29 ms·
> Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all th
by nurple 5mo ago
> Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota. However, if you use a wired USB connection then it does not do that (see the discussion here and elsewhere), so I exclusively use CarPlay via USB.
The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected.
They are both very cagey with how they talk about this (or don't).
- zackify 5mo agoI use android auto through grapheneos thankfully! this is crazy!
- andrepd 5mo agoCan you clarify? Does it feed it bullshit data? Because android auto expects car telemetry data which it streams to Google's servers. Which is a big no-no for me for obvious reasons.
- piaste 5mo agoIt doesn't stop Android Auto from doing whatever with the car data, but it's sandboxed to have no more default privileges than a regular app, so it can be denied access to your phone's data by default (apps, contacts, etc.). Wireless AA will only work if you grant it extra privileges; wired AA does not need them. You can also "firewall" AA via something like TrackerControl, this would let you block connections to eg. Google Analytics servers without denying network access altogether (which would likely cause AA to stop working). I've only used AA with short-term rentals so I didn't spend too much time exploring these options.
- andrepd 5mo agoFair enough. Streaming my location and an OBD dump to Google whenever I'm driving is a non-starter for me, so I'll stick with the aux cord!
- downloadram 5mo agotracker control will be itself blocked by android auto, with a stonewall error DISABLE VPN TO USE ANDROID AUTO not sure if this was caused by an OS update or an AA update because im certain it used to work fine (not graphene, but friends otherwise stock samsung android)
- b00ty4breakfast 5mo agothis sounds like donning a TNT vest to diffuse a bomb
- downrightmike 5mo agoThey are cagey because they get nearly $100k upfront with crazy interest rates, and then they make a ton of money through their spyware.
- pfortuny 5mo agoHonest question: what do you mean?
- downrightmike 5mo agoYou pay inflated prices for the car and then they still steal and sell your data. This isn't hard to understand, same thing smart TV mfg do.
- epicide 5mo agoI think you mean "subsidized" instead of "inflated".
- Rooster61 5mo agoNo, they meant inflated. Cars are quite expensive right now, and dealers are notorious for raking in cash through financing. If they were subsidized, prices would be lower to increase user base, as in the aforementioned dynamic present in the current smart TV market. I think the inital point was that car manufacturers/dealers are double dipping through initial cost/interest AND data harvesting.
- alext5 5mo agoBoth an high end tv or a car are expensive items where the manufacturer shouldn’t be making additional income on your personal data. A free 55 inch tv supported by ads would be subsidized. A big ticket item price likely does not change even if it intrudes on your privacy and the manufacturer makes additional income on your data. In that sense it’s not subsidized it’s just greedy business practices.
- arkadiyt 5mo agoIn a perfect world they wouldn't collect it either, but I'd rather Apple have it than the car manufacturer (or rather, only Apple vs both Apple and the car manufacturer)
- drnick1 5mo agoYou need GrapheneOS to sever the link to Google. You can also deny specify apps and services Internet access.
- MSFT_Edging 5mo agoIs android auto still available with Graphene? AA is genuinely one of the few life-changing features introduced in the last decade that I'd prefer not to go without.
- subscribed 5mo agoYep and works flawlessly via USB for me. That was a deal breaker for me for the longest time too. Allowing it to connect over Bluetooth requires granting AA plenty of additional permissions which I didn't want to do (but hey, on GOS at least you can muzzle that thing).
- throw_a_grenade 5mo agoMostly works, some stuff doesn't. The worst thing that doesn't work is alternative maps (e.g. OsmAnd).
- Quentangle 5mo agoOrganic Maps works. I have not tried any other alternative. You may have to enable developer mode in the Android Auto settings, then enable Unknown Sources in the developer settings.
- wing-_-nuts 5mo agoI like the idea of graphene, but I worry my banking / brokerage apps wouldn't work anymore and that'd be a deal breaker
- drnick1 5mo agoThe Graphene community maintains a list of compatible banking apps. Another possibility is to keep an old/cheap, stock Android phone at home with WiFi only for apps like this.
- everdrive 5mo agoWhat about if it's just paired as an audio device rather than through an app?
- embedding-shape 5mo agoDon't get CarPlay/Android Auto that way though, so no navigation/maps for example.
- everdrive 5mo agoSure -- I'm not asking a general question, but thinking about my wife's phone, which is paired as an audio device. It sounds like we're probably in good shape.
- Jblx2 5mo agoAre there any cars that support CarPlay/Android Auto that don't have built-in navigation/maps?
- hoistbypetard 5mo agoMine (a US 2017 subaru impreza) supports both and doesn't have built-in navigation/maps.
- embedding-shape 5mo agoAFAIK, every single one of those "built-in navigation/maps" either require the car itself is internet connected (with its own modem), or that you every year get a SD card with map updates to stick into the car. I guess it's fine in an emergency, but I wouldn't want to use it day-by-day, the live traffic/road closure information in my case ends up saving us tons of time over the year.
- Jblx2 5mo agoIt is also OK if you only use GPS 3 times per year.
- 5mo ago
- embedding-shape 5mo agoAnd once you've gotten rid of Google and Apple, your telecom company tracks you, your CC payments help track you and even cameras in public do. It's hard to not want to throw your hands in the air screaming "whatever" when almost everything you use in public is somehow used to track you either as you move around, or in the future.
- dualvariable 5mo agoThis is one of those things that can't ever be solved with individual solutions but needs to be solved through legislation and standards, and ideally a fundamental right to privacy (and a fundamental redefinition of what privacy means when it comes to corporate surveillance of individuals).
- whamlastxmas 5mo ago[flagged]
- foresto 5mo ago> Government leaders will never give up their pipeline of knowing everything about everyone. Then let us hire different leaders into government. Public servants, not overlords.
- HenryBemis 5mo agoIf you have noticed, every independent candidate almost never gets elected. Vast majority of those who say they will "change the country to the better" either never get elected or are ousted early on. And those who stay change their tune. I fear that only blackmail-able people with the potential to win elections, get the support, so that they are beholden to someone who ultimately gives them the job (e.g. funding their campaign) and has to return the favor x10 when elected, so promises go out the window and new reality sets in.
- 5mo ago
- gruez 5mo ago>if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota Source? Can bluetooth devices do that without the user's knowledge?
- MRPockets 5mo agoI assume that the original article statement is referring to connecting to CarPlay/Android Auto wirelessly, not simply connecting via Bluetooth for a speaker-type setup. But I do not know that this is the case. Certainly, I would assume all privacy bets are off if you connect CarPlay/Android Auto in any manner.
- deleted 5mo ago[deleted]
- jklinger410 5mo ago> then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota How?
- colordrops 5mo agoThey are probably confusing google auto with bluetooth.
- brg1007 5mo agoOn Android there is an option called "Bluetooth tethering - Share phone's internet connection via Bluetooth" . If it is On and you are connected to the car's bluetooth it will have internet access via your phone.
- jklinger410 5mo agoI'm suspicious that the car's system can do this. I don't think we should be assuming your car can tether internet through bluetooth until we see someone snoop Toyota-bound traffic being routed through their phone.
- kccqzy 5mo agoThat's Bluetooth PAN. I would be very surprised that a car will implement this profile.
- nullify88 5mo agoI have a 2025 Renault 4 etech and I frequently enable bluetooth thethering so I can access Spotify, HBO etc via the in car entertainment system (It runs a flavour of Android called OpenR Link) , not via android auto. Though I frequently need to enable the bluetooth tethering setting on the phone before the profile can be activated via the cars paired devices menu (where you can select other profiles such as Audio, calling, etc) While the car has a sim card already, I can't use it for general purpose apps without a subscription. Only updates, remote control and I suppose telemetry. I usually opt for choosing a bluetooth tether instead of wifi since I already establish a connection for calls, or music / audio books. It isn't hard to imagine Android being able to transmit vehicle telemetry via the same means.
- Angostura 5mo agoStandard Carplay is essentially an additional screen for your phone - your existiing privacy settings carry across. What's your concern?
- vk6flab 5mo agoUnfortunately that's not quite true, since the "app screen" on the media display during Android Auto use has an additional "Toyota" icon that AFAIK isn't coming from my phone. What's more concerning is that it's entirely unclear exactly what information is shared over the Android Auto link, in my case, over Bluetooth.
- adestefan 5mo agoThat icon is a "close Carplay/Auto" button. My Subaru has a Subaru button; my wife's Mazda has a Mazda button.
- tadfisher 5mo agoThere's a protobuf-based API for two-way communication between the Android Auto app and the head unit [0]. It depends on what the headunit supports, but this includes data such as GPS location, steering wheel button activation, accelerometer data, parking brake activation, gear selection, touch screen input, dimmer switch position, odometer, and much more. A lot of this has obvious use within the AA interface; for example, the parking brake position is used to prevent scrolling too far through lists, and the car's GPS is usually much more accurate than the phone's and better on the phone battery. 0: https://github.com/f1xpl/aasdk/tree/development/aasdk_proto https://github.com/f1xpl/aasdk/tree/development/aasdk_proto (pretty old reverse-engineering effort)
- hamburglar 5mo agoOne of the things I notice CarPlay has access to is the fan speed. In one of my vehicles, when I say “hey siri” it turns the HVAC fan down so it can hear me better. I’ve always wondered if the interface is the phone telling the car “hey make things quieter” or if it’s explicitly turning the fan down. It’s also interesting that this only happens in one of my cars. I assume it’s because the other car is a higher end vehicle and has a quieter fan.
- nullc 5mo ago> then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota [...] so I exclusively use CarPlay via USB. I would be concerned that a passenger connecting their phone to it while I was driving. In other cars I've been successful picking up the relevant modules for peanuts from surplus/scrap then just desoldering the RF-active components (like bt radios, etc) and swapping them in. YMMV but if it doesn't work you're just out the cost of a junk part. Even if some radio feature is benign its existence means that its hard to be confident that there isn't some other telemetry feature you missed. With no connectivity at all you don't need to worry that you missed something because you can monitor the car with a spectrum analyzer and observe its never transmitting. Unfortunately in some newer cars you can't swap any modules without a dealer tool to pair the module to the car, presumably in a bid to prevent third parties from fixing the car (presumably preventing people from lobotomizing their surveillance isn't on their radar yet).
- rkagerer 5mo agoIs there any information about precisely what vehicle telemetry they capture and retain? I know the laws are far from perfect, but isn't there some legislation compelling them to disclose what they collect? What specifically would be the most relevant law/regulation? (If it varies by geography, pick any major market, eg. California, that is big enough to impact their engineering design and the content of published material). You mentioned they're cagey, and my aim is to examine if there's a gap between what they're supposed to disclose and what they do, which could be rectified by litigation. Eg. If they just say "vehicle telemetry" that doesn't tell you much, and I'd happily contribute to an EFF effort to get them to elaborate. Alternatively someone who works close to this code could provide some examples of what a "typical" smartphone OS platform collects these days.
- KennyBlanken 5mo agoGenerally speaking the author seems to wave a bunch of conspiracies around without the evidence to support it, or frankly, much technical knowledge. The author seems unaware that in iOS you can uncheck nearly every single location usage the OS and Apple Apps themselves collect. On iOS not only can you shut off things like traffic reporting while using Maps and cellular/WiFI/Bluetooth data collection...unlike Google, Apple will let you use those services without requiring you contribute to them.
- mmooss 5mo ago> the author seems to wave a bunch of conspiracies around without the evidence to support it The author provides links at the top to credible reporting on relatively well-known privacy concerns.
- pbhjpbhj 5mo agoGDPR should work to get a copy of the data, also it would only be allowed to be collected with explicit permission -- I'm assuming that data about your car is PII about you.
- phony-account 5mo ago> The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected. Do you have evidence or a citation for this? Or is it just the sort of statement that’s made in the pretty certain expectation of upvotes on HN?
- platevoltage 5mo agoI would have liked to have seen this citation too instead of seeing you get downvoted.
- internet2000 5mo agoI trust Apple more than I trust Toyota.
- sneak 5mo agoYou shouldn’t. Apple preserves backdoors in iCloud encryption to enable warrantless government surveillance. They have no other option.
- willis936 5mo agoIt's weird to hang up on this specific item because they do actually offer an E2EE icloud option. Lose your key: lose your data. https://support.apple.com/en-us/108756 https://support.apple.com/en-us/108756
- sneak 5mo agoNobody has it on, and unless BOTH sides are using it, your iMessage conversations are all readable by Apple, because they are backed up twice - one for each end. This option is also disabled in the UK - an intentionally preserved backdoor for government access. https://support.apple.com/en-gb/122234 https://support.apple.com/en-gb/122234
- willis936 5mo agoOkay fine but I use it and so does everyone in my immediate family and we're not in the UK. So... you're wrong.
- Projectiboga 5mo agoA 12v bluetooth to FM transmitter can at least give you tunes and a speaker phone feature.
- dyauspitr 5mo agoYeah, but at least for now they don’t have the power to remotely disable my car or jack up my insurance prices and I trust Apple 1000% more than any of the other random car companies do not sell my data.
- happyopossum 5mo ago> They are both very cagey with how they talk about this (or don't). No, not really - at least not apple. They are very clear on what CarPlay’s privacy stance is, and they’ve got privacy white papers on pretty much everything: Eg. https://www.apple.com/privacy/docs/Location_Services_White_Paper_Nov_2019.pdf https://www.apple.com/privacy/docs/Location_Services_White_P... Again, at least on the apple front this comes off as a ton of “stated without evidence “
- like_any_other 5mo agoWhat does a user see when enabling CarPlay on their iPhone, and not browsing apple.com for random .pdfs?
- nurple 5mo agoPlease provide a reference to the page that talks about the data that carplay collects. There are zero hits for "carplay" in that doc. I have done extensive research into this, and Apple provide basically zero information about what information carplay collects about your vehicle. Location data isn't the only kind of data that your car feeds to your device through the carplay connection.
- jonnycomputer 5mo agoHow would they use my phone's internet? assuming no app is installed of course.