I posted a flavor of this comment on an article a few months ago, but it's relevant here:
I have a seven year old Volkswagen, not financed. I'm security conscious and made sure to disable all the data collection I could find in the companion app before removing my account, turn off remote access services, dig through the infotainment to turn off what I could, etc.
Last year I requested a Carfax on it, and one of the fields in the request was current mileage. I entered an estimate like 75000 miles. On form submission, that field failed validation with red subtext along the lines of 'this is less than the last reported mileage of 75345, reported <5 or so days prior>'. Checking my odometer and looking at my past few days' trips, that was indeed accurate.
The car hadn't been to a shop or out of my possession in weeks, so I can only assume the telemetry was still dialing home and selling to third parties despite my best efforts to disable it.
Tangential, but one of the concerns I have about these 'smart' cars is they have an expiration deadline.
There's an exceedingly common type of failure I have seen myself in industrial electronics and (has happened with Tesla at least once), that some module keeps a log of some kind in a nonvolatile flash, and this flash has a limited lifecycle, which the equipment reaches at some years into its life (or earlier, if the flash came from a bad batch, or more logging happens than planned).
At this point the board usually gets bricked and replacement is very hard due to cryptographic handshakes between components.
I share the sentiment. I want a new car, but only if I can guarantee all telemetry is hard disabled. But I don’t have the kind of money to buy a new car and risk bricking it. Luckily I’m pretty handy, so I’ll have to keep my 2014< cars forcefully running as long as I can.
Your mileage went from VW->telematics vendor->broker->carfax, thats the chain it usually follows. The fuse stops it but the real issue is the owner is the only one without the record.
You could probably find some interesting info if you send out some privacy requests through the chain. LexisNexis and Verisk are consumer reporting agencies, so they have to provide you a disclosure on request. Start there.
> turn off remote access services, dig through the infotainment to turn off what I could
This is never enough. You can't trust a software switch. You need to remove the hardware capability if you want to make sure the car isn't spying on you. In the best case, the telematics box has it's own fuse, and that may be enough. In other cases, you need to find the box and unplug it. The service manual will have it's location. In some cars it's easily accessible, in others less so and you need to remove the glove box or part of the dash. Dealers will probably refuse to do it, my advice would be to DIY or find an independent mechanic who will do it.
Carfax also can report estimated mileage, but it might have a different flag in the system that allows override.
I've been handed a Carfax on my own car that has a reported mileage much greater than the actual mileage on the car, and the car has not been out of my possession.
All it would need is a wi-fi antenna internally, and then it could connect to an open wi-fi network anywhere. And it's going to be pretty much impossible to avoid ever driving your car within range of some open network.
It would have to find an open Wi-Fi network that isn't gated behind a captive portal, which is very rare. Rare enough that most telemetry would be too stale to be useful.
I would be very surprised if it was that simple - systems in modern cars are so interlinked that I would expect that pulling a fuse would cause something else to break, resulting in dash lights or broken functionality.
It’s not futile. Write your congressperson and state representatives. If enough people do this around the country, laws will eventually be passed to prevent it.
This is why there are
moral panics about things people feel in their guts: most people are reasonably easily unsettled and distracted by queer people, people who look different, people their people don’t trust being in charge.
It works. Most people are happier focusing and holding forth on that and repeating familiar statements than they are talking to congressional staff about policy.
Your car that you paid a lot for and you like and have positive useful experiences with every day? That’s going to be way farther down the list of things to worry about.
Two different things are getting called "car data" here.
Facts about the car: VIN, spec, recall status, odometer. Attested by someone other than the owner. Outlives every owner and the owner is the last to have it, if at all.
Facts about the driver: speed, location, timestamp. Thats what GM sold, the fix is to not collect it but OEMs seem to take 'anonymization' approach.
The DRIVER act treats both as the same which is why it fails to fix anything. The second needs a ban. The first needs the opposite - especially as we take the driver out of the vehicle - an authoritative record of the vehicle. How do we expect AVs to have adoption when the only safety certification is the company's press release?
How can this be stopped, from a technical perspective? Can I wrap the comms in a Faraday cage?
Obviously it would be better to have this action be illegal. But with legal privacy protections eroding in the US and other countries, it seems prudent to have a better understanding of the systems involved in the immoral surveillance.
I've had good luck with pulling service manuals, finding the telematics antenna connectors, and unplugging them. It's popular to pull the telematics module fuse, but that typically disables internal microphones and GPS that are used by android auto and carplay. This severely degrades features spouses expect to just work. The antenna pulling is a much lighter touch.
Okay it's a red herring here. I also like to use carplay and the phone's GPS is truly awful to use. I also like to dictate texts and take calls in my car. These are things that don't need to be sacrificed if a scalpel is used in place of a butcher's knife.
Sometimes it helps to have someone with their priorities in order keeping a reality check on people who don't always stay grounded.
A good question. I'm not really concerned with the answer since I don't plan on selling my cars. I'm sure a good population would pay to not have their car spy on them and I can think of very few that would pay to have it turned on.
Easily reversible mods only affect price for suckers anyway.
You're implying the stub of an exposed coax inside a faraday cage is capable of establishing a link with cell towers. This doesn't really pass fermi tests and I've never observed it myself, just read the paranoid concerns of people online.
Regardless, taping some foil around the connectors with the foil making okay contact with the metal chassis is more than enough attenuation at sub GHz microwave to remove this concern without having to source specialty terminations and crimpers (or worse, non-reversible damage to the OEM cable assemblies by repurposing their terminations). I've done the foil+tape on some of my vehicles, but it hasn't made a difference in binary "does it connect or not?" testing.
These cars are more software than hardware now. And like everything else in the software industry, every product gets released incomplete and patched later.
Although the correct solution would be a USB port somewhere to insert a patch file rather that over-the-air updates that might happen while driving.
It’s practical to see battery level so I can optimise the electricity price at which I charge it.
Although it wasn’t worth the cost of the 3 year subscription so I now just estimate the charge status based on the charge’s power consumption.
If the car is at 10% battery, it may be worth charging at .15 or .3€/kWh. If it’s at 70% charge, I’ll wait until the price drops to .005€/kWh. The whole thing is automated in HA.
You can do stuff like like turn it on to heat or cool the cabin, live track it's location, lock/unlock doors, open/close trunk, and updates are mostly for the infotainment systemn and driving assists.
Their is a cell modem in the car, so all these features are available anywhere the car has cell service.
> You can do stuff like like turn it on to heat or cool the cabin, live track it's location, lock/unlock doors, open/close trunk, and updates are mostly for the infotainment systemn and driving assists.
Are any of those things more important than your security (e.g., against hackers) and privacy?
Vote with your dollars. I know one brand that has the most leading edge tech and does not sell my data so I bought from them. However they do use my anonymized data to train models for a future FSD capability but only because I opted in to that.
When given the choice between privacy and convenience, the great majority of consumers choose convenience over and over again.
I'm not sure what the solution is, but it's not going to be market based if you look at any recent trends. Interest in privacy is unfortunately a niche concern outside of places like HN.
Anyone who has tried to market a privacy oriented product knows what I am talking about.
“FSD?” You aren’t talking about Tesla, are you? “Vote with your dollars?” So you voted for regulatory capture, election interference, erosion of free speech (due to concentration of media power), and you’re financially supporting an openly racist, openly fascist oligarch who’s let the mask completely slip? I can’t even mention the gesture he did on the inauguration stage, because the mods tend to delete any mention of that. Galaxy brain moment. /s
The fact that you even said that with a straight face. If you buy a Tesla in >2025 you’re morally bankrupt.
Yeah… I’d rather my data get sold than support any Musk-led company.
He has caused a non-zero number of deaths from entirely preventable diseases, I would rather not mention any numbers (nor do I claim real knowledge of them) before there is public accountability. Mentioning numbers tends to put the Elon Stans into a willfully ignorant state. It’s natural for them, as they have to pretend the Emperor’s garments are astonishing 24/7.
How do you think right-to-repair intersects with cars?
An obvious thing may be to say the software must be published or the spec released, but we've had computers in cars since the 80s. It seems like a tall task but people can and do reverse engineer entire ECU systems (See Trionic Tuning)
Another seemingly very obvious one - requiring manufacturers to publish specifications regarding ALL OBD interface options. Of course this immediately runs into trouble. Saab for example gated features of the security system to prevent key reprogramming, swapping of certain components without a dial out to the internet using specific saab software that runs on a laptop and interfaces.
> How do you think right-to-repair intersects with cars?
Strongly. You don't own the thing you purchased if you can't legally repair it or legally obtain the knowledge to repair it. At beat you're paying an overpriced lease and granting a liability waiver.
>Much like owning a home without an HOA attached, it is becoming harder and harder to meet this requirement.
The near universal proliferation of owner's associations and management groups and whatnot for developments larger than ~1ac (the EPA threshold, some states/towns have lower) is something you can lay at the feet of the Clean Water Act and it's implementation and precedents over the following decades.
The exact area of the buildings, the driveways, the community park and gazebo, etc, etc, are necessary features of the site plan that makes the math that is required to meet stormwater/environmental requirements. And and some legal entity has to be responsible for that in perpetuity. Enter the HOA. This is also why HOAs often won't allow you to expand your driveway or add a non-permeable patio, it could (prob not, but still) ruin the environmental calculations they're responsible for enforcing as a condition.
I'm not nearly as familiar with car regulatory stuff but I would bet a lot of money that they're using OTA telematics to check some sort of compliance box...
I believe it was Strongtowns reporting a few months back that HOAs are generally being driven by developers, the only folks with (a) land to build in bulk; (b) capital, relationships, and experience to get fully through permitting in bulk; (c) building a substantial fraction of SFH.
Strongtowns is happy to follow the money and incentives on all sorts of other issues. Why do they just throw up their hands and say "it's the developers" on this issue?
Developers don't do anything that costs money, like set up an HOA, without a reason. The developers create the HOA because you need your >1ac residential development to pass stormwater permitting. While you theoretically could make each individual .25ac parcel you're putting a house on compliant it's infinitely cheaper to just ignore all that, grade everything toward the road, dig a ditch, send the contents of the ditch through your stormwater treatment features, build in a little margin to those items, show the permitting authority the numbers that prove it passes with flying colors and when some jerk says "but what if X Y Z changes" you point to the excess you built in and tell them to GFY.
Now, where it really gets evil is when you start really pinching pennies or where the rules change over the course of the process making your numbers not work. Say you've got a lot of grade, a lot of rainfall, a lot of stormwater you gotta "treat". Well, you start adding rules to the HOA. Require certain parts of the lots remains grass or planter or whatever. Disallow patios, but do allow wood decks because the municipality considers those pervious, etc, etc. Or maybe the results you've got are marginal but you throw the bureaucrats a bone by saying you'll disallow car-ports and sheds in the HOA rules to prevent people from adding impervious surface. Or maybe you're uphill of some wetlands but not close enough to be regulated by default you promise to disallow working on cars and require people pick up their pet waste and not use lawn fertilizer or some other laundry list of certain things in order to make the local town's wetlands people comfortable not raising objection and claiming jurisdiction.
And of course, however these rules and plans shake out, the HOA is responsible for implementation in perpetuity.
There’s no reason that sort of compliance needs an HOA. Most places already have building codes enforced by mandatory government inspections for major renovations.
Do they do the same spying on the models/units produced for sale in EU? It’s not actually a necessary part of the operation of the device, so it makes sense they’d be able to sell them without it.
In my GM car I have the wonderful opportunity to pull the OnStar fuse and disable all cellular connectivity. However, I am concerned the telematics information are stored in long term storage and if I have to reconnect the fuse, all my driving will be batch uploaded. I hope not!! And the GPS still works. Maybe I can find some dummy loads as well or the antennae.
It's still better than other modern cars though? I think.
If you are willing to lose GPS, maybe you could set the car's internal clock to the year 2000. This might fool a cursory data dump that is looking for "last three months of driving habits". Would obviously not stand up to any real scrutiny, but mostly painless.
My car is much older and I used to hope it would last forever. But now I hope it dies soon enough that when I go to replace it, the options for non smart cars haven't gone away.
Tesla charges a $10/month subscription for its connected features, with relatively high uptake because its software is actually great (unlike the dogshit UX of most cars), so it doesn't need to sell data. Plus it just isn't how Tesla operates.
> third-party partners process information about you and how you use our services, including clicks and screen recordings, using first and third-party cookies, pixels, and similar technologies
Maybe the poster is saying, "There are no consequences for anyone acting in this way here, and we seem to be slipping ever more into societal moral decay, so why shouldn't I cheat to win?" Or: "All companies are essentially gigantic conglomerates eating each others' food by selling my own and others' data to each other, so I basically have rights to their claimed assets anyway."
Talking as an eastern european: unless you live in a sunshine place (~Mediterranean) most of the 90s car already eaten by the rust + the salt used for defrosting on roads in the winter.
Also by my experience cars (except from SUVs) somehow never kept up with the road quality. Pot holes are a problem everywhere but you can see that certain brands for example japanese and korean ones never designed for deteriorating road quality (and I don't mean offroad) because... you know they just don't exist in the home market. So the tires, wheels, suspension are not as robust as they should be.
Sure _everything can be fixed_ but then your car becomes a hobby and might not everyone has an attitude and time for that.
My wife's Ioniq 5 was hit on the bumper while it was parked. Took weeks for all parts to get to the dealer and cost thousands of dollars because sensors etc. if someone hit my 1981 Volvo 240 the same way I'm not even sure it would cause any noticable damage.
The 240 is built like a brick (both in terms of strength and looks). My dad had one when I was much younger, then he sold it for a 740. A few months after the sales, police knocked on his door and asked him a lot of questions. It turned out the purchaser had used the car in a ram-raid on a shop.
I really wanted a modern car because of the fancy automation stuff, I thought.
But it never is economical or more environmental friendly.
Whatever I saved on my old car compared to a newer one will never be less than the theoretical fuel savings on a newer car. Repair costs will never be as much (assuming you buy a popular repair friendly car). And nothing new needs to be built for me either.
Contrary to the HN bias, but a way to avoid this if you want to get a new car full of tech gadgets is to get one that runs on Android Automotive. The privacy policy is a normal tech company privacy policy. Other cars come with privacy notices that just say they can give your data to anybody.
Sorry, but a lot of cars, even if they run Android Automotive, maintain a separate TCU/DCM with its own cellular connection that can collect vehicle information independently of Android Automotive.
I have a seven year old Volkswagen, not financed. I'm security conscious and made sure to disable all the data collection I could find in the companion app before removing my account, turn off remote access services, dig through the infotainment to turn off what I could, etc.
Last year I requested a Carfax on it, and one of the fields in the request was current mileage. I entered an estimate like 75000 miles. On form submission, that field failed validation with red subtext along the lines of 'this is less than the last reported mileage of 75345, reported <5 or so days prior>'. Checking my odometer and looking at my past few days' trips, that was indeed accurate.
The car hadn't been to a shop or out of my possession in weeks, so I can only assume the telemetry was still dialing home and selling to third parties despite my best efforts to disable it.
reply