3 ms·

They've also slashed prices https://www.bloomberg.com/news/articles/2024-03-27/fisker-slashes-ev-prices-as-much-as-39-in-fight-for-survival https://www.bloomber

They've also slashed prices https://www.bloomberg.com/news/articles/2024-03-27/fisker-slashes-ev-prices-as-much-as-39-in-fight-for-survival https://www.bloomberg.com/news/articles/2024-03-27/fisker-sl... . Presumably that's on existing inventory as the manufacturing is paused. So even if they do cash your check it won't be as big as it used to be. It looks like bankruptcy is imminent. If they do go under does that mean there would be no one there to collect the telemetry? Would an electric car made by a bankrupt company be the first electric car not to constantly be spying on its owners?

leptons 3y ago
Someone else could still do the spying.
londons_explore 3y ago
More importantly, electric cars use a TLS protocol for charging, and that TLS protocol requires the manufacturers to issue new certificates every (90?) days. If the servers go down, these cars won't be able to charge with DC chargers at all (which requires the TLS protocol), and maybe not with home chargers either (which sometimes uses the TLS protocol).
- pornel 3y ago
  Are you sure about this? I thought client certs were only for plug'n'charge (which identifies individual cars for the purpose of payment), and charging paid out of band could be negotiated using dumber protocols.
- jmholla 3y ago
  The 90 days limit is a Let's Encrypt limit. I don't think TLS limits that length in and of itself. Except that it might need to be finite. But I'm not sure that the `Not After` field is required.
  - bigiain 3y ago
    For maybe 5 years or so, the maximum expiry time for a TLS cert (for anything under the purview of the Certification Authority Browser Forum) has been just under 400 days. That's also not a hard technical limit in the TLS spec, you can easily generate a self signed cert that expires in the year 3000 if you want, but it's voluntarily abided by from all the Certificate Authorities that want to have their root certs included in almost every web browser. It's _possible_ that EV chargers don't use common Certificate Authorities, but it feels unlikely to me.
    - korhojoa 3y ago
      These aren't browsers, so that doesn't apply. Their authorities are completely separate. Check out "White Paper of Charging Interface Initiative e. V." from Charins website. https://www.charin.global/media/pages/technology/plug-charge/cd956082cc-1659354078/charin_implementation_guide_to_plug_and_charge_v1_2.pdf https://www.charin.global/media/pages/technology/plug-charge...
- ehnto 3y ago
  That is the funniest thing I have read today, thank you. I understand the need for an encrypted connection, but it is worrying to see cars getting built more or less like phone or web apps, and encountering the same obtuse issues.

leptons 3y ago

Someone else could still do the spying.

londons_explore 3y ago

More importantly, electric cars use a TLS protocol for charging, and that TLS protocol requires the manufacturers to issue new certificates every (90?) days. If the servers go down, these cars won't be able to charge with DC chargers at all (which requires the TLS protocol), and maybe not with home chargers either (which sometimes uses the TLS protocol).

pornel 3y ago
Are you sure about this? I thought client certs were only for plug'n'charge (which identifies individual cars for the purpose of payment), and charging paid out of band could be negotiated using dumber protocols.
jmholla 3y ago
The 90 days limit is a Let's Encrypt limit. I don't think TLS limits that length in and of itself. Except that it might need to be finite. But I'm not sure that the `Not After` field is required.
- bigiain 3y ago
  For maybe 5 years or so, the maximum expiry time for a TLS cert (for anything under the purview of the Certification Authority Browser Forum) has been just under 400 days. That's also not a hard technical limit in the TLS spec, you can easily generate a self signed cert that expires in the year 3000 if you want, but it's voluntarily abided by from all the Certificate Authorities that want to have their root certs included in almost every web browser. It's _possible_ that EV chargers don't use common Certificate Authorities, but it feels unlikely to me.
  - korhojoa 3y ago
    These aren't browsers, so that doesn't apply. Their authorities are completely separate. Check out "White Paper of Charging Interface Initiative e. V." from Charins website. https://www.charin.global/media/pages/technology/plug-charge/cd956082cc-1659354078/charin_implementation_guide_to_plug_and_charge_v1_2.pdf https://www.charin.global/media/pages/technology/plug-charge...
ehnto 3y ago
That is the funniest thing I have read today, thank you. I understand the need for an encrypted connection, but it is worrying to see cars getting built more or less like phone or web apps, and encountering the same obtuse issues.