6 ms·

It's opt-out on my Renault Megane e-Tech. It was a very clear prompt during initial setup, and it shows me a very unambiguous notification that it's enabled ev

It's opt-out on my Renault Megane e-Tech. It was a very clear prompt during initial setup, and it shows me a very unambiguous notification that it's enabled every time I start the car. If I click on that it takes me to the setting. edit: might even have been opt-in during initial setup, now that I think about it. I do recall it being a very deliberate thing during setup. Of course I'll have to trust that turning it off actually turns it off, no way for me to verify that. The reason I keep it on is because my SO is a bit absent minded to where she parks the car, and I value not having to run around in the streets trying to find it when I'm in a hurry over the potential privacy loss. edit: Renault was found[1][2] to be the "least problematic" with respect to privacy by Mozilla last year. [1]: https://foundation.mozilla.org/en/blog/privacy-nightmare-on-wheels-every-car-brand-reviewed-by-mozilla-including-ford-volkswagen-and-toyota-flunks-privacy-test/ https://foundation.mozilla.org/en/blog/privacy-nightmare-on-... [2]: https://news.ycombinator.com/item?id=37443644 https://news.ycombinator.com/item?id=37443644

amluto 2y ago
Apple knows how to allow one to find one’s devices without Apple knowing where they are. It’s not that hard.
- likeabatterycar 2y ago
  Ackhually, it is that hard, unless your method relies on millions of your devices out in the wild acting as sensors in a mesh network, as Apple does.
  - amluto 2y ago
    That’s a much harder problem than VW would need to solve. Also, Find My substantially predates the Find My network and AirTags. There are very straightforward solutions, depending on the threat model. For example, the app could send VW a private key every day, and VW would send that key to the car. Then the car sends periodic location reports, encrypted to that key. VW can, upon request, send the report to the app, which decrypts it. But VW can’t decrypt the report itself, so they don’t know the location of the car. Also, it’s forward secure in the sense that a leak of VW’s database is entirely useless after a day.
    - magicalhippo 2y ago
      This would require a key per app installation, my SO has the app installed too for example. It would also introduce a lot of additional failure modes. Doable but not exactly trivial.
      - layer8 2y ago
        It would work exactly like how you can send an encrypted email to multiple recipients and each of them can decrypt it despite having different private keys. That part isn’t rocket science.
        magicalhippo 2y ago
        Indeed, it's making it work reliably and with zero friction given both apps and car will have variable internet access.
        amluto 2y ago
        This is not hard. App login sets up a session with VW (which is surely already does), except the session needs a database entry and not just a JWT-like token. (Many auth frameworks do this anyway.) The database row needs to add a public key, and the server needs to send all the key changes to the car. And that’s about it.
        magicalhippo 2y ago
        Again, that's the easy part. The hard part is making it work reliably in the real world.
        deleted 2y ago
        [deleted]
        amluto 2y ago
        What, exactly, makes it hard to get this to work reliably in the real world? The app already won’t work without a valid login session. The car is already sending a little blob of data to the mothership containing a location. If the communication to the mothership changes to having the mothership send a list of keys and the car encrypt its blob, that’s basically it. The total increase in communication needed is one round trip to revalidate keys. I realize that modern development has layers and layers of documents and teams and overcomplicated interfaces, but this is the kind of thing that could be done by one developer, using two servers and a load balancer (or a more creative HA scheme with client assistance that can easily survive complete loss of a datacenter or two), that can handle the entire fleet.
likeabatterycar 2y ago
The opt-out should be pulling the telematics fuse. Unless you can audit the source code, you can't, and shouldn't, trust the software.
- layer8 2y ago
  That might be impossible with mandatory eCall: https://en.wikipedia.org/wiki/ECall https://en.wikipedia.org/wiki/ECall

amluto 2y ago

Apple knows how to allow one to find one’s devices without Apple knowing where they are. It’s not that hard.

likeabatterycar 2y ago
Ackhually, it is that hard, unless your method relies on millions of your devices out in the wild acting as sensors in a mesh network, as Apple does.
- amluto 2y ago
  That’s a much harder problem than VW would need to solve. Also, Find My substantially predates the Find My network and AirTags. There are very straightforward solutions, depending on the threat model. For example, the app could send VW a private key every day, and VW would send that key to the car. Then the car sends periodic location reports, encrypted to that key. VW can, upon request, send the report to the app, which decrypts it. But VW can’t decrypt the report itself, so they don’t know the location of the car. Also, it’s forward secure in the sense that a leak of VW’s database is entirely useless after a day.
  - magicalhippo 2y ago
    This would require a key per app installation, my SO has the app installed too for example. It would also introduce a lot of additional failure modes. Doable but not exactly trivial.
    - layer8 2y ago
      It would work exactly like how you can send an encrypted email to multiple recipients and each of them can decrypt it despite having different private keys. That part isn’t rocket science.
      - magicalhippo 2y ago
        Indeed, it's making it work reliably and with zero friction given both apps and car will have variable internet access.
        amluto 2y ago
        This is not hard. App login sets up a session with VW (which is surely already does), except the session needs a database entry and not just a JWT-like token. (Many auth frameworks do this anyway.) The database row needs to add a public key, and the server needs to send all the key changes to the car. And that’s about it.
        magicalhippo 2y ago
        Again, that's the easy part. The hard part is making it work reliably in the real world.
        deleted 2y ago
        [deleted]
        amluto 2y ago
        What, exactly, makes it hard to get this to work reliably in the real world? The app already won’t work without a valid login session. The car is already sending a little blob of data to the mothership containing a location. If the communication to the mothership changes to having the mothership send a list of keys and the car encrypt its blob, that’s basically it. The total increase in communication needed is one round trip to revalidate keys. I realize that modern development has layers and layers of documents and teams and overcomplicated interfaces, but this is the kind of thing that could be done by one developer, using two servers and a load balancer (or a more creative HA scheme with client assistance that can easily survive complete loss of a datacenter or two), that can handle the entire fleet.

likeabatterycar 2y ago

The opt-out should be pulling the telematics fuse. Unless you can audit the source code, you can't, and shouldn't, trust the software.

layer8 2y ago
That might be impossible with mandatory eCall: https://en.wikipedia.org/wiki/ECall https://en.wikipedia.org/wiki/ECall