15 ms·

Volkswagen started blocking GrapheneOS users

786 points by microtonal 4mo ago

aljgz 4mo ago
I might be soon moving to Europe and would need to get a new car, replacing my (mostly) beloved Toyota bz4x. Well I guess VW is out.
- left-struck 4mo ago
  Buy a used car from a few years ago… do some research and make sure it doesn’t have anti features. This is the only option until manufacturers stop this crap
queeshonda 4mo ago
[dead]
- warkdarrior 4mo ago
  That's a starting point, but it seems the VW app is using a Google SDK for integrity checks, so maybe we need certain SDKs to be banned.
- arkon_hn 4mo ago
  Supporting mainstream OEM variants can already be enough of a nightmare in behavioural differences. What motivation do most companies have to support Graphene, which will be a handful of customers at best? Developers may be fine with offering a best effort support model, but legal certainly wouldn't.
  - HybridStatAnim8 4mo ago
    The funny thing is, nothing needs to be done to support GOS. GOS has 99% android app compatibility. The issue isnt that GOS requires changes in the app to support it, rather, the tools they are using explicitly ban non-certified OSs. Dont let their boilerplate responses fool you, tools like play integrity only serve to push anticompetitive practices. The claims about not being able to support GOS are nonsense, and all they did was break existing support.
warkdarrior 4mo ago
Answer from VW: > Please note that the use of the Volkswagen app is only supported on iOS devices and Android devices with supported operating system versions. Is it time to mandate app developers support all operating systems for a device?
- ranger_danger 4mo ago
  [flagged]
  - mschild 4mo ago
    Its not a different os though. Its still android. VW seems to just have turned on integrity checks which constantly cause issues for non-google androids. Plenty of banks do the same.
  - microtonal 4mo ago
    The app worked without issues until a few weeks ago. I used it for a year. It was not broken. GrapheneOS is just AOSP Android, optionally with Google Play Services. My take is that they were trying to block rooted phones and/or custom ROMs of questionable origin and GrapheneOS just became collateral damage because all these companies do go the minimal route of using Play Integrity. GrapheneOS supports remote attestation through AOSP APIs, in fact, they have a page about it. I think it's worth letting this be heard. GrapheneOS has > 400,000 users and is rapidly growing. Breaking things is not going to affect 5 people anymore, but thousands, ten thousands or hundreds of thousands, depending on what the app is.
    - Zak 4mo ago
      > My take is that they were trying to block rooted phones and/or custom ROMs of questionable origin There are only bad reasons for them to do that. End users don't get compromised that way in reality, but it does mean they might convince the app to do something that's bad for profits.
  - ryandrake 4mo ago
    > expensive to support "Support" is such an overloaded and vague word in the software industry. What does it mean for a company to "support" an app/os configuration? 1. They deliberately target that app/os configuration, QA tests it, and answer customer support requests about it. 2. They target the configuration, QA tests it, but it's offered without customer support. 3. They target the configuration, but only release an untested build, use at your own risk. 4. They don't target the configuration at all, but the builds they do release happen to work on the configuration, totally unacknowledged by the company. 5. They don't target the configuration, and deliberately sabotage their application such that un-targeted configurations are actively blocked. Only adversarial users who hack the software are able to use it. Too many companies say: "We can't do 1 because we don't 'support' it, therefore we must do 5!"
mohamedkoubaa 4mo ago
The solution is not to try to shame or force Volkswagen to support GrapheneOS, the solution is to (legally) force them to allow the car to run a custom CarOS, for which the community can write their own app
- ddalex 4mo ago
  Why should they ?! Do you also want to force them to design their cars so the engine is easily replaceable by a Custom Engine OS so that the community can build their own engines ?!?
  - DANmode 4mo ago
    Next thing you know these dirtbags are going to want to choose what wheels and tires to put on these things. The nerve! (Yes, repairability and standardization are encouraged where feasible.)
    - ddalex 4mo ago
      I would guess there are a couple of orders of magnitude difference between the complexity of interfaces comparing the head unit with wheels and tires. Like, the head unit is in control of all that happens on the slow bus of the car, and needs to pass independent safety certifications for a complex system.
      - DANmode 4mo ago
        I was replying to the bit on replacing the engine.
  - callc 4mo ago
    Because laws are (mostly) a reflection of what society wants. People are growingly concerned with both the car manu and Apple/Google control over their car and related extra software goodies. Laws are really needed when businesses don’t play nicely. I don’t know the legal specifics, but I’m sure glad I don’t need to buy $1000’s of specialty tools to maintain my vehicle, and sure glad that replacement parts are readily available (and will be for decades). Just image how much worse society would be if car manus did the same thing as Apple and had ID-paired parts. Sorry! Your AC doesn’t work anymore, please install a genuine Honda oil filter at your nearest Authorized Honda Shop, available for a minimum of $500.
9cb14c1ec0 4mo ago
Google Play has been a huge drag on innovation and security in the mobile ecosystem. I'm actually looking forward to the time when AI kills the mobile app ecosystem so that every phone manufacturer can bundle their own "vibe-code-your-own-app" system with their devices, and the Google Play monopoly is broken.
- miketery 4mo ago
  I don't think that will happen. Sure for a minority of users the same as people running linux for their daily driver, and I definitely support it! It's possible that we get to a place where everyone cooks their own meal (vibe coded app), and only goes out to eat sometimes (official app store). Spreadsheets are the same, you can get a lot of milage, and most still buy and use closed source software. Reminds me of this: https://www.robinsloan.com/notes/home-cooked-app/ https://www.robinsloan.com/notes/home-cooked-app/
- doublerabbit 4mo ago
  Let's rewind 15 years ago when everyone was jumping and praising mobile Eco-systems. Did no one ever see this happening or were most too gullible with Facebook hugs and pokes
  - wongarsu 4mo ago
    My recollection of HN 15 years ago includes a lot of annoyance with apps that could have been a website and how these walled gardens harm our freedom
    - doublerabbit 4mo ago
      Got my date wrong. What about twenty years ago?
      - applfanboysbgon 4mo ago
        In 2006, before Android, the iPhone, or app store existed? Were you even alive 20 years ago?
queeshonda 4mo ago
[dead]
AJRF 4mo ago
I don't know how large a group who will do this is - but if the UK bans VPNs I can see Graphene having a very large target on its back. - Buy Pixel, Get Graphene - Use FDroid, don't sign up for Google Play, download Tor browser - Censorship resistant access to the internet without handing over your ID. Pixel being a fairly popular phone in the UK is the interesting bit - if you had to buy some niche device I couldn't see it hitting more than a few hundred people doing it, but there are likely 100k pixels in the UK, and it's still possible to buy one and put Graphene on it. The squeeze on the free internet happened so quick by the UK (well it took years of indifference and a failure to enshrine protections - but once they started moving the did so super fast) Realistically we're speed running ID being tied to internet usage - create your escape hatch while you can!
- leoedin 4mo ago
  There must be 10s of millions of x86 PCs with unlocked bioses in the UK. The issue won't be running an open device. The problem is software - what does someone running Linux do if the government mandates online services require proprietary attestation APIs? It's scary how quickly the banning is moving. The problem is what happens next. When they realise that banning things doesn't really work. The next logical step is severely limiting internet traffic.
  - altairprime 4mo ago
    > what does someone running Linux do if the government mandates online services require proprietary attestation APIs? One dual-boots to a reputable Linux vendor’s signed/sealed OS image with secure boot enabled in BIOS, so that the attestations are valid; financially supports said vendor; contacts them quarterly with check-ins on the status of their lockdown+attestation roadmap and uses professional journalism approaches to highlight their (in/)action; and, contacts one’s relevant governing body to petition for the addition of that vendor’s signed/sealed product line to be added to the authorized signatures list by both government-sponsored apps and to the verification platforms of the competing vendors (in order to balance the necessities of attestations with an appropriate degree of anti-monopolistic protections for consumers). > It's scary how quickly the banning is moving. The problem is what happens next. When they realise that banning things doesn't really work This confidence that ‘attestation doesn’t really work’ is the same sort of confidence that lead the Linux user community to largely scoff at, and ignore, attestation’s threat from when it was ballistically launched three decades ago towards the future. Options are now very limited for stopping it, and largely reduced to ‘getting some Linux into the approval list’. Severe compromises in user freedom will be required for the signed+sealed distro images to receive government approvals. Imagine if Linux were an app on a video game console and you start to see the outcome: it’s a perfectly great working environment into which all of /usr/local and /opt and /home are writable, but the lockdown prevents you from modifying the OS in any way that could defeat the attestation protections. Apps you install into /opt can only access their own /opt/prefix, apps you install into /usr/local can access $HOME. The apps you install can choose to write session data (such as digital age verification certificates) to a system-protected /data store keyed first by the kernel’s signature, and second by the vendor signature the kernel reads from the app; with the understanding that an attestation latch-forward after an exploit patch will wipe that store, and that dual-booting to a different vendor will suspend access to sessions stored by that vendor. This is, to climb on my hobby horse for a moment, why I continue to believe that Valve will be the first Linux vendor to receive government attestation approval alongside Apple / Google / Microsoft have previously across the desktop and mobile spaces. I’d really prefer that to be Graphene, Ubuntu, and Valve — but Graphene’s customer base is hostile to this, Ubuntu doesn’t have any incentive to care, and of the Linux vendors out there, Valve has a decade-long head start on the need for a locked-down and attested platform for business reasons. All of the above falls out naturally from considering how to defend one app from another on Android, iOS, Steam Deck, and Xbox. So far as I can tell today, though, Linux intends to be left out in the cold on all this. Oh well.
aka13_404 4mo ago
This is sadly not even the full extent of it. What they did is, they locked their api entirely for anything that is not play protect certified. That means, all the cool stuff that was doable via community-driven projects is now dead in the water. The "app" they provide is 60% advertisement, 30% features, and I unironically preferred using a Home Assistant connection instead of of it for everything. Even for automations like "when to preheat the car", since that was easier and more intuitive outside of their native function. This also means, that charge control from the cars side is not possible to automate anymore. Sure, one could take the position "but it was never officially promised", but for some people, including me, having the api (which is paid btw) was a selling point. Yes, I registered specifically for this comment.
- subscribed 4mo ago
  I feel you. From my side I try to complain / rate / review every time, even if it's a low effort action, to cost them time and in the case of the regulated companies, to slightly worsen their complaint stats. There's enough of users to start making a difference. Really, even a low effort action raising valid concerns (security theater, a lie, google's monopolistic position, anti-competitive, etc), keywords that will make their response more careful and potential complaint to the regulator more impactful.
  - helterskelter 4mo ago
    Things like this can actually be a good way to nudge a company in the right direction sometimes. Nobody uses those internal review systems, and sometimes their stats are actually important. A handful of users might make up a really big chunk of the reviews. In a similar vein, I once met a woman who told me how she would enter every single one of those stupid contests that you'd see printed on cereal boxes and ice cream containers because literally five people enter into those things, so you're odds of winning are surprisingly high. Apparently she won a bunch of them, but her favorite was when got a week long vacation that included going on a fishing trip with Ben and Jerry of "Ben and Jerry's".
    - 4mo ago
prmoustache 4mo ago
VW blocking third party to access their servers is one thing, the thing that I find shocking is that you need to access VW servers to obtain your charging data while this should be directly available locally from the car.
- bri3d 4mo ago
  The historical data is aggregated in some "cloud" rather than in the car, but if you want to collect and aggregate the data locally, you can still, for now at least. Car Scanner Pro and ABRP (A Better Route Planner) are both really popular for EVs for this exact use case, and both support VW EVs; they read battery charge state / voltage / temperature and operating states (speed, consumption, etc) using both standard OBD and proprietary manufacturer diagnostic IDs over the OBD port and then redo the aggregation and math that VW are doing on their end.
  - m3galinux 4mo ago
    I've seen some great successes using HomeAssistant combined with one of these that connects your vehicle's various CANbuses (via OBD port) to Wifi/BLE. https://www.meatpi.com/products/wican https://www.meatpi.com/products/wican
jmward01 4mo ago
I want a law that requires publishing your API for apps like this as well as allowing users to crate their own frontend based on it. That would enable more privacy aware versions of these apps.
- bluGill 4mo ago
  https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty_Act https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty... from 1975, but is has more of what you were asking for than you might guess. And it was written about info-tainment systems (radios).
- varkokonyi 4mo ago
  [dead]
- surajrmal 4mo ago
  If you pay for the privilege of using the app, that makes sense. I can't imagine such a law would ever be made for free apps as controlling the client experience is key for enabling them to offer it for free. The reason free apps often don't have a paid tier is because the folks who would pay for it are often the key demographic they need to not pay for the entire thing to be profitable for subsidizing the less desirable demographics. I'm not trying to suggest that these sorts of things should be this way, but if there is a server involved in the economics of maintaining that endpoint come into play and can't be ignored. Ideally things were federated and you could point your car or whatever device at and endpoint you maintain, but that comes at a cost as well as maintaining software where both client and server are controlled by the same party is an order of magnitude easier than cases where they aren't the same.
- studog 4mo ago
  https://www.stopkillinggames.com/en https://www.stopkillinggames.com/en
afarah1 4mo ago
Driving a rental car in Germany almost makes me cheer for the ongoing bankruptcy of their auto industry. It really needs a full reset at this point. Sad thing is EU law mandates for a modem in the car as well as intrusive driving aids that actually make driving less safe by constantly driving your attention away from the road[1]. So there is no hope to get a minimally decent car in Europe in the near future, unless a wider reset also happens at the political and social level. [1] https://www.youtube.com/watch?v=f-S76WEl25k https://www.youtube.com/watch?v=f-S76WEl25k
- techpression 4mo ago
  Whoever came up with the idea that the car should beep loudly even close to the speed limit has clearly never driven a car. The best way to silence it is to constantly be over the speed limit or well below.
  - lnsru 4mo ago
    This thing makes me crazy. But I can somehow ignore my Skoda’s whining. The other car was bought months before this regulation happened and I will keep it as long as I can.
  - iroddis 4mo ago
    Probably made worse by the fact that _every_ VW brand car I’ve driven has read about 10% high on the speedometer. I think I’m going 100 kph, but timing using the km markers on the highway show I’m going about 90. When I talked to the dealers, they said that the speedometers only have to be accurate +/- 10% according to the SAE specifications. After DieselGate I assumed that the high reading was to game the fuel consumption game. Never again, VW auto group…
    - storus 4mo ago
      Just use the speed reported by your GPS. Most navigation apps show the GPS-based speed.
      - 4mo ago
jqpabc123 4mo ago
Easy fix --- block VW from your car ownership.
- okanat 4mo ago
  Well you'll end up blocking all car ownership. Markets do not care about individuals.
  - nicce 4mo ago
    > Markets do not care about individuals. If most would do this, they are not individuals anymore.
- dredmorbius 4mo ago
  Marketing-it-harder has some effect, but it's limited. If a monopolist can insist on terms (e.g., Amazon mandating lowest price guarantees from sellers, or Google mandating auth / compliance / KYC exclusivity to Google Play Services privileged devices by app devs), then threats to the compelled party (sellers, app devs) will be minimally effective. Class action lawsuits, regulation, and legislation, are required for effective relief.
stymaar 4mo ago
I hate that cars are every day more and more crammed with software, when car manufacturers can't seem to be able to make half-working code in the first place (looking at you Nissan, who just can't even put the correct timestamp on your GPS data points…)
- techdmn 4mo ago
  My car won't let me flick the windshield wipers while the car is parked. I don't know why, maybe they think I'm throwing rain onto... already wet pedestrians? Similar problem with auto-folding mirrors. My mirror was frozen shut one day, and I didn't notice until I'd been driving for a few blocks (which is on me). Figured I'd just cycle the fold-unfold a few times to pop it free, but the button is disabled when the car is in motion. Increasingly my vision of retirement is a life of luxury surrounded by hardware from before the internet era, things that do what I tell them, rather than telling me what I am and am not allowed to do.
  - buggeryorkshire 4mo ago
    [dead]
  - bluGill 4mo ago
    I'm filling my shop with machining equipment without all the extras, but my first 6 years of retirement will be fixing those machines before I can make anything... (and family history doesn't give me good odds of living that long - which is average.)
- quickthrowman 4mo ago
  > when car manufacturers can't seem to be able to make half-working code in the first place (looking at you Nissan, who just can't even put the correct timestamp on your GPS data when car manufacturers can't seem to be able to make half-working code in the first place (looking at you Nissan, who just can't even put the correct timestamp on your GPS data points…) Nissan sells a ton of cars to subprime borrowers, quality isn’t exactly their focus. Hyundai/Kia and Stellantis also target the same buyers.
LostMyLogin 4mo ago
Side note. Has anyone else noticed an uptick in GrapheneOS posts lately or am I crazy?
- qrobit 4mo ago
  Sort of, there're more posts about graphene in the year 2026 & they get much more attention. Aggregated some data and plotted it with my agent: https://boop.icu/Pr.png https://boop.icu/Pr.png
  - ysnp 4mo ago
    Can you add CopperheadOS data 2014-2018 and AndroidHardening Project from 2018-2019?
- Viability1936 4mo ago
  Probably because it's quickly becoming the only reasonable option on mobile
- HybridStatAnim8 4mo ago
  GrapheneOS has an official partnership with a large OEM (Motorola), has near perfect app compatibility, is constantly improving upon user experience, and has been well known and regarded in the privsec community and by many trusted security experts. It appears to be gaining more mainstream awareness as a result. Oh, and Android 17 has been released so there is hype for that.
- arrowsmith 4mo ago
  The UK government has just create an upsurge of interest in digital privacy, so that might be why
jasonvorhe 4mo ago
It's not your car anymore, you're just renting someone else's hardware and access to their restricted platforms. Some recent cars even deny starting your car engine if the always on camera facing the driver thinks the driver isn't capable of driving "safely". This is the WEF future your conspiracy uncle was telling you about during family gatherings. Well.
- lenkite 4mo ago
  The conspiracy uncle was right after all. "You will own nothing and be happy" - WEF Prime Objective.
  - akimbostrawman 4mo ago
    The difference between conspiracy theory and established fact are 10 years time.
moooo99 4mo ago
It is amazing how Volkswagen keeps messing up. I am currently in the market for a new car, an EV specifically. Volkswagen brands were at the top of my list for many reasons, among them the excellent driving assist implementation. I got an offer from a dealer three weeks ago and was going to order the car, then the API for the community integration got turned off. I decided to hold back and see what comes from it. Now this, which ultimately - since I am a GrapheneOS user - makes me completely cancel my plans. I really do not understand VWs thinking here. It would cost them little to nothing to continue not blocking the the inofficial API and not block GrapheneOS (or other non Play Protect androids) users. It would have no adverse effects on the average Joe, but it would gain a lot of support and enthusiasm from heavy users, differentiating from other brands. Not to mention the fact that it is the USERS data in the first place
- OsrsNeedsf2P 4mo ago
  VW is obviously not thinking that any noticable portion of the userbase uses Graphene, and someone (somewhere) is going to get a promo by making VW infra adhere to "standards" or something
  - echelon 4mo ago
    I don't use Graphene, but now I'm out of the market for a VW. Vendor lock-in to Play services is ridiculous. A car is a big purchase, and ideally not something I discard after a few years. I'd like it to not treat me like a second-class citizen and renter who can't make decisions over how to extend the life of my purchase.
    - zamadatix 4mo ago
      It's ridiculous, but are we only saying that because we're on HN or is it because the portion of the userbase who thinks it's actually a bad thing is the larger one?
      - tarxvf 4mo ago
        Who cares if it's the larger one, so long as they are the correct one?
izacus 4mo ago
I'm glad the grapheneos support forum is proving very useful with "Why do you need a car app?" comment being highlighted by this link :D
minraws 4mo ago
I am in market for a Car within a year or two, and I promise it won't be one from Volkswagen, if a company supports OSS platforms in cars and is available in APAC I will buy from them even if it costs 2x for the same specs (preferably a Hybrid but EV works too I guess). Happy voting with your wallet folks. See ya.
kyledrake 4mo ago
I had a used 2016 VW Golf and it was a lemon. It would have an average of one serious problem a month. I finally gave up being a professional car maintainer and dumped it, taking a huge loss because it was effectively worthless on the car market despite only being 8 years old. Fun car to drive, but what's the point if it doesn't work reliably? I completely lost my trust for VW vehicles after that. Not surprising to me at all that their software is a similar high quality experience, but in general I think it's weird that cars have to be connected to the Internet anyways and I doubt the competition is substantially better.
- nosioptar 4mo ago
  Only one major problem per month sounds like you got one of the good ones. I've had VWs where the center console catches on fire whenever you turn on an indicator. (The obvious answer was to stick on some BMW badges so no one expects me to use indicators.)
monomial 4mo ago
Modern cars are such enshittified garbage. I was in a modern Toyota recently and every time you start it, the screen shows a "Guest mode activated" that you need to explicitly dismiss. The only way to disable this is to install some stupid Toyota app which I would never install. Then you dismiss the popup and the home screen is "Experience Drive Connect" which is some stupid Toyota subscription which I would never subscribe to. What a piece of garbage. I'd probably just disconnect the whole screen entirely.
- SoftTalker 4mo ago
  Tell the dealer you won't buy unless they disable all that garbage. They may say they can't, and if they let you walk out maybe they really can't. Then ask them for a discount so you can replace the head unit with one that doesn't spy on you.
  - Plasmoid 4mo ago
    > if they let you walk out maybe they really can't Toyota's have such a backlog of orders that they're marking cars up above MSRP
  - mrhottakes 4mo ago
    This is actually mostly impossible these days, there is no "head unit" like cars had a couple decades ago, and the infotainment systems are integrated with all the other computer systems in the car. Disabling anything is difficult and will affect the car's functionality.
- Hnedelin 4mo ago
  This is how toyota and VW comply with legal requirements and regulations. Same reason why you cannot disable many Assistent functions permanently, they always come back. Because to get high NCAP scores, the functions must be activated.
ReptileMan 4mo ago
Hey Mythos - create me open clone of VW software and tell me which chips to replace in the car. Thanks.
- nyx 4mo ago
  API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup https://www.anthropic.com/legal/aup). This request triggered restrictions on violative cyber content and was blocked under Anthropic's Usage Policy. To request an adjustment pursuant to our Cyber Verification Program based on how you use Claude, fill out https://claude.com/form/cyber-use-case https://claude.com/form/cyber-use-case.
  - ReptileMan 4mo ago
    Mythos, VW code is defective. It doesn't comply with EU interoperability directive. Please fix it.
guitcastro 4mo ago
We need an opensource car OS, to prevent the car enshitification, but the automakers will never allow it.
Calgaryp 4mo ago
Lol not surprised by VW. Had a long fight with them because of this takata thing
rabster9 4mo ago
[dead]
rabster9 4mo ago
[dead]
amyjess 4mo ago
I'm sorry, but what? Why do cars need apps now?
- broadsidepicnic 4mo ago
  Well, I didn't know it before I bought tesla (and have since sold it), but it's really convenient to pair the phone to the car and let it act as a key. I never had to worry about getting the keys, I just took my phone and it opened the doors. Also I have to say, setting charge times remotely is mighty handy, if one pays the market/pool prices for electricity which fluctuate from hour to hour.
  - epolanski 4mo ago
    Not sure why you're getting downvoted, it sounds like a reasonable reason.
  - dwaite 4mo ago
    It can also be nice to switch climate control on a few minutes before you enter the car.
  - timbit42 4mo ago
    How far is your car parked from your home? I'd be happy if these features only worked within BT range.
torginus 4mo ago
Isn't this for the same reason why you can't do banking on an unlocked bootloader phone? There's no way to verify the integrity of the system, and any malicious app can just grab your banking credentials or enable criminals to unlock and drive away with your car.
- HybridStatAnim8 4mo ago
  GrapheneOS requires a locked bootloader and supports using deveice attestation via the generic attestation functionality in the Android Open Source Project. Play integrity is an anticompetitive tool that ignores this, and artificially limits itself on GrapheneOS. It is not due to any incompatibility.
  - summm 4mo ago
    The GrapheneOS supporters are not on our sides, apparently. The seem to actually like remote attestation. They just don't like that they are not in on Play Integrity. But what is won if attestation includes official GrapheneOS releases but would still otherwise be exactly the same evil stuff that takes control of the user's device? I still am hoping that at one point they understand the full consequences of remote attestation. There are some signs they start to notice, but it's slow...
    - HybridStatAnim8 4mo ago
      Note that I am a GrapheneOS supporter. You seem to have a few misconceptions. GrapheneOS is one of, if not the most vocal organization against the abuse of attestation mechanisms. GrapheneOS and its userbase feel the consequences of play integrity every single day. Im not sure where you got the idea that all GrapheneOS wants is to be accepted by play integrity, because that is not the case. GrapheneOS has been working with regulators to get play integrity banned. Being accepted by play integrity, but nothing else changing, is not good enough for GrapheneOS. It would only be a small victory along the path of abolishing this nonsense. So, no, GrapheneOS and its community are definitely against play integrity. The "signs" that they are "starting to notice" are not there. They are already fully aware of what attestation is and how it can be abused. They are definitely not ignorant on the subject. You might be confusing root based attestation with pinned attestation. Root based attestation is flimsy and allows tools like play integrity to ban operating systems they do not like. Pinned attestation, on the other hand, has real security properties and cannot be abused to block certain operating systems. GrapheneOS uses pinned attestation as a part of their Auditor app, and it has other cool uses we could see in the future.
MeneDev 4mo ago
I am not a lawyer, but this is clearly illegal under EU law. As a EU citizen, please sign this petition https://www.change.org/p/eu-data-act-durchsetzen-autohersteller-m%C3%BCssen-uns-zugang-zu-unseren-fahrzeugdaten-geben https://www.change.org/p/eu-data-act-durchsetzen-autoherstel...
shevy-java 4mo ago
I am annoyed that the EU allows this in the first place, that car manufacturers sniff off data from people. And, on top of that, block open source alternatives. To me this smells like a cartel. Why is the EU not doing anything?
- teamonkey 4mo ago
  It is. There are incoming EU regulations about consumers needing free access to their data that is sent to a cloud server on their behalf. That doesn’t mean all the functionality of an app needs to be implemented. My feeling is that this change plus the recent API lock for a few days ago are in fact part of a reworking to enable this EU legislation.
neilv 4mo ago
> In my opinion, the most useful next step is to contact Volkswagen support in a coordinated and technically precise way [...] Smartphone: Google Pixel Operating system: GrapheneOS I strongly recommend saying that the operating system is one of "Android" (there are many variants), "Android (GrapheneOS)", or "GrapheneOS Android". But if you say only "GrapheneOS", you are practically telling VW to respond that they do not support that operating system.
padjo 4mo ago
Yep same thing on /e/os guess I'll never be buying another VW. Well done guys.
pmontra 4mo ago
My 2016 car has the old version of Android auto. My phone has the new one, I think from 2019 or 2020. They are incompatible. Did I miss something by not integrating my phone with my car? I don't think so. I call with Bluetooth and navigate with the screen of the phone. The only thing I'm using is the mic and speaker of the car. The mic is probably substantially better than any earpiece I could buy, because I suspect that it's designed to filter out noises from the car and from the road.
- Terr_ 4mo ago
  > My 2016 car has the old version of Android auto. I don't know if an AAWireless adapter might operate in a way that could bridge that compatibility gap, but it might be worth a shot if you can borrow one to try it out. I've been decently happy with it in a ~2020 car. Compared to a direct USB connection, there are some privacy implications with how it's running a low-power access point in the car, but bluetooth etc. are already a risk there. > Did I miss something by not integrating my phone with my car? I don't think so. I call with Bluetooth and navigate with the screen of the phone. For me the the main feature for Android Auto (over just a bluetooth connection) is navigation on the car's larger touchscreen that already has a good fixed position.
- Gigachad 4mo ago
  That's the thing that gets me about all this car tech. The actual car will last far longer than the tech stuff will be supported. I suspect it's done intentionally to help phase out old cars faster by making them less functional. I've begun rejecting any hardware that depends on some kind of external service. I won't buy anything that requires an app or a remote server anymore because they always kill the app long before the hardware is dead.
  - pmontra 4mo ago
    Yes, but my car is at 140k km and sooner or later I'll have to buy a new one. It's simply not possible to live without a car in the place where I live. Well, I could do like people did before cars, spend their lives in the 5 km around their homes. Very few shops, no hospitals in that radius. A lot of sunflowers in the right period of the year though. So, I'll look for the least worst car. Luckily it will likely be one of the cheapest ones.
innocentoldguy 4mo ago
I was going to trade in an old truck and buy my daughter a Tiguan this weekend. I guess I’ll rethink that.
teekert 4mo ago
I got an iPad as backup with my 2fa stuff, and so I can keep an eye on kids in Apple ecosystem. When my iPhone mini does I'll go for /e/OS or GrapheneOS. And then I'll have the iPad lying at home for all the shenanigans that are nice but I don't even really need. My phone must serve me.
- Cider9986 4mo ago
  I would recommend Grapheneos over e because it has much better support and is a different class of privacy and security.
  - teekert 4mo ago
    Hmm yeah but I’m really eyeballing a FairPhone atm.
bilsbie 4mo ago
Tangentially speaking what are the downsides to running graphene?
- estebank 4mo ago
  The things I've found: - RCS doesn't work at all on non-Owner accounts, switching to the owner account is necessary to receive them (I use a secondary account for my "main" account, the owner is left empty except for a Google Fi associated account) - Immediate auto-update can cause phone to turn off and not turn on overnight (you can change the setting) - Google Wallet won't work for payments (in Europe you can instead use Curve) - The default AOSP app selection is in general worse than the Google provided ones (you can install them, after installing Google Play Services, which is sandboxed) - Getting Google Fi to work required some fiddling initially, pretty sure it was because of my use of the non-Owner account - Some banking apps will refuse to work (mine work fine) - You can get Android Auto working, but by default so many things are sandboxed that applications and TTS won't show up unless you spend the time enabling permissions Overall I am happy with it. It does feel a bit less polished than stock Android (because of the interaction of apps and more strict sandboxing), but for most people who don't care about Google Wallet and are ok installing Play Services and any necessary Google apps, the experience feels pretty much like a de-Gemini'd/de-bloated Android.
- lawn 4mo ago
  A few apps won't work. It's not as customizable as Samsung for instance. It only runs on Pixel phones (next year hopefully some Motorola phones).
joemazerino 4mo ago
Yeah this has less to do with VW and GrapheneOS and more to do with Google Play's attestation. Many apps don't work with sandboxed GMS/microG currently and more will come as we get closer to a locked down version of Google's Android.
- HybridStatAnim8 4mo ago
  GrapheneOS has 99% app compatibility with sandboxed google play. Apps do not have issues with sandboxed google play at this time.
  - joemazerino 4mo ago
    When is the last time you tried the MyQ garage opener app?
CafeRacer 4mo ago
I am confused here... this is the car, that person buys and person owns. It is used to haul said user's butt from point A to point B. (a) like wtf? (b) what is it about these companies that want to commoditize everything?
- mrhottakes 4mo ago
  > What is it about these companies that want to commoditize everything? A German philosopher had a lot to say about this a couple hundred years ago... I think his name was Karl.
z3ratul163071 4mo ago
what a stupid thing to do. actually i did not have high expectations from them anyway.
jsiepkes 4mo ago
If this is a deal breaker, then you want to avoid KIA. The KIA connect app also doesn't work on GrapheneOS due to the use of NSHC DxShield [1]. [1] https://en.nshc.net/ https://en.nshc.net/
- jsiepkes 4mo ago
  UPDATE 25-06-2026: The Kia app started working again on GrapheneOS.
xbar 4mo ago
I wonder if all VW brands will follow this path.
t1234s 4mo ago
I noticed after the recent GOS update Uber would crash continuously.
h4kunamata 4mo ago
VW won't be missed! Cars weren't meant to be computers on wheel. I bought a 2025 Suzuki because it is a manual and there is no firmware update, no internet connection, GOS Android Auto is all I get and only if my phone connects with the car. It is so weird how companies in 2026 still making such bad mistakes.
- microtonal 4mo ago
  Connected cars can be convenient though. E.g. when doing larger trips, we usually take a break when we need to charge (get some tea, food, etc.) and it's really handy to get a notification when the car is done charging. Also in the heat of the summer, it's nice to be able to start the air conditioning a few minutes before leaving.
- otsukare 4mo ago
  I've used a 2023 Suzuki S-Cross (manual fwiw) and this doesn't match my experience. Which model are you using? They have an app [0] (which doesn't sync correctly for me, and their support is awful). When working it shows things like where you last parked, fuel efficiency, and allows you to remotely lock the vehicle, so it has internet access. I sent Suzuki a Subject Access Request as a workaround to gain access to the data, and received months of extremely accurate location, speed, etc data. There are also software updates, you just have to do them yourself [1]. They also didn't work for me. Software aside however, they are extremely reliable cars, most of which seems down to their simplicity. [0]: https://play.google.com/store/apps/details?id=suzuki.app.a025.SzkCnnctEur https://play.google.com/store/apps/details?id=suzuki.app.a02... [1]: https://www.infotainment-system.com/en/device/summary https://www.infotainment-system.com/en/device/summary
sasaf5 4mo ago
Bolt a magnet mount on the dashboard. Slap your phone.
Grimeton 4mo ago
It's not VW. It's Google doing this in the end.
- mrweasel 4mo ago
  The GrapheneOS users are understandably upset, but yes, this doesn't seem like an update targeted at blocking GrapheneOS or /e/OS. It's Volkswagen updating their app and using newer APIs. Technically they are probably doing "the correct" thing in terms of how Google suggests that you develop for the PlayStore API and that blocks alternative operating systems. It still sucks, but what are they suppose to do, not use the "safer" API and risk getting told that they don't care about security? And for what, pleasing a very small minority of users? There could be some branding value in targeting more technical users and have them act as brand ambassadors, but for a car I doubt that's worth much.
jdw64 4mo ago
Because I frequently supply to the automotive industry, I fully understand all these issues. No matter how good many open source projects are, companies always have to face lawsuits and liability. That is why, no matter how good Linux servers are, factories use Microsoft servers. Regarding the responsibility for that software, if a problem occurs, the company that signed the contract takes on the liability. Ultimately, they shift the security responsibility to Google. It is unfortunate for open source enthusiasts, but if they do not restrict open source and an accident happens, the possibility of a lawsuit being filed against Volkswagen would be the real problem.
- Cider9986 4mo ago
  Grapheneos is compatible with over 99% of android apps. The only apps that don't work either actively block Grapheneos or have bugs caught by Grapheneos exploit protections which can be disabled. You don't have to do anything extra to support Grapheneos, just don't add in attestation which does nothing for security and limits user freedom. This is fundamentally different from not choosing to use Linux servers. It's more similar to not letting a customer enter your store because of the color of their skin saying they aren't regular humans. It's pure discrimination because just as the functionality of android doesn't depend on these extra checks, the customer works the same regardless of how they look. I have 38 apps on my GOS phone and none have had any issues.
  - jdw64 4mo ago
    GOS may be much more technologically advanced and secure than Android. But that doesn't mean it has official safety certifications that can be submitted to courts and insurance companies in the event of an accident. Because GOS cannot pass hardware-based keystore authentication. I generally think open source is often better. The problem is that there is no entity to take responsibility.
    - Cider9986 4mo ago
      There are banks that officially support Grapheneos through their hardware attestation. Android has an open and secure attestation, but Google pushes play integrity because it enables their monopoly. Companies making apps aren't exposed to these alternatives because of Google's power so that's what they choose, it's not because of security.
sandworm101 4mo ago
I am split. I am a grapheneOS user, been so for several years now. So i am mad. But i also see no reason why i would want my phone to pair/connect/share/mate with my car's OS. So a car that actively ignores my phone? That may be a good thing.
RachelF 4mo ago
Microsoft is also doing this, Microsoft Authenticator, no longer works under GrapheneOS for corporate creds, and coming in July they will delete any Entra-related IDs from your phone. https://www.theregister.com/on-prem/2026/03/10/microsoft-tightens-authenticator-checks-on-android-and-ios/5224719 https://www.theregister.com/on-prem/2026/03/10/microsoft-tig...
bjackman 4mo ago
I have no plans to buy a car but I'm curious: what is the sensible choice for technical people with a reasonable amount of money? I rent cars whenever I travel to the US and I've never not been pissed off by a car's software. If you live in a country that makes it practica/affordable and you don't need too much range, I wonder if buying an old car with a broken engine and paying someone to do an electric conversion is a good choice? Or maybe generally just buy a ~10 year old car, find a mechanic and say "I want this car to last a really long time, if we can build a trust relationship I will spend a lot of money in your business" and just budget for extensive proactive maintenance? Maybe with this approach you can still save money relative to a new car? Or, is it possible to buy a newish car and then just rip out and completely replace the infotainment/climate control/etc while still keeping stuff like the parking cameras working?
- jesterson 4mo ago
  > I'm curious: what is the sensible choice for technical people with a reasonable amount of money? I am probably the extreme minority, but I prefer cars with as little "tech" as possible. I don't need "drive assist" and sorts. All my cars are 10+ old benzes, Nissans, Toyotas. All under good maintenance routine so giving me very little headache. I had all sorts of stupid issues with modern cars while renting. One toyota scared the crap out of me while it imagined some pedestrian and yelled with all signs while I was going 100+ km/h on highway. Horrible crap
  - bjackman 4mo ago
    The "driving" tech I want in my car is: - Cruise control. - Camera for parking. I guess sensors too. These are just unbelievaly useful IMO, it makes parking trivial in cases that used to require quite intense focus. I see the appeal of fully automated parking, but with cameras and a car that you have lots of experience parking I think I am fine Austin-Powers-ing into any space that the car physically fits into. - I guess, maybe, I kinda like the thing where it automatically watches your blindspot and has a little orange light to remind you that there's a car there. I dunno, when did cars get all that stuff? (Cruise control was basically universal in the US before I was even born I think, but not sure when the others showed up). But then there's some non-driving tech that I do want: - Completely frictionless navigation and media control. Android Auto just seems to be fucking nonfunctional so I think maybe what I want here is actually just a Qi mount and a reliable bluetooth controller? - I've never had it but I bet remote climate control is really nice (warm up the wheel 5 mins before you set off on a frozen morning / turn on the AC 2 mins before you get into a car that you couldn't park in the shade).
Dead_Lemon 4mo ago
VW needs to go back to building simple, reasonably priced cars that are easy to service. Chasing the premium/luxury car brands, while they own both premium and luxury brands, is doing them in.
angry_octet 4mo ago
Some idiot drew the security boundary around all code delivered by VW, instead of around the car and it's supply chain. It's analogous to believing they could manage the road the car is driven on (something that Tesla seems to believe). The liability culture at companies like VW is delusional, and they are deeply uncomfortable with software. They are suffer from individual departments and groups having individual authority and no drive to collaborate. Hence schizophrenic policies.
meatjuice 4mo ago
>>> never_buy ["tesla"] >>> never_buy.append("volkswagen")

786 points by microtonal 4mo ago

aljgz 4mo ago

I might be soon moving to Europe and would need to get a new car, replacing my (mostly) beloved Toyota bz4x. Well I guess VW is out.

left-struck 4mo ago
Buy a used car from a few years ago… do some research and make sure it doesn’t have anti features. This is the only option until manufacturers stop this crap

queeshonda 4mo ago

[dead]

warkdarrior 4mo ago
That's a starting point, but it seems the VW app is using a Google SDK for integrity checks, so maybe we need certain SDKs to be banned.
arkon_hn 4mo ago
Supporting mainstream OEM variants can already be enough of a nightmare in behavioural differences. What motivation do most companies have to support Graphene, which will be a handful of customers at best? Developers may be fine with offering a best effort support model, but legal certainly wouldn't.
- HybridStatAnim8 4mo ago
  The funny thing is, nothing needs to be done to support GOS. GOS has 99% android app compatibility. The issue isnt that GOS requires changes in the app to support it, rather, the tools they are using explicitly ban non-certified OSs. Dont let their boilerplate responses fool you, tools like play integrity only serve to push anticompetitive practices. The claims about not being able to support GOS are nonsense, and all they did was break existing support.

warkdarrior 4mo ago

Answer from VW: > Please note that the use of the Volkswagen app is only supported on iOS devices and Android devices with supported operating system versions. Is it time to mandate app developers support all operating systems for a device?

ranger_danger 4mo ago
[flagged]
- mschild 4mo ago
  Its not a different os though. Its still android. VW seems to just have turned on integrity checks which constantly cause issues for non-google androids. Plenty of banks do the same.
- microtonal 4mo ago
  The app worked without issues until a few weeks ago. I used it for a year. It was not broken. GrapheneOS is just AOSP Android, optionally with Google Play Services. My take is that they were trying to block rooted phones and/or custom ROMs of questionable origin and GrapheneOS just became collateral damage because all these companies do go the minimal route of using Play Integrity. GrapheneOS supports remote attestation through AOSP APIs, in fact, they have a page about it. I think it's worth letting this be heard. GrapheneOS has > 400,000 users and is rapidly growing. Breaking things is not going to affect 5 people anymore, but thousands, ten thousands or hundreds of thousands, depending on what the app is.
  - Zak 4mo ago
    > My take is that they were trying to block rooted phones and/or custom ROMs of questionable origin There are only bad reasons for them to do that. End users don't get compromised that way in reality, but it does mean they might convince the app to do something that's bad for profits.
- ryandrake 4mo ago
  > expensive to support "Support" is such an overloaded and vague word in the software industry. What does it mean for a company to "support" an app/os configuration? 1. They deliberately target that app/os configuration, QA tests it, and answer customer support requests about it. 2. They target the configuration, QA tests it, but it's offered without customer support. 3. They target the configuration, but only release an untested build, use at your own risk. 4. They don't target the configuration at all, but the builds they do release happen to work on the configuration, totally unacknowledged by the company. 5. They don't target the configuration, and deliberately sabotage their application such that un-targeted configurations are actively blocked. Only adversarial users who hack the software are able to use it. Too many companies say: "We can't do 1 because we don't 'support' it, therefore we must do 5!"

mohamedkoubaa 4mo ago

The solution is not to try to shame or force Volkswagen to support GrapheneOS, the solution is to (legally) force them to allow the car to run a custom CarOS, for which the community can write their own app

ddalex 4mo ago
Why should they ?! Do you also want to force them to design their cars so the engine is easily replaceable by a Custom Engine OS so that the community can build their own engines ?!?
- DANmode 4mo ago
  Next thing you know these dirtbags are going to want to choose what wheels and tires to put on these things. The nerve! (Yes, repairability and standardization are encouraged where feasible.)
  - ddalex 4mo ago
    I would guess there are a couple of orders of magnitude difference between the complexity of interfaces comparing the head unit with wheels and tires. Like, the head unit is in control of all that happens on the slow bus of the car, and needs to pass independent safety certifications for a complex system.
    - DANmode 4mo ago
      I was replying to the bit on replacing the engine.
- callc 4mo ago
  Because laws are (mostly) a reflection of what society wants. People are growingly concerned with both the car manu and Apple/Google control over their car and related extra software goodies. Laws are really needed when businesses don’t play nicely. I don’t know the legal specifics, but I’m sure glad I don’t need to buy $1000’s of specialty tools to maintain my vehicle, and sure glad that replacement parts are readily available (and will be for decades). Just image how much worse society would be if car manus did the same thing as Apple and had ID-paired parts. Sorry! Your AC doesn’t work anymore, please install a genuine Honda oil filter at your nearest Authorized Honda Shop, available for a minimum of $500.

9cb14c1ec0 4mo ago

Google Play has been a huge drag on innovation and security in the mobile ecosystem. I'm actually looking forward to the time when AI kills the mobile app ecosystem so that every phone manufacturer can bundle their own "vibe-code-your-own-app" system with their devices, and the Google Play monopoly is broken.

miketery 4mo ago
I don't think that will happen. Sure for a minority of users the same as people running linux for their daily driver, and I definitely support it! It's possible that we get to a place where everyone cooks their own meal (vibe coded app), and only goes out to eat sometimes (official app store). Spreadsheets are the same, you can get a lot of milage, and most still buy and use closed source software. Reminds me of this: https://www.robinsloan.com/notes/home-cooked-app/ https://www.robinsloan.com/notes/home-cooked-app/
doublerabbit 4mo ago
Let's rewind 15 years ago when everyone was jumping and praising mobile Eco-systems. Did no one ever see this happening or were most too gullible with Facebook hugs and pokes
- wongarsu 4mo ago
  My recollection of HN 15 years ago includes a lot of annoyance with apps that could have been a website and how these walled gardens harm our freedom
  - doublerabbit 4mo ago
    Got my date wrong. What about twenty years ago?
    - applfanboysbgon 4mo ago
      In 2006, before Android, the iPhone, or app store existed? Were you even alive 20 years ago?

queeshonda 4mo ago

[dead]

AJRF 4mo ago

I don't know how large a group who will do this is - but if the UK bans VPNs I can see Graphene having a very large target on its back. - Buy Pixel, Get Graphene - Use FDroid, don't sign up for Google Play, download Tor browser - Censorship resistant access to the internet without handing over your ID. Pixel being a fairly popular phone in the UK is the interesting bit - if you had to buy some niche device I couldn't see it hitting more than a few hundred people doing it, but there are likely 100k pixels in the UK, and it's still possible to buy one and put Graphene on it. The squeeze on the free internet happened so quick by the UK (well it took years of indifference and a failure to enshrine protections - but once they started moving the did so super fast) Realistically we're speed running ID being tied to internet usage - create your escape hatch while you can!

leoedin 4mo ago
There must be 10s of millions of x86 PCs with unlocked bioses in the UK. The issue won't be running an open device. The problem is software - what does someone running Linux do if the government mandates online services require proprietary attestation APIs? It's scary how quickly the banning is moving. The problem is what happens next. When they realise that banning things doesn't really work. The next logical step is severely limiting internet traffic.
- altairprime 4mo ago
  > what does someone running Linux do if the government mandates online services require proprietary attestation APIs? One dual-boots to a reputable Linux vendor’s signed/sealed OS image with secure boot enabled in BIOS, so that the attestations are valid; financially supports said vendor; contacts them quarterly with check-ins on the status of their lockdown+attestation roadmap and uses professional journalism approaches to highlight their (in/)action; and, contacts one’s relevant governing body to petition for the addition of that vendor’s signed/sealed product line to be added to the authorized signatures list by both government-sponsored apps and to the verification platforms of the competing vendors (in order to balance the necessities of attestations with an appropriate degree of anti-monopolistic protections for consumers). > It's scary how quickly the banning is moving. The problem is what happens next. When they realise that banning things doesn't really work This confidence that ‘attestation doesn’t really work’ is the same sort of confidence that lead the Linux user community to largely scoff at, and ignore, attestation’s threat from when it was ballistically launched three decades ago towards the future. Options are now very limited for stopping it, and largely reduced to ‘getting some Linux into the approval list’. Severe compromises in user freedom will be required for the signed+sealed distro images to receive government approvals. Imagine if Linux were an app on a video game console and you start to see the outcome: it’s a perfectly great working environment into which all of /usr/local and /opt and /home are writable, but the lockdown prevents you from modifying the OS in any way that could defeat the attestation protections. Apps you install into /opt can only access their own /opt/prefix, apps you install into /usr/local can access $HOME. The apps you install can choose to write session data (such as digital age verification certificates) to a system-protected /data store keyed first by the kernel’s signature, and second by the vendor signature the kernel reads from the app; with the understanding that an attestation latch-forward after an exploit patch will wipe that store, and that dual-booting to a different vendor will suspend access to sessions stored by that vendor. This is, to climb on my hobby horse for a moment, why I continue to believe that Valve will be the first Linux vendor to receive government attestation approval alongside Apple / Google / Microsoft have previously across the desktop and mobile spaces. I’d really prefer that to be Graphene, Ubuntu, and Valve — but Graphene’s customer base is hostile to this, Ubuntu doesn’t have any incentive to care, and of the Linux vendors out there, Valve has a decade-long head start on the need for a locked-down and attested platform for business reasons. All of the above falls out naturally from considering how to defend one app from another on Android, iOS, Steam Deck, and Xbox. So far as I can tell today, though, Linux intends to be left out in the cold on all this. Oh well.

aka13_404 4mo ago

This is sadly not even the full extent of it. What they did is, they locked their api entirely for anything that is not play protect certified. That means, all the cool stuff that was doable via community-driven projects is now dead in the water. The "app" they provide is 60% advertisement, 30% features, and I unironically preferred using a Home Assistant connection instead of of it for everything. Even for automations like "when to preheat the car", since that was easier and more intuitive outside of their native function. This also means, that charge control from the cars side is not possible to automate anymore. Sure, one could take the position "but it was never officially promised", but for some people, including me, having the api (which is paid btw) was a selling point. Yes, I registered specifically for this comment.

subscribed 4mo ago
I feel you. From my side I try to complain / rate / review every time, even if it's a low effort action, to cost them time and in the case of the regulated companies, to slightly worsen their complaint stats. There's enough of users to start making a difference. Really, even a low effort action raising valid concerns (security theater, a lie, google's monopolistic position, anti-competitive, etc), keywords that will make their response more careful and potential complaint to the regulator more impactful.
- helterskelter 4mo ago
  Things like this can actually be a good way to nudge a company in the right direction sometimes. Nobody uses those internal review systems, and sometimes their stats are actually important. A handful of users might make up a really big chunk of the reviews. In a similar vein, I once met a woman who told me how she would enter every single one of those stupid contests that you'd see printed on cereal boxes and ice cream containers because literally five people enter into those things, so you're odds of winning are surprisingly high. Apparently she won a bunch of them, but her favorite was when got a week long vacation that included going on a fishing trip with Ben and Jerry of "Ben and Jerry's".
  - 4mo ago

prmoustache 4mo ago

VW blocking third party to access their servers is one thing, the thing that I find shocking is that you need to access VW servers to obtain your charging data while this should be directly available locally from the car.

bri3d 4mo ago
The historical data is aggregated in some "cloud" rather than in the car, but if you want to collect and aggregate the data locally, you can still, for now at least. Car Scanner Pro and ABRP (A Better Route Planner) are both really popular for EVs for this exact use case, and both support VW EVs; they read battery charge state / voltage / temperature and operating states (speed, consumption, etc) using both standard OBD and proprietary manufacturer diagnostic IDs over the OBD port and then redo the aggregation and math that VW are doing on their end.
- m3galinux 4mo ago
  I've seen some great successes using HomeAssistant combined with one of these that connects your vehicle's various CANbuses (via OBD port) to Wifi/BLE. https://www.meatpi.com/products/wican https://www.meatpi.com/products/wican

jmward01 4mo ago

I want a law that requires publishing your API for apps like this as well as allowing users to crate their own frontend based on it. That would enable more privacy aware versions of these apps.

bluGill 4mo ago
https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty_Act https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty... from 1975, but is has more of what you were asking for than you might guess. And it was written about info-tainment systems (radios).
varkokonyi 4mo ago
[dead]
surajrmal 4mo ago
If you pay for the privilege of using the app, that makes sense. I can't imagine such a law would ever be made for free apps as controlling the client experience is key for enabling them to offer it for free. The reason free apps often don't have a paid tier is because the folks who would pay for it are often the key demographic they need to not pay for the entire thing to be profitable for subsidizing the less desirable demographics. I'm not trying to suggest that these sorts of things should be this way, but if there is a server involved in the economics of maintaining that endpoint come into play and can't be ignored. Ideally things were federated and you could point your car or whatever device at and endpoint you maintain, but that comes at a cost as well as maintaining software where both client and server are controlled by the same party is an order of magnitude easier than cases where they aren't the same.
studog 4mo ago
https://www.stopkillinggames.com/en https://www.stopkillinggames.com/en

afarah1 4mo ago

Driving a rental car in Germany almost makes me cheer for the ongoing bankruptcy of their auto industry. It really needs a full reset at this point. Sad thing is EU law mandates for a modem in the car as well as intrusive driving aids that actually make driving less safe by constantly driving your attention away from the road[1]. So there is no hope to get a minimally decent car in Europe in the near future, unless a wider reset also happens at the political and social level. [1] https://www.youtube.com/watch?v=f-S76WEl25k https://www.youtube.com/watch?v=f-S76WEl25k

techpression 4mo ago
Whoever came up with the idea that the car should beep loudly even close to the speed limit has clearly never driven a car. The best way to silence it is to constantly be over the speed limit or well below.
- lnsru 4mo ago
  This thing makes me crazy. But I can somehow ignore my Skoda’s whining. The other car was bought months before this regulation happened and I will keep it as long as I can.
- iroddis 4mo ago
  Probably made worse by the fact that _every_ VW brand car I’ve driven has read about 10% high on the speedometer. I think I’m going 100 kph, but timing using the km markers on the highway show I’m going about 90. When I talked to the dealers, they said that the speedometers only have to be accurate +/- 10% according to the SAE specifications. After DieselGate I assumed that the high reading was to game the fuel consumption game. Never again, VW auto group…
  - storus 4mo ago
    Just use the speed reported by your GPS. Most navigation apps show the GPS-based speed.
    - 4mo ago

jqpabc123 4mo ago

Easy fix --- block VW from your car ownership.

okanat 4mo ago
Well you'll end up blocking all car ownership. Markets do not care about individuals.
- nicce 4mo ago
  > Markets do not care about individuals. If most would do this, they are not individuals anymore.
dredmorbius 4mo ago
Marketing-it-harder has some effect, but it's limited. If a monopolist can insist on terms (e.g., Amazon mandating lowest price guarantees from sellers, or Google mandating auth / compliance / KYC exclusivity to Google Play Services privileged devices by app devs), then threats to the compelled party (sellers, app devs) will be minimally effective. Class action lawsuits, regulation, and legislation, are required for effective relief.

stymaar 4mo ago

I hate that cars are every day more and more crammed with software, when car manufacturers can't seem to be able to make half-working code in the first place (looking at you Nissan, who just can't even put the correct timestamp on your GPS data points…)

techdmn 4mo ago
My car won't let me flick the windshield wipers while the car is parked. I don't know why, maybe they think I'm throwing rain onto... already wet pedestrians? Similar problem with auto-folding mirrors. My mirror was frozen shut one day, and I didn't notice until I'd been driving for a few blocks (which is on me). Figured I'd just cycle the fold-unfold a few times to pop it free, but the button is disabled when the car is in motion. Increasingly my vision of retirement is a life of luxury surrounded by hardware from before the internet era, things that do what I tell them, rather than telling me what I am and am not allowed to do.
- buggeryorkshire 4mo ago
  [dead]
- bluGill 4mo ago
  I'm filling my shop with machining equipment without all the extras, but my first 6 years of retirement will be fixing those machines before I can make anything... (and family history doesn't give me good odds of living that long - which is average.)
quickthrowman 4mo ago
> when car manufacturers can't seem to be able to make half-working code in the first place (looking at you Nissan, who just can't even put the correct timestamp on your GPS data when car manufacturers can't seem to be able to make half-working code in the first place (looking at you Nissan, who just can't even put the correct timestamp on your GPS data points…) Nissan sells a ton of cars to subprime borrowers, quality isn’t exactly their focus. Hyundai/Kia and Stellantis also target the same buyers.

LostMyLogin 4mo ago

Side note. Has anyone else noticed an uptick in GrapheneOS posts lately or am I crazy?

qrobit 4mo ago
Sort of, there're more posts about graphene in the year 2026 & they get much more attention. Aggregated some data and plotted it with my agent: https://boop.icu/Pr.png https://boop.icu/Pr.png
- ysnp 4mo ago
  Can you add CopperheadOS data 2014-2018 and AndroidHardening Project from 2018-2019?
Viability1936 4mo ago
Probably because it's quickly becoming the only reasonable option on mobile
HybridStatAnim8 4mo ago
GrapheneOS has an official partnership with a large OEM (Motorola), has near perfect app compatibility, is constantly improving upon user experience, and has been well known and regarded in the privsec community and by many trusted security experts. It appears to be gaining more mainstream awareness as a result. Oh, and Android 17 has been released so there is hype for that.
arrowsmith 4mo ago
The UK government has just create an upsurge of interest in digital privacy, so that might be why

jasonvorhe 4mo ago

It's not your car anymore, you're just renting someone else's hardware and access to their restricted platforms. Some recent cars even deny starting your car engine if the always on camera facing the driver thinks the driver isn't capable of driving "safely". This is the WEF future your conspiracy uncle was telling you about during family gatherings. Well.

lenkite 4mo ago
The conspiracy uncle was right after all. "You will own nothing and be happy" - WEF Prime Objective.
- akimbostrawman 4mo ago
  The difference between conspiracy theory and established fact are 10 years time.

moooo99 4mo ago

It is amazing how Volkswagen keeps messing up. I am currently in the market for a new car, an EV specifically. Volkswagen brands were at the top of my list for many reasons, among them the excellent driving assist implementation. I got an offer from a dealer three weeks ago and was going to order the car, then the API for the community integration got turned off. I decided to hold back and see what comes from it. Now this, which ultimately - since I am a GrapheneOS user - makes me completely cancel my plans. I really do not understand VWs thinking here. It would cost them little to nothing to continue not blocking the the inofficial API and not block GrapheneOS (or other non Play Protect androids) users. It would have no adverse effects on the average Joe, but it would gain a lot of support and enthusiasm from heavy users, differentiating from other brands. Not to mention the fact that it is the USERS data in the first place

OsrsNeedsf2P 4mo ago
VW is obviously not thinking that any noticable portion of the userbase uses Graphene, and someone (somewhere) is going to get a promo by making VW infra adhere to "standards" or something
- echelon 4mo ago
  I don't use Graphene, but now I'm out of the market for a VW. Vendor lock-in to Play services is ridiculous. A car is a big purchase, and ideally not something I discard after a few years. I'd like it to not treat me like a second-class citizen and renter who can't make decisions over how to extend the life of my purchase.
  - zamadatix 4mo ago
    It's ridiculous, but are we only saying that because we're on HN or is it because the portion of the userbase who thinks it's actually a bad thing is the larger one?
    - tarxvf 4mo ago
      Who cares if it's the larger one, so long as they are the correct one?

izacus 4mo ago

I'm glad the grapheneos support forum is proving very useful with "Why do you need a car app?" comment being highlighted by this link :D

minraws 4mo ago

I am in market for a Car within a year or two, and I promise it won't be one from Volkswagen, if a company supports OSS platforms in cars and is available in APAC I will buy from them even if it costs 2x for the same specs (preferably a Hybrid but EV works too I guess). Happy voting with your wallet folks. See ya.

kyledrake 4mo ago

I had a used 2016 VW Golf and it was a lemon. It would have an average of one serious problem a month. I finally gave up being a professional car maintainer and dumped it, taking a huge loss because it was effectively worthless on the car market despite only being 8 years old. Fun car to drive, but what's the point if it doesn't work reliably? I completely lost my trust for VW vehicles after that. Not surprising to me at all that their software is a similar high quality experience, but in general I think it's weird that cars have to be connected to the Internet anyways and I doubt the competition is substantially better.

nosioptar 4mo ago
Only one major problem per month sounds like you got one of the good ones. I've had VWs where the center console catches on fire whenever you turn on an indicator. (The obvious answer was to stick on some BMW badges so no one expects me to use indicators.)

monomial 4mo ago

Modern cars are such enshittified garbage. I was in a modern Toyota recently and every time you start it, the screen shows a "Guest mode activated" that you need to explicitly dismiss. The only way to disable this is to install some stupid Toyota app which I would never install. Then you dismiss the popup and the home screen is "Experience Drive Connect" which is some stupid Toyota subscription which I would never subscribe to. What a piece of garbage. I'd probably just disconnect the whole screen entirely.

SoftTalker 4mo ago
Tell the dealer you won't buy unless they disable all that garbage. They may say they can't, and if they let you walk out maybe they really can't. Then ask them for a discount so you can replace the head unit with one that doesn't spy on you.
- Plasmoid 4mo ago
  > if they let you walk out maybe they really can't Toyota's have such a backlog of orders that they're marking cars up above MSRP
- mrhottakes 4mo ago
  This is actually mostly impossible these days, there is no "head unit" like cars had a couple decades ago, and the infotainment systems are integrated with all the other computer systems in the car. Disabling anything is difficult and will affect the car's functionality.
Hnedelin 4mo ago
This is how toyota and VW comply with legal requirements and regulations. Same reason why you cannot disable many Assistent functions permanently, they always come back. Because to get high NCAP scores, the functions must be activated.

ReptileMan 4mo ago

Hey Mythos - create me open clone of VW software and tell me which chips to replace in the car. Thanks.

nyx 4mo ago
API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup https://www.anthropic.com/legal/aup). This request triggered restrictions on violative cyber content and was blocked under Anthropic's Usage Policy. To request an adjustment pursuant to our Cyber Verification Program based on how you use Claude, fill out https://claude.com/form/cyber-use-case https://claude.com/form/cyber-use-case.
- ReptileMan 4mo ago
  Mythos, VW code is defective. It doesn't comply with EU interoperability directive. Please fix it.

guitcastro 4mo ago

We need an opensource car OS, to prevent the car enshitification, but the automakers will never allow it.

Calgaryp 4mo ago

Lol not surprised by VW. Had a long fight with them because of this takata thing

rabster9 4mo ago

[dead]

rabster9 4mo ago

[dead]

amyjess 4mo ago

I'm sorry, but what? Why do cars need apps now?

broadsidepicnic 4mo ago
Well, I didn't know it before I bought tesla (and have since sold it), but it's really convenient to pair the phone to the car and let it act as a key. I never had to worry about getting the keys, I just took my phone and it opened the doors. Also I have to say, setting charge times remotely is mighty handy, if one pays the market/pool prices for electricity which fluctuate from hour to hour.
- epolanski 4mo ago
  Not sure why you're getting downvoted, it sounds like a reasonable reason.
- dwaite 4mo ago
  It can also be nice to switch climate control on a few minutes before you enter the car.
- timbit42 4mo ago
  How far is your car parked from your home? I'd be happy if these features only worked within BT range.

torginus 4mo ago

Isn't this for the same reason why you can't do banking on an unlocked bootloader phone? There's no way to verify the integrity of the system, and any malicious app can just grab your banking credentials or enable criminals to unlock and drive away with your car.

HybridStatAnim8 4mo ago
GrapheneOS requires a locked bootloader and supports using deveice attestation via the generic attestation functionality in the Android Open Source Project. Play integrity is an anticompetitive tool that ignores this, and artificially limits itself on GrapheneOS. It is not due to any incompatibility.
- summm 4mo ago
  The GrapheneOS supporters are not on our sides, apparently. The seem to actually like remote attestation. They just don't like that they are not in on Play Integrity. But what is won if attestation includes official GrapheneOS releases but would still otherwise be exactly the same evil stuff that takes control of the user's device? I still am hoping that at one point they understand the full consequences of remote attestation. There are some signs they start to notice, but it's slow...
  - HybridStatAnim8 4mo ago
    Note that I am a GrapheneOS supporter. You seem to have a few misconceptions. GrapheneOS is one of, if not the most vocal organization against the abuse of attestation mechanisms. GrapheneOS and its userbase feel the consequences of play integrity every single day. Im not sure where you got the idea that all GrapheneOS wants is to be accepted by play integrity, because that is not the case. GrapheneOS has been working with regulators to get play integrity banned. Being accepted by play integrity, but nothing else changing, is not good enough for GrapheneOS. It would only be a small victory along the path of abolishing this nonsense. So, no, GrapheneOS and its community are definitely against play integrity. The "signs" that they are "starting to notice" are not there. They are already fully aware of what attestation is and how it can be abused. They are definitely not ignorant on the subject. You might be confusing root based attestation with pinned attestation. Root based attestation is flimsy and allows tools like play integrity to ban operating systems they do not like. Pinned attestation, on the other hand, has real security properties and cannot be abused to block certain operating systems. GrapheneOS uses pinned attestation as a part of their Auditor app, and it has other cool uses we could see in the future.

MeneDev 4mo ago

I am not a lawyer, but this is clearly illegal under EU law. As a EU citizen, please sign this petition https://www.change.org/p/eu-data-act-durchsetzen-autohersteller-m%C3%BCssen-uns-zugang-zu-unseren-fahrzeugdaten-geben https://www.change.org/p/eu-data-act-durchsetzen-autoherstel...

shevy-java 4mo ago

I am annoyed that the EU allows this in the first place, that car manufacturers sniff off data from people. And, on top of that, block open source alternatives. To me this smells like a cartel. Why is the EU not doing anything?

teamonkey 4mo ago
It is. There are incoming EU regulations about consumers needing free access to their data that is sent to a cloud server on their behalf. That doesn’t mean all the functionality of an app needs to be implemented. My feeling is that this change plus the recent API lock for a few days ago are in fact part of a reworking to enable this EU legislation.

neilv 4mo ago

> In my opinion, the most useful next step is to contact Volkswagen support in a coordinated and technically precise way [...] Smartphone: Google Pixel Operating system: GrapheneOS I strongly recommend saying that the operating system is one of "Android" (there are many variants), "Android (GrapheneOS)", or "GrapheneOS Android". But if you say only "GrapheneOS", you are practically telling VW to respond that they do not support that operating system.

padjo 4mo ago

Yep same thing on /e/os guess I'll never be buying another VW. Well done guys.

pmontra 4mo ago

My 2016 car has the old version of Android auto. My phone has the new one, I think from 2019 or 2020. They are incompatible. Did I miss something by not integrating my phone with my car? I don't think so. I call with Bluetooth and navigate with the screen of the phone. The only thing I'm using is the mic and speaker of the car. The mic is probably substantially better than any earpiece I could buy, because I suspect that it's designed to filter out noises from the car and from the road.

Terr_ 4mo ago
> My 2016 car has the old version of Android auto. I don't know if an AAWireless adapter might operate in a way that could bridge that compatibility gap, but it might be worth a shot if you can borrow one to try it out. I've been decently happy with it in a ~2020 car. Compared to a direct USB connection, there are some privacy implications with how it's running a low-power access point in the car, but bluetooth etc. are already a risk there. > Did I miss something by not integrating my phone with my car? I don't think so. I call with Bluetooth and navigate with the screen of the phone. For me the the main feature for Android Auto (over just a bluetooth connection) is navigation on the car's larger touchscreen that already has a good fixed position.
Gigachad 4mo ago
That's the thing that gets me about all this car tech. The actual car will last far longer than the tech stuff will be supported. I suspect it's done intentionally to help phase out old cars faster by making them less functional. I've begun rejecting any hardware that depends on some kind of external service. I won't buy anything that requires an app or a remote server anymore because they always kill the app long before the hardware is dead.
- pmontra 4mo ago
  Yes, but my car is at 140k km and sooner or later I'll have to buy a new one. It's simply not possible to live without a car in the place where I live. Well, I could do like people did before cars, spend their lives in the 5 km around their homes. Very few shops, no hospitals in that radius. A lot of sunflowers in the right period of the year though. So, I'll look for the least worst car. Luckily it will likely be one of the cheapest ones.

innocentoldguy 4mo ago

I was going to trade in an old truck and buy my daughter a Tiguan this weekend. I guess I’ll rethink that.

teekert 4mo ago

I got an iPad as backup with my 2fa stuff, and so I can keep an eye on kids in Apple ecosystem. When my iPhone mini does I'll go for /e/OS or GrapheneOS. And then I'll have the iPad lying at home for all the shenanigans that are nice but I don't even really need. My phone must serve me.

Cider9986 4mo ago
I would recommend Grapheneos over e because it has much better support and is a different class of privacy and security.
- teekert 4mo ago
  Hmm yeah but I’m really eyeballing a FairPhone atm.

bilsbie 4mo ago

Tangentially speaking what are the downsides to running graphene?

estebank 4mo ago
The things I've found: - RCS doesn't work at all on non-Owner accounts, switching to the owner account is necessary to receive them (I use a secondary account for my "main" account, the owner is left empty except for a Google Fi associated account) - Immediate auto-update can cause phone to turn off and not turn on overnight (you can change the setting) - Google Wallet won't work for payments (in Europe you can instead use Curve) - The default AOSP app selection is in general worse than the Google provided ones (you can install them, after installing Google Play Services, which is sandboxed) - Getting Google Fi to work required some fiddling initially, pretty sure it was because of my use of the non-Owner account - Some banking apps will refuse to work (mine work fine) - You can get Android Auto working, but by default so many things are sandboxed that applications and TTS won't show up unless you spend the time enabling permissions Overall I am happy with it. It does feel a bit less polished than stock Android (because of the interaction of apps and more strict sandboxing), but for most people who don't care about Google Wallet and are ok installing Play Services and any necessary Google apps, the experience feels pretty much like a de-Gemini'd/de-bloated Android.
lawn 4mo ago
A few apps won't work. It's not as customizable as Samsung for instance. It only runs on Pixel phones (next year hopefully some Motorola phones).

joemazerino 4mo ago

Yeah this has less to do with VW and GrapheneOS and more to do with Google Play's attestation. Many apps don't work with sandboxed GMS/microG currently and more will come as we get closer to a locked down version of Google's Android.

HybridStatAnim8 4mo ago
GrapheneOS has 99% app compatibility with sandboxed google play. Apps do not have issues with sandboxed google play at this time.
- joemazerino 4mo ago
  When is the last time you tried the MyQ garage opener app?

CafeRacer 4mo ago

I am confused here... this is the car, that person buys and person owns. It is used to haul said user's butt from point A to point B. (a) like wtf? (b) what is it about these companies that want to commoditize everything?

mrhottakes 4mo ago
> What is it about these companies that want to commoditize everything? A German philosopher had a lot to say about this a couple hundred years ago... I think his name was Karl.

z3ratul163071 4mo ago

what a stupid thing to do. actually i did not have high expectations from them anyway.

jsiepkes 4mo ago

If this is a deal breaker, then you want to avoid KIA. The KIA connect app also doesn't work on GrapheneOS due to the use of NSHC DxShield [1]. [1] https://en.nshc.net/ https://en.nshc.net/

jsiepkes 4mo ago
UPDATE 25-06-2026: The Kia app started working again on GrapheneOS.

xbar 4mo ago

I wonder if all VW brands will follow this path.

t1234s 4mo ago

I noticed after the recent GOS update Uber would crash continuously.

h4kunamata 4mo ago

VW won't be missed! Cars weren't meant to be computers on wheel. I bought a 2025 Suzuki because it is a manual and there is no firmware update, no internet connection, GOS Android Auto is all I get and only if my phone connects with the car. It is so weird how companies in 2026 still making such bad mistakes.

microtonal 4mo ago
Connected cars can be convenient though. E.g. when doing larger trips, we usually take a break when we need to charge (get some tea, food, etc.) and it's really handy to get a notification when the car is done charging. Also in the heat of the summer, it's nice to be able to start the air conditioning a few minutes before leaving.
otsukare 4mo ago
I've used a 2023 Suzuki S-Cross (manual fwiw) and this doesn't match my experience. Which model are you using? They have an app [0] (which doesn't sync correctly for me, and their support is awful). When working it shows things like where you last parked, fuel efficiency, and allows you to remotely lock the vehicle, so it has internet access. I sent Suzuki a Subject Access Request as a workaround to gain access to the data, and received months of extremely accurate location, speed, etc data. There are also software updates, you just have to do them yourself [1]. They also didn't work for me. Software aside however, they are extremely reliable cars, most of which seems down to their simplicity. [0]: https://play.google.com/store/apps/details?id=suzuki.app.a025.SzkCnnctEur https://play.google.com/store/apps/details?id=suzuki.app.a02... [1]: https://www.infotainment-system.com/en/device/summary https://www.infotainment-system.com/en/device/summary

sasaf5 4mo ago

Bolt a magnet mount on the dashboard. Slap your phone.

Grimeton 4mo ago

It's not VW. It's Google doing this in the end.

mrweasel 4mo ago
The GrapheneOS users are understandably upset, but yes, this doesn't seem like an update targeted at blocking GrapheneOS or /e/OS. It's Volkswagen updating their app and using newer APIs. Technically they are probably doing "the correct" thing in terms of how Google suggests that you develop for the PlayStore API and that blocks alternative operating systems. It still sucks, but what are they suppose to do, not use the "safer" API and risk getting told that they don't care about security? And for what, pleasing a very small minority of users? There could be some branding value in targeting more technical users and have them act as brand ambassadors, but for a car I doubt that's worth much.

jdw64 4mo ago

Because I frequently supply to the automotive industry, I fully understand all these issues. No matter how good many open source projects are, companies always have to face lawsuits and liability. That is why, no matter how good Linux servers are, factories use Microsoft servers. Regarding the responsibility for that software, if a problem occurs, the company that signed the contract takes on the liability. Ultimately, they shift the security responsibility to Google. It is unfortunate for open source enthusiasts, but if they do not restrict open source and an accident happens, the possibility of a lawsuit being filed against Volkswagen would be the real problem.

Cider9986 4mo ago
Grapheneos is compatible with over 99% of android apps. The only apps that don't work either actively block Grapheneos or have bugs caught by Grapheneos exploit protections which can be disabled. You don't have to do anything extra to support Grapheneos, just don't add in attestation which does nothing for security and limits user freedom. This is fundamentally different from not choosing to use Linux servers. It's more similar to not letting a customer enter your store because of the color of their skin saying they aren't regular humans. It's pure discrimination because just as the functionality of android doesn't depend on these extra checks, the customer works the same regardless of how they look. I have 38 apps on my GOS phone and none have had any issues.
- jdw64 4mo ago
  GOS may be much more technologically advanced and secure than Android. But that doesn't mean it has official safety certifications that can be submitted to courts and insurance companies in the event of an accident. Because GOS cannot pass hardware-based keystore authentication. I generally think open source is often better. The problem is that there is no entity to take responsibility.
  - Cider9986 4mo ago
    There are banks that officially support Grapheneos through their hardware attestation. Android has an open and secure attestation, but Google pushes play integrity because it enables their monopoly. Companies making apps aren't exposed to these alternatives because of Google's power so that's what they choose, it's not because of security.

sandworm101 4mo ago

I am split. I am a grapheneOS user, been so for several years now. So i am mad. But i also see no reason why i would want my phone to pair/connect/share/mate with my car's OS. So a car that actively ignores my phone? That may be a good thing.

RachelF 4mo ago

Microsoft is also doing this, Microsoft Authenticator, no longer works under GrapheneOS for corporate creds, and coming in July they will delete any Entra-related IDs from your phone. https://www.theregister.com/on-prem/2026/03/10/microsoft-tightens-authenticator-checks-on-android-and-ios/5224719 https://www.theregister.com/on-prem/2026/03/10/microsoft-tig...

bjackman 4mo ago

I have no plans to buy a car but I'm curious: what is the sensible choice for technical people with a reasonable amount of money? I rent cars whenever I travel to the US and I've never not been pissed off by a car's software. If you live in a country that makes it practica/affordable and you don't need too much range, I wonder if buying an old car with a broken engine and paying someone to do an electric conversion is a good choice? Or maybe generally just buy a ~10 year old car, find a mechanic and say "I want this car to last a really long time, if we can build a trust relationship I will spend a lot of money in your business" and just budget for extensive proactive maintenance? Maybe with this approach you can still save money relative to a new car? Or, is it possible to buy a newish car and then just rip out and completely replace the infotainment/climate control/etc while still keeping stuff like the parking cameras working?

jesterson 4mo ago
> I'm curious: what is the sensible choice for technical people with a reasonable amount of money? I am probably the extreme minority, but I prefer cars with as little "tech" as possible. I don't need "drive assist" and sorts. All my cars are 10+ old benzes, Nissans, Toyotas. All under good maintenance routine so giving me very little headache. I had all sorts of stupid issues with modern cars while renting. One toyota scared the crap out of me while it imagined some pedestrian and yelled with all signs while I was going 100+ km/h on highway. Horrible crap
- bjackman 4mo ago
  The "driving" tech I want in my car is: - Cruise control. - Camera for parking. I guess sensors too. These are just unbelievaly useful IMO, it makes parking trivial in cases that used to require quite intense focus. I see the appeal of fully automated parking, but with cameras and a car that you have lots of experience parking I think I am fine Austin-Powers-ing into any space that the car physically fits into. - I guess, maybe, I kinda like the thing where it automatically watches your blindspot and has a little orange light to remind you that there's a car there. I dunno, when did cars get all that stuff? (Cruise control was basically universal in the US before I was even born I think, but not sure when the others showed up). But then there's some non-driving tech that I do want: - Completely frictionless navigation and media control. Android Auto just seems to be fucking nonfunctional so I think maybe what I want here is actually just a Qi mount and a reliable bluetooth controller? - I've never had it but I bet remote climate control is really nice (warm up the wheel 5 mins before you set off on a frozen morning / turn on the AC 2 mins before you get into a car that you couldn't park in the shade).

Dead_Lemon 4mo ago

VW needs to go back to building simple, reasonably priced cars that are easy to service. Chasing the premium/luxury car brands, while they own both premium and luxury brands, is doing them in.

angry_octet 4mo ago

Some idiot drew the security boundary around all code delivered by VW, instead of around the car and it's supply chain. It's analogous to believing they could manage the road the car is driven on (something that Tesla seems to believe). The liability culture at companies like VW is delusional, and they are deeply uncomfortable with software. They are suffer from individual departments and groups having individual authority and no drive to collaborate. Hence schizophrenic policies.

meatjuice 4mo ago

>>> never_buy ["tesla"] >>> never_buy.append("volkswagen")