8 ms·
Stop connecting vehicles to the internet pls & thanks
by sxcurity 2y ago
Stop connecting vehicles to the internet pls & thanks
- yupyupyups 2y agoOk, I wont.
- carabiner 2y agoThanks.
- AdamJacobMuller 2y agoIf it's done well, there are some useful features there. App unlock, remote start + remote temperature control. All very useful. I couldn't imagine buying a car without carplay now.
- rwmj 2y agoSorry no. App unlock is a stupid anti-feature, do people genuinely think it's better than pressing a keyfob? Remote start is very useful in very cold climates, but guess what, it doesn't need a phone, an app or the internet. My friend in a snowy part of Japan had a radio keyfob that did this literally 10 or more years ago. As long as you were within about 100 ft of the car you could switch it on and turn on the heaters.
- AyyEye 2y agoI installed an aftermarket remote start kit in the 90s. It cost less than $100.
- kube-system 2y agoMany of the earlier aftermarket remote start kits were cheap and simple because the vehicles had fewer security features. They are more complex and expensive today, and some are questionable in their implementation.
- toomuchtodo 2y agoI use my Tesla app to lock and unlock our vehicles all the time, in all cases outside of RF range. I have a Twilio number wired up I can call, enter a 10 digit code, and it will unlock and enable the vehicle to drive in the event I have lost my phone and keycard. These are material quality of life improvements. Physical access is required to exploit any unauthorized access to the vehicle. What are you going to do? Steal my change?
- roywiggins 2y agoIs it really so much better than an RF keyfob that it's worth connecting your car to the Internet for?
- toomuchtodo 2y agoYes, I accept the risk and threat model. RF fobs are compromised frequently as well. Unless you rip the cellular module out of my vehicles, I will find it, and someone is just going to break the window if they want in. Edit: Non connected cars for the risk adverse, connected cars for those with the risk appetite. The market will self sort, even if telematics requires more regulatory oversight (they do!). https://www.google.com/search?q=fob+relaying+theft+attack https://www.google.com/search?q=fob+relaying+theft+attack
- roywiggins 2y agoOf course, with this Kia attack, it didn't matter if you had never used or activated the feature, it was still vulnerable. With keyfobs you can just not use it or destroy it if you are worried about relay attacks. Connecting every car to the Internet at all times just in case their owners might want to activate a remote start feature at some point is nuts.
- potato3732842 2y ago>Yes, I accept the risk and threat model. >Edit: Non connected cars for the risk adverse, connected cars for those with the risk appetite. The market will self sort, even if telematics requires more regulatory oversight (they do!). Seems contradictory. What risk are you actually accepting if we're all forced to kick in for some regulator that protects you from the majority of the risk?
- somehnguy 2y agoRemote start via phone is still useful in cold climates. While getting a ride with a friend to my car left at some location I've been able to start & get it warmed up before we even got off the highway. It was nice and warm by the time I arrived to it. With only a keyfob it would have still been ice cold. Absolutely not a necessary feature, but I miss it (free MyLink subscription expired and I won't pay for it).
- toast0 2y agoFor safety, you're really not supposed to remote start a vehicle if you can't observe it / are in contact with someone who is observing it. Lots of potential hazards, but it can be convenient.
- Kirby64 2y agoWith an EV, this isn't a concern. No tailpipe fumes or whatnot to worry about. Also, in pretty much any public space where you would park it (i.e., outside of your own garage), this isn't a concern either.
- Rebelgecko 2y agoCan you give an example of a hazard? I genuinely can't think of one- at least on my car, when you remote start it is still locked so it's not like anyone can get in and drive it away (and even if someone breaks in I don't think it'll go into Drive without a key in the vehicle)
- toast0 2y agoIf the tailpipe is restricted (by snow, say), you're likely to damage the car. If it runs poorly when it starts, and it's unsupervised, it could result in damage that would have been avoided if you were present and shut it down in a reasonable amount of time. If someone is working on the car (authorized or not), they may be injured if it starts without their knowledge. If it's parked indoors, exhaust gasses are likely to build up, leading to a dangerous situation. If you have multiple drivers, maybe someone else moved it and you didn't know.
- Kirby64 2y agoAutomatic unlock with a phone is not an anti feature. If it replaces your key fob completely, then it’s one less thing you have to carry. I haven’t carried keys of any kind for… 6 years at this point? Also, remote start/temp control that works no matter the distance as long as there’s internet connectivity is superior to a radio based implementation. There’s plenty of places that are largely RF impermeable, or otherwise distance is too far. If you’re in a store, 100ft is barely any distance, especially with the layers of concrete in the way.
- devilbunny 2y ago> I haven’t carried keys of any kind for… 6 years at this point? You do you, of course, but I've absolutely relied on physical keys on numerous occasions over the years even when electronic methods exist. Garage door spring broke or power is out, and battery died on your electronic house lock? You're not getting in. Keyless fob ignition car ends up in a very strange state where, even though I have the fob in my hand and the car is running, it won't respond because the doors were locked from the inside by the dog? Happened. Actually had that conversation about the house with my wife when she didn't carry house keys: do you want to find yourself stuck out of the house while the pets freeze or boil because you didn't just carry a damned key?
- asdasdsddd 2y agoThe time I save pays for a locksmith many times over. I also give my friends/my condo spares so this is never actually an issue.
- Kirby64 2y ago> Garage door spring broke or power is out, and battery died on your electronic house lock? You're not getting in. How, exactly, would this happen simultaneously? Any reasonable system should alert you when batteries in your locks are running low. Unless you brazenly disregard those warnings (since, the low battery at least on mine means you still have... weeks left of battery), you will always have access. Also, with multiple entry-points into the house, you'd need ALL door locks to have their batteries die simultaneously. And the power to be out. That's a level of redundancy that is just unreasonable. > Actually had that conversation about the house with my wife when she didn't carry house keys: do you want to find yourself stuck out of the house while the pets freeze or boil because you didn't just carry a damned key? In what world would your pets die because you got locked out of the house? You should have AC/heating... and in some sort of power outage event (which, also, would require you to not be home either), your pets are certainly not going to freeze/overheat immediately. In such a crazy unrealistic scenario, breaking a window or drilling out a lock is a straightforward solution. But also, that would require so many multiple events to happen simultaneously (to get to needing to break a window) that it will never reasonably happen.
- mavamaarten 2y agoLocking my car through the app is a genuinely useful feature. Ever parked, left your car, and thought to yourself "damn, did I lock my car?". Just lock it through the app. I've had to fetch something from my car while my gf had the car keys with her, I could just open it with my phone. It's useful.
- nucleardog 2y agoMy key fob has two way communication and like a half mile range in urban areas. If I ever park and wonder “damn did I lock my car” I can look at my key fob and see if it has a locked or unlocked padlock on it. As long as I remember sometime within like 20 minutes of parking (assuming I spend 20 minutes walking away from it in a straight line), I can lock it if I _did_ forget. I’ll get confirmation that it locked if I do that and the command makes it through. Mine also works even where there’s no cell reception! Which is all to say… I’d prefer better key fobs instead of cellular modems and cloud services.
- Tempest1981 2y agoDo any auto manufacturers offer this? I see several aftermarket systems here: https://www.popularmechanics.com/cars/a34512303/best-remote-car-starters/ https://www.popularmechanics.com/cars/a34512303/best-remote-...
- nucleardog 2y agoDoubt it. Mine's aftermarket. The manufacturer doesn't offer remote start on their manual transmission vehicles so I had to get an aftermarket system if I wanted remote start for those -50 days. Mine's a little older / less fancy than some of those linked[0] but essentially the same. I doubt it would ever solve my problem (they're still not going to offer half the functionality on a M/T vehicle), but there's no reason they couldn't offer something like this as a couple hundred dollar option on most of their vehicles. They already basically have all the hardware in the car I figure. [0] https://www.compustar.com/remotes/pro-t12/ https://www.compustar.com/remotes/pro-t12/
- asdasdsddd 2y agoI dont want to carry another stupid fob around. My goal in life is to carry a dumb smart phone that can unlock anything.
- cryptonector 2y agoRemote start is also useful in hot climates, and for similar reasons.
- AyyEye 2y agoIt's never well done.
- bigstrat2003 2y agoIt was well done on my previous car and current car. So it would appear that your claim does not hold.
- natch 2y agoIt's very well done in my car.
- yreg 2y agoIt's well done in Tesla.
- ric2b 2y agoTesla's have been hacked multiple times in the past as well.
- FriedPickles 2y agoUnlock via Bluetooth is perfectly viable without internet connection (unless you mean unlocking it for someone else?). Remote start and temp control should probably work from a few hundred feet away. If only phones had a longer range local radio, perhaps something like Zigbee. Maybe WiFi direct?
- lowkj 2y agoCarPlay doesn't use your car's internet, it uses your phone's internet. That's part of the whole beauty of it.
- krferriter 2y agoYeah, important distinction
- natch 2y agoPlease explain how in your mind are they doing remote climate control, then?
- whiplash451 2y agoIt just doesn’t have to be the internet.
- natch 2y agoWhy do you give CarPlay credit for those features? No need for CarPlay for any of those. What do you get from CarPlay that you don't get from a connected car without CarPlay?
- yjftsjthsd-h 2y ago> What do you get from CarPlay that you don't get from a connected car without CarPlay? Software quality and security updates on the internet-facing component.
- natch 2y agoYou are under the impression that Teslas can't get software and security updates? Which happen to be free, btw.
- morkalork 2y agoIf the car manufacturer can remote unlock and start your car for you, it can be abused by a hacker in same way. It's the exact same argument against backdoors in encryption for the government, if a backdoor works for them, it'll work for hackers too.
- CatWChainsaw 2y agoWell aren't you a precious little princess. I have none of that. It's very unlikely my early 2000s car will ever be attacked in this manner. I am going to maintain that car as long as possible. Enjoy your ticking time bomb.
- kkfx 2y agoWell... There is no reason to have a middleman like the OEM, so the car could be connected just with the formal owner (i.e. with a personal subdomain o dyndns), FLOSS stack under users control and some hard limits (like you can't act on the car if it moving and so on).
- Rebelgecko 2y agoI would guess 99.9% of car owners who use the app would not set up a personal subdomain or manage a FLOSS stack
- thfuran 2y agoI don't think you have enough nines.
- kkfx 2y agoNo doubt today, but in another very realistic in the sense that's perfectly logic and possible since more than a decade, where government have digital IDs who are smart-cards not crapplications, and with them certified mails with a personal domain and the ISP router is just a FLOSS homeserver (as it is actually, being GNU/Linux embedded machines with a tailored PBX, Samba to offer usb network storage, CUPS for serving a usb-connected printer and so on, just a bit more powerful and open. In such world thanks to the commonality of FLOSS we have dedicated distros and package for such iron, widespread enough to be commonly available in users hands. As a result the security risks are still more than zero but much, much less and many who could since their car is their own, not owned for real by the OEM, they could simply cut the connection if they do want so. Such open world could be done in few years by laws, and anything is already there since decades. It's a matter of knowledge and will.