-features disabled by unplugging a specific module or two, while losing as little legitimate functionality as possible. Using products the ways we want rather the way manufacturers tell us to is what the tech community used to focus on. It's certainly not a panacea, but it is better than news articles remarking how everything is so broken but in the end just giving in. Barring something like a non-loopholed US GDPR making the surveillance business illegal, self help against corporate control is all we've got. Also there are a lot of people comfortable working on cars for which this could be a gateway to seeing tech as something that can be modded and controlled rather than an impenetrable black box.

autoexec 3y ago
> My biggest question is which makes/models can have the surveillance anti-features disabled by unplugging a specific module or two, while losing as little legitimate functionality as possible. Onstar usually lives in a box that can be physically disconnected. That'll keep them from spying on you/your car even if you've never activated or used their service. I never enable bluetooth on my phone, but my car still has an AUX port and I'll plug my phone into that. If I charge my phone by plugging it into the car's USB ports I use a data blocker.

snapetom 3y ago

Geez, that's a horrible graphic. Is the top good or bad? Are the X's good or bad? There's a bunch of logos I don't even recognize.

a_c 3y ago

I wonder if there is an open source community for making cars. And if so, is it legal to drive such a car. Anyway, at the end of the day, no one cares about privacy. Any company had consequences by screwing up privacy I would love to know.

s_dev 3y ago
>Anyway, at the end of the day, no one cares about privacy. Everyone cares about their privacy especially those who claim not to. What they really mean is they don't care for the privacy of others. Privacy is simply the right to be left alone. To do your own business without intrusion from family, friends, the public or government or anything.
- Goronmon 3y ago
  "Cares about privacy" in the sense that they purchase products specifically with that being one of the top concerns?
  - JohnFen 3y ago
    Most normal people I've talked to about this have a deep sense of defeat. They care a lot, but also don't think that there's anything they can do about it -- so it often doesn't figure into their purchasing decisions. It's a position I can understand. How can anyone who doesn't do a deep dive like sniffing network traffic actually know that they're not being sold down the river, privacy-wise? They can't.
    - mindslight 3y ago
      Agreed on how I feel most people perceive this stuff - they care but they are also resigned, whether that's expressed as active disapproval or accepting cognitive dissonance. To me the real crux of the matter is how to turn that caring into any sort of feeling of having choices. It's not even a terribly hard model - if a device has an Internet connection and is running proprietary software, it's only a matter of time until it spies on you or otherwise betrays your trust. But it sounds way too abstract and technical for the average person to act on it. And even in the case that there are off the shelf libre solutions, they still don't compete against all of the advertising pushing surveillance based solutions.
      - Silhouette 3y ago

travisporter 3y ago

How would it go if I bought a Tesla and somehow disabled the cellular antenna?

sneak 3y ago
The problem you run into is warranty - if you take it in for any kind of service, they will still have access to all data logged locally on flash.
- travisporter 3y ago
  Good point. Is servicing still needed for Tesla? I know there’s no oil changes but if the tires can be handled by a tire company could you get by without Tesla getting involved
  - ok123456 3y ago
    If not for the battery, charging system, range problems, and components breaking because they didn't use automotive grade parts. The car is basically inoperable if the big tablet stops working.

tpmx 3y ago

Scope creep in the Mozilla Foundation. (Useful research for sure though.)

autoexec 3y ago
this is the kind of scope creep I love to see!
unethical_ban 3y ago
Mozilla's brand is not a browser, it's privacy and digital freedom.
- sickofparadox 3y ago
  I would agree that it's brand isn't a browser, considering most people have never heard of it. Makes me wonder what they could do if they actually advertised it.
  - unethical_ban 3y ago
    Most people don't give a shit about browsers and only know about chrome because the multi-tens-of-billions of dollars advertising and web search behemoth plastered ads on every search for a decade.
    - clbrmbr 3y ago
      I really did try to switch to Firefox, but it’s buggy on macOS. Tabs keep hanging in air. Also screen sharing is primitive compared to Chrome…
      - wintermutestwin 3y ago
        huh? My main browser is FF on macOS. I currently have ~350 tabs open across multiple windows. I have zero bugginess. I consider Chrome primitive because it lacks vertical tabs (kinda necessary with >10 tabs open at once). You can't even get workable vertical tabs with an extension on Chrome!

sudobash1 3y ago

This is the part I have been most curious about. How does the data get exfiltrated. Here is their link to explain the different levels of car connectivity. https://privacy4cars.com/data-in-cars/p4cs-five-levels-of-vehicle-connectivity/ https://privacy4cars.com/data-in-cars/p4cs-five-levels-of-ve... According to that link, the majority of cars on the road are currently "level 1." Which can connect to phones, but cannot use them to "phone home". But that is of course changing with the cars sold today.

dmckeon 3y ago
From that link: > Level 3 and above Connected Vehicles constitute almost the totality of new vehicles produced today.

slg 3y ago

The question that is always missing from these conversations is "Why should we care?" That isn't a popular question in communities like HN, but it is how the average person thinks. On a philosophical level the "if you have nothing to hide" argument is flawed, but from a practical perspective it is kinda true (edit: in the context of corporate data collection). People who actually want change need to be able to communicate this to the average person in a clear and concrete manner how this negatively impacts their life. Once that reasoning starts getting into hypotheticals about a future totalitarian government or philosophical points about the nature of privacy, you have already lost people. You need to be able to tell normal people why they should care about their privacy before they are motivated to protect it.

mbauman 3y ago
> from a practical perspective it is kinda true Folks don't realize all the things they are hiding — and can be extraordinarily important to hide — even when they're actively hiding them! My personal favorite anecdote here is comes from a debate with a friend who was staunchly asserting that she had nothing to hide. I just blindly suggested — hypothetically — that one example would be if she were in early stages of pregnancy. Seven months later, guess what she was hiding during the argument.
- slg 3y ago
  This is part of what I'm talking about. Hiding something from an individual you know is very different from hiding something from a faceless corporation. There are obvious practical implications from someone you know finding out that you are pregnant before you want them to know. Why does it matter whether your car manufacturer knows if you are pregnant?
  - kevincox 3y ago
    The problem is that the more people know a secret the less likely it is to stay secret. I don't want the people I know to be able to download a profile about my from their local data broker. Even if my car company doesn't sell my data (which they probably will) one of the companies that do know it will eventually leak it and it will be slurped up and be made available to people that I don't want it available to.

rkagerer 3y ago

From what I can tell they basically just went and read all the manufacturers privacy policies - that seems to be the primary source of their data. With some background sprinkled in of known breaches / past news. I was hoping there may have been more reverse engineering or packet sniffing going on, or some other deeper means of investigation. Don't get me wrong I care about privacy and this is important information which is great to highlight to the average Joe. But it's not like it was hidden (some of us actually do read, care about, and even send critiques back to vendors about their legal policies).

Springtime 3y ago
The way that multiple (I counted 4) articles of theirs talked about it as though it was a report I was expecting a deeper analysis but they just presented keywords pulled from privacy policies and extrapolated. The tone used was also oddly casual and blog-like for an important topic ('ugh', 'yikes', 'wtf', liberal use of exclamations—even double exclamations), apart from hypothetical scenarios which don't help ground their points. In the AMA they admit they're unaware what various aspects mean yet the articles present findings emphatically. Mozilla recently published[1] a page about how they had four lawyers and three 'privacy experts' analyze a Microsoft service agreement and yet the page contains zero comments or analysis from them, merely containing two paragraphs that the conclusion was indecisive. I do appreciate Mozilla bringing attention to such topics, though for all the money and effort they put in getting people to analyze things I kinda hoped their articles would be more substantive than what a reader can similarly determine. [1] https://foundation.mozilla.org/en/campaigns/microsoft-ai/ https://foundation.mozilla.org/en/campaigns/microsoft-ai/

rkagerer 3y ago

Did I blink and miss when cars stopped being purchased, and started being licensed like software? Most of this research is about manufacturers' legal cover (privacy policies). If I owned a car like this I would have my lawyer send a formal letter to the manufacturer explaining that I disagree with their terms, and opt out of all this garbage. Clarifying they do NOT have my consent, regardless of what buttons their UI forces me to push to drive my vehicle. If they tried to tell me I'm no longer allowed to use the vehicle, it would be a delicious lawsuit over what exactly my $50k or whatever bought me (that they'd effectively sold me a lemon).

kwiens 3y ago
You blinked and missed it. This has been a systematic trend since software licenses started infecting vehicles. I've been writing about this for a decade now: https://www.wired.com/2014/01/174071/ https://www.wired.com/2014/01/174071/ Followup from law Professor Aaron Perzanoswky: https://www.wired.com/story/plaintext-turns-out-you-own-nothing/ https://www.wired.com/story/plaintext-turns-out-you-own-noth... He even wrote a book on it! https://mitpress.mit.edu/9780262535243/the-end-of-ownership/ https://mitpress.mit.edu/9780262535243/the-end-of-ownership/
deleted 3y ago
[deleted]

toss1 3y ago

Seem like time to start prioritizing projects like restoring an old car, maybe even pre-ECU/fuel injected, or doing an electric conversion, just so we an have a car that is a car and not a spyware platform. I can certainly appreciate how a car company would find all the data fantastic for legit purposes of understanding how their products are used and improving the products. But the externalized costs on the customer of the inevitable data breaches... at least make the data connection and collection opt-in.

ornornor 3y ago
Was looking into this a few motnsh ago, but a conversion kit for an ICE car was around 10–20k + labor (or tools if you’re DIYing it)… that’s pretty steep.
- toss1 3y ago
  Seems steep, but since good used cars are well into 5 figures, but one with a blown motor can be had for a few $k, add $10-20k and we're still in range of a good used car or bottom-of-the-barrel new car, and below most electrics... and batteries are getting cheaper, e.g., by 10% in August alone [0] — this could be good! [0] https://www.reuters.com/technology/ev-energy-storage-battery-prices-set-fall-more-report-2023-09-07/ https://www.reuters.com/technology/ev-energy-storage-battery...