Internet-connected cars fail privacy and security tests conducted by Mozilla

https://gizmodo.com/mozilla-new-cars-data-privacy-report-1850805416

by rntn • 3 years ago

638 604 3 years ago

nhance• 3 years ago

I've got a 2018 Jeep Grand Cherokee and I've been searching for where the sim card is for the built in cellular modem so I can rip it out.

It astounds me that there aren't more people interested in cutting off the constant telemetry and to be honest it wouldn't surprise me if the car refuses to operate correctly when I do figure out where it's at and pull it.

Sander_Marechal• 3 years ago

There probably isn't a physical SIM card anymore. It probably just has an eSIM.

ben-schaaf• 3 years ago

Just gotta break out the soldering iron then.

yardie2• 3 years ago

In 2018? I doubt car manufacturers can move that fast. Apple didn't implement eSIM until 2018 for the iPhone XS. No way an auto maker has it before consumer electronics maker.

catchnear43214• 3 years ago

overwhelm the brain with input. to hold onto threads like this one, you have to be fairly healthy or fairly mad.

not strapping on tin foil hat, this likely isn’t some massive coordinated effort. it could be done “better.”

this is just making the most of the situation. at scale.

if you simplify the question, “Who wants to let their car manufacturer surveil them?” - the answer is also simple. very few hands are going to be raised.

most people don’t get the tl;dr - they drown in the firehose.

what isn’t out there is a friendly, accessible version of what you’re looking for - multi-manufacturer information on snipping the sensors, why and how, and what you lose in the exchange. if it is out there, it isn’t friendly enough to be readily found.

s3p• 3 years ago

I'm not sure what you're suggesting here.

vuln2• 3 years ago

It’s an eSim. Not a physical SIM card afaik.

monkpit• 3 years ago

Do you have a source for this?

joezydeco2• 3 years ago

You'd probably have more success finding the external antenna and clipping the leads at the sharkfin.

b1122• 3 years ago

Just make sure you do something, like use a resistor to ground the antenna lead, because I did that, and would still get connectivity at times.

EG if the cell tower was very close.

Was fine after I used a resistor to turn that power into mild heat.

vorpalhex• 3 years ago

There's often times a small cellular modem in the sharkfin on vehicles but I believe Jeeps still have whip antennas.

Could use an SDR or emf reader. It'll take a while since you need to catch a cellular keep alive but otherwise should be fine.

pgeorgi2• 3 years ago

it wouldn't surprise me if the car refuses to operate correctly

I know of a car (Renault in EU) whose SIM access is broken somehow that still works fine, just can't call home. No guarantee that every car will handle it gracefully, but at least some regions don't seem to mandate any enforcement if that module happens to "break".

throw37478747472• 3 years ago

I am pretty sure that is (or soon will be) illegal in EU. Car needs to be able to call emergency, if accident is detected.

justinclift• 3 years ago

"Oops, how did that happen..." ;)

chongli• 3 years ago

Will it also be illegal to drive an old car that doesn't have this telemetry?

loloquwowndueo2• 3 years ago

The manufacturer may have to legally include the functionality in cars they sell but in pretty sure the owner isn’t obligated to use or keep the functionality untouched.

By comparison if your seat belts are all frayed and you don’t wear them anyway that’s on you, manufacturer sold you a car with seat belts in good condition and that as far as the “compliance” requirement goes.

neurostimulant2• 3 years ago

Wait, new cars in EU are expected to have cellular connectivity?

lost_tourist5• 3 years ago

Is there some EU police that go around arresting people if you clip it?

PrimeMcFly4• 3 years ago

What about the the numerous older cars that don't have that functionality?

swader999• 3 years ago

There's likely five Sims at various places and even 3d printed into the frame.

delecti• 3 years ago

They're eSIM these days, so it's actually zero physical SIM cards.

noman-land3• 3 years ago

Check out the manual, find where the fuse is for the cellular modem, and remove it.

orev• 3 years ago

That’s quite a big assumption to think that it would be clearly labeled, and also that it would have a dedicated fuse. It’s not like that would be such a huge power draw that it needs its own fuse. Pulling the fuse would likely cause the whole infotainment system to go down.

bityard2• 3 years ago

There's more than a fair chance that the modem is built into or fused along with the entertainment systems.

mindslight2• 3 years ago

I feel like if this were happening 20 years ago, common wisdom would develop to buy from a list of model of cars where people had already blazed the path, directions of what the cell modem looks like and how to unplug it, prominent links to a community working on a libre replacement, and majority opinion of this is just what you should do to cope in the modern world. Now with the web community being so diffuse the majority opinion basically seems to be "whatevs". Perhaps if you dug into the right threads on the right manufacturer-specific forum you could find a thread or two with some investigation, but that's about it. It's also essentially impossible to navigate/compare the amenability of different makes to this.

FWIW I've got no actual experience, but given the general slowness with which the car industry moves I would guess the cell modem is just a module hanging off one of the CAN buses, receiving telemetry broadcast by other modules and injecting/interrogating commands when requested (like modern OBD2 ports). I suppose it could also be part of something like the gauge cluster that links different buses as well (at least on Hondas) but with the modular way cars seem to work I'd guess it's not likely.

I'd try to track down a copy of the factory service manual for your model. Those have seem to have gotten pretty thin these days too in favor of computer-based documentation, but it should at least help you work out how things are generally connected. (No point to the readily-available Haynes manual though. Those are apparently garbage)

wil421• 3 years ago

Removing the head unit and unplugging the “Bordeaux” and violet wire[1] may help and be easier to do. It’s the LTE and 3G antennae wire.

I have a 2019 Grand Cherokee and I think we both have the updated head unit. Let me know if anything works.

[1] https://www.jeepgarage.org/threads/uaq-antenna-connections.2...

grecy• 3 years ago

My 2021 Wrangler has a very obvious antenna on top of the roll bar, very easy to unplug. (There's actually two - one for SIM stuff, and one for the XM Sat radio)

hashtag-til3• 3 years ago

I think it will be a good differentiation factor in a few years, that a brand comes up with an offline car, i.e. a car that you just refuel/charge and drive - no telemetry/connected features involved.

It may be a niche thing in future, but certainly something that would be appealing to me as a consumer.

slashtab• 3 years ago

Open source Car!!

hashtag-til3• 3 years ago

That a good idea in theory, but that has a very high bar for non-advanced users.

What I meant is kind of just a regular brand that offers you a regular car with convenience features, but no telemetry/services involved. All local and offline - that's the catch for them, because what brands want is to monetize services...

BLKNSLVR• 3 years ago

Name's all sorted too:

The Oscar.

userbinator3• 3 years ago

The automotive enthusiast community has been building their own for decades.

birch2• 3 years ago

Oh, this would be an expensive hobby that I would embrace.

temp_gnuser2• 3 years ago

The rally fighter and other local motors vehicles are open source iirc, but I agree this should be the future.

morkalork• 3 years ago

Add analog buttons, knobs and I'm sold!

quietpain• 3 years ago

I think the insurance co will be the main lever in this story. If you have cameras & telemetry: standard insurance, open source offline car: pay premium.

hashtag-til3• 3 years ago

It is already the case today (at least in the UK). If you accept having a "black box", then you have a discount. I already pay the premium to not have that installed.

PS: I understand we're talking about the future here, just wanted to clarify that paying a premium for less telemetry is already here and not a hypothetical case.

throw1234651234• 3 years ago

Dashcams have worked just fine for a while, and they don't have to be connected to the internet to pull the data later SELECTIVELY, WHEN NEEDED. Yes, there is a chance it's completely destroyed, but it's fairly minor.

geerlingguy• 3 years ago

Maybe this is why Steve Jobs was working on an Apple Car... privacy as a selling point!

Grazester2• 3 years ago

Hope that was a joke.

LegitShady2• 3 years ago

I don't think so. tell it to the privacy focused television companies.

VoodooJuJu• 3 years ago

I don't see this happening. I see a lot of collusion between insurance, dealers, makers, and even the federal government to impose spyware for all future models.

bityard2• 3 years ago

I'm with you 100%, but reality is strongly not in our favor.

In order to bring a new car brand to the market, it literally takes the resources of a narcissistic billionaire, and even those are much more like upper-middle class status symbols than affordable conveyance for everyone. The regulatory hill is a steep climb on its own and the incumbents have a literal 100-year head start on how to sell cars to normal people.

Even if we just look at the tech sector... where are the privacy-preserving cell phones? There are none, unless you are willing to do not much else on it other than phone calls, text messages, and very light web browsing.

ravenstine4• 3 years ago

And unfortunately, the history of narcissistic rich people making cars is none too good. Such cars will either be overly expensive and require parts to be shipped from Italy, or they'll be totally shoddy "look at me" cars like Tesla or DeLorean.

Even if we just look at the tech sector... where are the privacy-preserving cell phones?

PinePhone?

thegrim0002• 3 years ago

The major brands won't do it, there's no money in it for them to do so, and there's so much regulation, regulatory capture that it's virtually impossible to start a new auto manufacturer without having billions of dollars of private equity to flush down the toilet on it, to target a very small fraction of the market that would want such vehicles, and such a company would just be quickly regulated out of existence if it was ever actually created.

ravenstine4• 3 years ago

Won't happen. Not enough people care. Convenience wins every time.

The only viable option is to get a used dumbcar and rip out the existing head unit.

hotpotamus• 3 years ago

My 2016 econobox would email me when a tire is low or it needs an oil change. I don't think this is all that new an issue.

stjohnswarts3• 3 years ago

why wouldn't it just show a dash light?

jmclnx2• 3 years ago

Yes, and that is why I will never buy new unless in the contract I have;

1. No data harvesting

2. If I or anyone discovers any kind of data harvesting, at any time, I get a full refund of the original purchase price plus interest plus 2000 USD from the manufacture. If not received in 6 months, it double ever 6 months.

But from what I understand, I heard due to Massachusetts "Right to Repair", all of that is turned off.

But time for the Federal Gov to step in. I expect they will since some Congress Critter will complain about the Auto Industry tracking them or their children. Or, more then likely, due to how the US Gov have been operating for the last 30 years or so, Congress people will get to purchase "special" vehicles.

0xcafefood2• 3 years ago

How do you buy a car that meets those criteria?

thfuran6• 3 years ago

You don't.

bell-cot• 3 years ago

I've heard of a few very-low-tech models, which are manufactured for NGO's to use in extremely remote places. Dunno if any of 'em would be street legal in a "normal" country. Those might qualify, and their sales process might be so customized that he could get such a contract. Maybe.

Otherwise, I'd guess it'll be "whatever it costs" vehicles aimed at the uber-rich, and their personal security details.

artursapek3• 3 years ago

you buy a good used car from the first decade of the 2000s or earlier

artursapek3• 3 years ago

lol

freeplay• 3 years ago

Of all the things that will never happen, this will never happen the most.

Androider• 3 years ago

There's telemetry, and then there's this https://arstechnica.com/tech-policy/2023/04/tesla-workers-sh...

inemesitaffia• 3 years ago

https://arstechnica.com/tech-policy/2019/08/apple-and-google...

GoofballJones2• 3 years ago

Thanks for linking to a 4 year old story. Now link to the follow-up stories to where Apple no longer does this and they were sued for breaking their privacy policy. Google still does it, as in their TOS they basically say "yeah, we're going to be looking over your shoulder at everything you do, as that's how we make our money".

TedDoesntTalk12• 3 years ago

That will be the norm for all car companies soon enough, not just Tesla.

sharikous• 3 years ago

China is now the biggest car exporter, thanks to the electric car boom.

Are there state security issues with Chinese cars too?

hef198985• 3 years ago

Yeah, we ban Huawei 4/5G infrastructure, and ban them fr using western / US tech, but are totally fine with whatever data BYD and EV OEMs do. But then TikTok and Xaomi are totally fine still, so what do I know...

api• 3 years ago

The entire area of connected devices is a security and privacy dumpster fire. However bad you think it is, it’s worse. Everything is full of both intentional telemetry and security vulnerabilities.

9g3890fj23• 3 years ago

I connect my phone to my 2015 Nissan's bluetooth, but just for music. GrapheneOS lets me prevent its access to my contacts, call history, active calls, text messages - anything but music audio. To me (but not the less tech literate, I know), if you're connecting your car to your phone, it's obvious that it is able to gather things about you.

That said, because I don't know much about cars, I don't know if the car is even capable of phoning home or by what means. Is it a 4G signal? Just a radio transponder? How do I even investigate without tearing my dash apart?

pragma_x• 3 years ago

I dug into the article, specifically the Nissan section. It reads like the car itself _could_ be gathering information on its own. IMO, the Nissan phone app is the more likely culprit here.

Unless there's something wild going on with XM, or there's a WiFi backdoor, the only other way the car is getting data out is over OBD2. And that's all engine, tires, and performance stuff: https://www.amazon.com/Turbo3-Leaf-Spy-Pro/dp/B00PMLTPN0/?ta...

Edit: OH. Looks like there's Over-the-air updates on some models. https://www.nissanusa.com/connect/features-apps/over-the-air...

The wireless features in your vehicle, including Over the Air Updates require use of your in-vehicle modem (if equipped). While Over the Air Updates are being made, some other wireless features may be unavailable or may require a wired connection. Please see FAQs for additional information.

9g3890fj23• 3 years ago

Interesting. I've never connected my car to my wireless network and I've never used the Nissan app. I think I used a burner email when setting things up, but that was years ago so I don't remember the details. I'll see what happens if I try an OTA update later today and report back.

bzzzt• 3 years ago

All new EU cars since 5 years ago are obligated to have 'eCall' which contacts emergency services in case of a crash. Most manufacturers solve that problem by including a 4G module.

Older cars also collect information. Most dealers read out the nav computer drive at service intervals so they also know where you've been, who you called etc, only a bit later.

giantg25• 3 years ago

Another reason to do my own service or find a trusted independent shop.

vanilla_nut• 3 years ago

One more reason I'm glad I connect my phone with a headphone jack. Just an analog connection carrying audio. The car doesn't even know what it's playing, as far as I know. Though some cars do seem to extract track names and artist names over the aux jack, so I think there's a little more than just an analog signal?

pgeorgi2• 3 years ago

I wonder if phones send out RDS (https://en.wikipedia.org/wiki/Radio_Data_System) information on the aux jack and your car happens to pick up on it.

Forbo• 3 years ago

This sounds like the content recognition they do on TVs. If that's the case, this is creepy as fuck.

stinos• 3 years ago

An analog jack should just be an analog signal, the beauty of it for applications like this being that it just works and for a variety of devices including the very first Sony Walkman to name just something which did not include any extra information. While in theory it is possible to encode extra and inaudible information in there, it seems more likely that if a car then knows what is playing it is just using Shazam or similar.

giantg25• 3 years ago

Possibly a side channel digital encoding of the track information, similar to how radio stations can display things like track name on your car radio. But I'm not really sure.

flangola73• 3 years ago

Audio jack can be used for Square payment transactions so it can't be that isolated

extraduder_ire4• 3 years ago

One downside I see to this is it being illegal to use a phone while driving, but interacting with your car stereo is fine.

Now I'm wondering if any car stereos have four-pin aux inputs to send headset button inputs or microphone audio back to the phone.

Larrikin• 3 years ago

Don't Android and iOS by default prevent bluetooth from accessing your contacts and calls. I know on Android you have to click a permission popup when connecting to bluetooth to allow contact and call access

TedDoesntTalk12• 3 years ago

Same on iOS.

giantg25• 3 years ago

Yeah, it's usually a cell module (older ones were 3G). Many times it's on its own daughter board and you can disconnect the bridge to the main board, or otherwise unplug it so it can't communicate with the car or towers. I did that to my car that has OnStar and the Bluetooth etc worked fine, but it couldn't transmit/connect to any network.

Grazester2• 3 years ago

The hell! You got a 2015 Nissan with Android Auto? I got a 2017 Infiniti that some trims did even come with Bluetooth, needless to say none had carplay or Android Auto. Damn you Nissan.

But I bought that car because its something for me to tinker with and I plan to replace that proprietary head until with an after one. And also use an Arduino 4 inch LCD to tap into the Can bus to show Hvac settings.

LegitShady2• 3 years ago

doesn't say android auto, just the nissan bluetooth. it has voice commands and can access your contacts if you let it, so you hit the talk button on the steering wheel and say "Call Bob D" and it will call, etc. It's kind of jank. same thing with reading out received text messages while driving.

No android auto required.

9g3890fj23• 3 years ago

Just regular Bluetooth, Android Auto and CarPlay are no-gos for me. I want less connectivity, not more.

birch2• 3 years ago

I always wonder to what extent those opt outs actually do something. I remember reading about the “unsubscribe” button for emails that never really did anything.

catlover762• 3 years ago

When you connect a phone to most cars via Bluetooth, the call and general audio permissions are separate from text message and contact info. So for example, in my mom's new car, I connect my phone so that when I drive it, I can take phone calls and listen to music. But for example it can't even display the contact name of contacts who call me, because it doesn't have access to that, so it just displays the phone number.

0xcafefood2• 3 years ago

It almost feels silly to ask, but is this legal even in the United States with its comparatively weak privacy laws? In many states, a vehicle is legally an extension of the home. So legal rights and protections that apply in one's home also apply in one's vehicle. Is the idea that, buried somewhere in the legalese, is a statement that the buyer is granting the automaker the right to spy?

ocdtrekkie• 3 years ago

Yes, the US is pretty nearly lawless when it comes to privacy issues. Half the protections we have today are "it's legally required in the EU but low cost enough to just do globally".

seanw444• 3 years ago

Considering the government uses the private sector as a cheat code to evade our 4th Amendment, this crap needs to be addressed.

giantg25• 3 years ago

Yeah, it's pretty sketchy but it seems the courts are allowing most it, even for second owner and non-subscribers (OnStar).

OnACoffeeBreak• 3 years ago

I am very unfamiliar with specific state laws regarding this, but there's a federal exception for automobiles when it comes to the Fourth Amendment:

https://en.wikipedia.org/wiki/Motor_vehicle_exception

rtb• 3 years ago

Probably not, but what can any individual do about it?

It's very difficult to show monetary damages in order to actually sue

hedora7• 3 years ago

The supreme court recently decided there's no right to privacy in the US (they used this as justification for rolling back Roe v. Wade). It's pretty clear they'll be taking away more rights over the next few years.

jgalt212• 3 years ago

Kia’s privacy policy reserves the right to monitor your “sex life,”

Please tell me this is lawyer CYA boilerplate, or is there a way for the shocks to tell "if this van's a rockin', don't come a knockin'".

catchnear43214• 3 years ago

somewhere a data scientist is cackling.

TedDoesntTalk12• 3 years ago

They have cameras and gyroscopes in the cabin. Pretty easy to figure it out even without the cameras.

rekoil• 3 years ago

Probably intentional to make sure they're not in trouble in case this happens to them: https://arstechnica.com/tech-policy/2023/04/tesla-workers-sh...

queuebert• 3 years ago

This reminds me of how my insurance app thinks I'm driving whenever I bounce my leg nervously.

gorbachev• 3 years ago

Earlier: https://news.ycombinator.com/item?id=37401563

pard689• 3 years ago

Things like this are a part of why my newest vehicle is an '04 Suburban.

TedDoesntTalk12• 3 years ago

But that won’t be an option in a few . How many 2015 cars will be on the road and for sale in 2035?

bob10292• 3 years ago

It's always going to be an option if you can afford it.

pard689• 3 years ago

I also have an '54 Chevy, a '62 CJ, a '69 wagon, a '68 Suburban, and a '84 Ford. I have a pretty good track record of keeping old things running well. Eventually my new cars (01 and two 03s) will cease to be repairable, but I have invested time and money in a very well maintained fleet of older vehicles, it's one of my only practical hobbies.

userbinator3• 3 years ago

It might actually be less than 1975 cars.

Most of the parts for a pre-computerised car can be made in a decent machine shop. The computers and software for newer cars are a huge contrast from that.

BurningFrog• 3 years ago

Strongly doubt gasoline powered cars will be street legal in 2035.

lefuturiste• 3 years ago

Get a bike (a muscular one) and problem solved :)

stjohnswarts3• 3 years ago

around here it's literally just the amount of time until you get hit by a car, everyone I've known who bikes (n=5) or motorcycles (n=4) on the regular has been hit. Only the severity varies.

Lolaccount• 3 years ago

Like my TV ... and my phone ... and my ... and my ink pen (connected via WIFI) ...

GoofballJones2• 3 years ago

The "inshitification" now extends to our cars.

cmurf• 3 years ago

How does GDPR affect this issue for cars bought/sold in EU market? Is the opt out complete? Does the right to be forgotten after the fact apply?

Msurrow2• 3 years ago

IANAL but this is clearly not even close to being legal under GDPR. Especially those collecting article 9 stuff (biometrics, genetics, sexual orientation, race, etc).

I think its just a matter of time before someone buys a new car that does this and takes the manufacturer to the EU courts. The argument that concent is given when you buy/use the car will not hold up for one second.

Car manufactors will have to allow you to use the car without collecting anything.

hugoroy• 3 years ago

My guess is that Mozilla only looked at the US market, and the article does not mention that this is US-only.

alwaysrunning• 3 years ago

Where is the host file so I can block all this data from being uploaded?

mikece• 3 years ago

Car dealerships are notoriously horrible about privacy as well. The last time I bought a car at a dealership they wanted me to sign a release that allowed them to use photos and videos of me as part of their television and online advertisement. They were stunned when I refused and threatened to nix the whole deal and I challenged them to do exactly that before (of course) a manager was summoned and eventually I was taken to an office to complete the purchase where I could not be accidentally caught on video or photos which would result in them getting sued for using my image and likeness.

darknavi• 3 years ago

And then you get about six years of SiriusXM mailers because they sell your data to them.

gspencley• 3 years ago

I bought a used vehicle at a dealership back in 2018. A couple of years later my daughter was looking for her first car and so we went to the same place. We were just browsing, and were met by a different sales rep. He had to excuse himself to tend to a different customer and during that time we left to go check out other places.

While we were at a different dealership I get an unexpected phone call. It was the sales rep at the first dealership, who I had never met before, and had certainly not given my phone number. I asked him how in the fucking hell he even knew my name, let alone my phone number, and he explained that the rep that sold us our vehicle in 2018 recognized me. I told him that was a very creepy and off-putting experience, that I do not consent to unsolicited phone calls from them, especially in such a creepy situation, and that I won't ever be purchasing another vehicle from them.

CamelCaseName• 3 years ago

"Recognized you"

I wonder where they put the facial detection camera

Bilal_io• 3 years ago

They have no respect for privacy. I use a Ford.com@domain.com to request a quote from Ford's official website. Apparently Ford shared my information with a dealer. That makes sense, but the dealer continued to email me and advertise cars from other manufacturers.

stjohnswarts3• 3 years ago

security in 95% of places is an afterthought. Your data is not really secure at all in the vast majority of places that keep it. Best you can do is be careful who gets it, and even then they often sell it.

vannucci3• 3 years ago

The more I read about these things, the more I think I'll be driving my 23 year old Toyota 4Runner until the end of my life

uberdru• 3 years ago

I am still driving my '09 4Runner. Cheap to own/maintain, ridiculously reliable. And no touch screen. Perfection!

Anything made after about 2015 feels WAY over-engineered, for my tastes at least.

aftbit• 3 years ago

Depending on your climate, you should probably have the right front frame member inspected for rust. My father had an '09 4Runner & got into a front-end crash. In the process that member was exposed, and while it looked fine on the outside, it was full of rust from the inside and quite thin.

Don't get me wrong, I drive an '01 Ranger that is more rust than steel at this point, but it is still good to know what you have.

vannucci3• 3 years ago

I totally agree I just feel like there's a sweet spot in the early 2000s where crash safety was better (not the best, but way closer to modern) and traction controls were standard but you didn't have all the spyware. My 2000 4Runner was unfortunately designed in the 1990s which means the doors are super thin as are the roof pillars. Not a deal breaker mind you, it's just the sort of thing that I won't want it until it's too late.

vidanay• 3 years ago

My 2002 Ford Excursion says "What's a SIM?"

toastal3• 3 years ago

I switched to a motorbike that has almost nothing ‘fancy’ about it--along with public transportation.

InitialLastName3• 3 years ago

Yeah, my bicycle tracks me so little that sometimes I track myself just to feel included.

hedora7• 3 years ago

If you have a license plate, then its being tracked with cameras when you use it.

sharkweek• 3 years ago

Yo fellow 3rd gen driver!

Bought my 2000 SR5 in 09 and it’s gone way up in value since then.

Have had 3 random people ask me over the last few years how much I’d take for it and the answer is always “not for sale.”

vannucci3• 3 years ago

Same here, I bought mine just as pandemic car prices plunged. It's not my primary right now but it might just become it. It's sad because I'm a car guy and I like some of the newer tech and all, I just can't stand all the markups and spyware and most of the time I just don't want to bother debugging my ride.

AndrewKemendo• 3 years ago

I've never bought a new car and don't have any plans to soon

My 2001 Tundra is a spy-free, comfortable and versatile life/work vehicle that works as well in the city as it does hauling logs and steel on my property. I have three school age kids and prefer my truck to a Van (I've owned one in the past too) any-day.

LeSaucy• 3 years ago

With the next Gen Toyota platforms all coming to market, it’s the end of an era for sure. I will be driving my 2nd Gen tundra into the ground!

giantg25• 3 years ago

Not a bad plan. There might still be some options out there. The previous generation of Silverado (14-18?)you could get a work truck without OnStar or anything. Didn't even have a key fob or Bluetooth. Costs a hell of a lot less too.

lost_tourist5• 3 years ago

2012 mustang here, one reason I got it instead of a camaro (which I like better) was because every single camaro I looked at had onstar.

WalterBright• 3 years ago

My '72 Dodge sez hello.

j1elo• 3 years ago

Except when you live in a city where they start to limit and ban transit of older cars, to force people transitioning into lower emission models, or public transit.

Like in Spain (through rules ultimately coming from Europe) there is a class of vehicles which are gradually being kicked out (banned from crossing certain very ample boundaries around the city): gasoline cars made before 2001, and diesel powered cars made before 2006.

For example, your 23 year old Toyota 4Runner would be deemed too polluting (or noisy, or both) to drive near the city center and auxiliary accesses of Madrid, and starting from 2025 it will be outright banned from driving on any part of the city, with a circle area of ~23 Km (14 miles) diameter from the center.

maxwell• 3 years ago

Also rolled out in London.

https://en.wikipedia.org/wiki/Ultra_Low_Emission_Zone

dangus4• 3 years ago

American carbrains can’t imagine a society that doesn’t depend on huge ass vehicles for daily transportation.

A reminder that driving isn’t a right, it’s a privilege that you have to get a license to do, and many other places that aren’t America don’t design their cities and even their small towns [1] around the idea that you must own a vehicle.

Congestion taxes and pollution rules tend to affect city centers where personal vehicle ownership is unnecessary and even something that could be considered detrimental to society as a whole.

I didn’t agree to die early due to elevated pollution levels in my city just so you can drive your truck around downtown.

Approximately half of all global oil use is associated with roadways. Maybe draining the world’s oil is a solid plan for the oil states and geopolitically massive superpowers of the world, but many countries have to import all of their oil, so owning a 19mpg Toyota 4Runner in a country like Spain is arguably a national security issue.

[1] https://youtu.be/ztpcWUqVpIg

geitir• 3 years ago

In many states in the US if your car lives long enough you get rewarded with exemption from emissions requirements!

photochemsyn• 3 years ago

The best way around this for those wanting an EV car is to get a classic car that's been well-maintained and do an electric conversion. The only 'infotainment system' anyone needs is a tablet or phone; a charging system for electronic devices shouldn't be too hard to set up either.

Waterluvian• 3 years ago

Okay so you wanna hear something absolutely horrifying?

My new CPAP machine has a 4G modem and it shares all my sleep data with the company. There’s some people at the local office who can tell precisely when I’m asleep and how asleep I am.

Could you possibly want any better data for when to rob someone?

I’ve put the thing in airplane mode and they called saying they can’t get the data needed for the first month, required for insurance purposes. Nope. My last machine had an SD card. How about you do that instead?

empyrrhicist• 3 years ago

It just seems to get worse and worse. We desperately need a consumer privacy bill of rights.

madethemcry• 3 years ago

I had to look it up: CPAP = continuous positive airway pressure; to treat sleep apnea disorder

I do have sleep apnea disorder but probably a mild one as I don't feel exhausted at all. Reading your comment sparked the idea that it might be a good idea to verify the severity. If there will be any CPAP machine involved I will for sure think of its privacy impact.

kkfx• 3 years ago

I have a new EV (a modest MG ZS long range 2022) and I'm not much concerned about privacy BUT much, much, much more about remote controls ability from the factory AND potentially someone else due to some crapware vulnerabilities who happen to be vast https://samcurry.net/web-hackers-vs-the-auto-industry/

My take is simple:

- all cars can be connected BUT the connection must be user controllable, meaning the car must run on FLOSS easily installable by the formal owner;

- all cars can offer remote controls BUT in a classic ssh-alike fashion, meaning it's ok to have a web(cr)app for end users, but not proxyed by the OEM only. OEM might act as a proxy to circumvent NAT, but the user is free to choose a DynDNS and other P2P/distributed solution hosted alone.

In mere privacy IMVHO my car can snoop videos of me/anything surrounding / capture audio no more and no less than an Android or iOS macrospy also know as smartphones. So I'm equally concerned BUT so far such smart devices can't potentially lock me outside in the middle of anything, making me crash on some people and than state I'm a terrorist crushing on purpose and so on. Witch limit much the risk surface.

bradley13• 3 years ago

I want to know how these license agreements work, legally speaking?

We bought a new car and signed the purchase agreement. Nowhere was there anything resembling a software license. Some months later, the display has a pop-up "our terms and conditions have changed". Um...which terms would those be, and when did we ever agree to them? Anyway, how can they make a one-sided change to a contract?

verisimilitude• 3 years ago

Here's the relevant legalese from Toyota: "By purchasing or leasing a vehicle equipped with an active Connected Services system, you specifically consent to our electronic collection and use of your account information and vehicle data and our storage of such data wherever we designate."

"Fun" right?

AnonymousPlanet• 3 years ago

Does the new owner of a used vehicle have to sign this too? And if this was skipped during the selling process, is the data now collected in the name of the previous owner?

jklinger410• 3 years ago

Also, as a PSA: Your local state government sells car registration data to data brokers and car manufacturers. It is often used for behavioral targeting.

Tangurena22• 3 years ago

I used to work for a state motor vehicle agency.

Federal law requires the manufacturers get your up to date mail address for recall purposes.

Legislators make sure that the agencies sell that data (this is the source of those "we've been trying to reach you about your vehicle's warranty" letters/calls). Sometimes they interfere to ensure that their buddies/lobbyists don't pay for it.

vel0city• 3 years ago

I doubt these datasets have anything to do with the "we've been trying to reach you about your vehicle's warranty" calls, as I know people who got a lot of those calls but never owned a vehicle (some were even minors!). Every time I listened to one of their messages it never had any actual targeted car information.

jen204• 3 years ago

Every time I've bought a car recently (which for Reasons has been a few times), I've ended up with utter scum sending mail designed to look "official" while skirting the actual reserved terms trying to scam me into extended warranties and so forth.

If I had more time I would use their free return address to ship boxes of broken bricks.

nologic01• 3 years ago

Once you normalize this state of affairs in one digital sector (social media, search, whatever), you've normalized it, period.

You can't say: X and Y can milk this, but Z and W cannot. Everybody will want to get a piece of action from such a lucrative scheme.

In turn once the managing elites of all these formerly non-tech sectors that get increasingly digitized (mobility, finance, insurance, health etc) get satisfied that their legal / reputation risk is manageable they will invest further in this direction and lobby hard to preserve their investment value against "intrusive and innovation limiting regulation".

It all follows logically and it is a dystopic downward spiral that has no bottom.

catlover762• 3 years ago

You can't say: X and Y can milk this, but Z and W cannot.

It is totally doable for the government to regulate social media differently from automobiles--it's happening right now!

netbioserror• 3 years ago

I have a 2019 Subaru Outback. I also use GrapheneOS on a Pixel 3A. I have noticed that, when my phone is plugged in and I have location services enabled (for navigation), when I'm NOT using navigation, the icon in the top bar indicating location services being used pings once every 30 seconds.

I'm sure onboard cell modems can be used to triangulate well enough, but just knowing that my car likes to hitch a ride on my phone's sensors has creeped me out forever. I'll definitely be looking for an old beater car as my second when the time comes.

tristor8• 3 years ago

Of all the horrible things go on with privacy these days, this is the one I hate the most. I’m a “car guy”, but not the sort that obsesses over old cars (although I do love 60s and 80s cars). I like new tech, I like the advances in engineering we’ve made in new vehicles, I like EVs even.

Nonetheless I’ve been in the market for a new car for months and haven’t bought because it’s hard to find any cars that meet my requirements (after all most companies primarily make trucks and shitty crossovers, not even cars). The two things that consistently hold me back are either things like this (crazy telemetry / touchscreens everywhere / half-ass safety tech) or insane dealer markups. I’ve pretty much figured out the new Toyota GR Corolla is the perfect car for my needs, but you can’t find them anywhere without a $25K+ dealer markup and many dealers won’t sell them to out of state residents.

It’s truly a crazy time in the new car markets and the used market isn’t really any better.

psyclobe• 3 years ago

Find a private broker to locate and acquire a car for you

tristor8• 3 years ago

And how does that result in a more reasonable cost profile than paying an insane dealer markup that’s half the MSRP of the car? A Corolla shouldn’t cost $70k.

cpursley6• 3 years ago

The touchscreens are really a dealbreaker on new cars.

They’re not just prone to quick obsolescence, they’re dangerous.

tristor8• 3 years ago

I hate them so much. Otherwise great cars are completely ruined by touchscreens. What was wrong with tactile knobs you could operate one handed without looking? You’re driving for fuck’s sake.

It’s why things like the GR Corolla are nearly miraculous in 2023, it even comes stick shift only.

guestbest• 3 years ago

I think they put in the touchscreens because it makes internationalization easier. No physical labels and OTA updates. Personally, I don’t think digital internationalization is good for the driver since it appeals to the lowest common denominator of interface while adding another expensive component to replace in case of damage.

thorin• 3 years ago

Is this a US thing? I recently bought a reasonably high end Skoda (which I think would be made in the same factory as VW, SEAT etc). It has a big touch screen in the centre console, but that's really only used for the radio / media / phone calls etc. This is all non essential stuff and so I can deal with it being on a screen. Everything relating to driving is an old skool analogue control.

A couple of things I don't like is the pull switch for parking brake, it's the first car I've had without an old skool handbreak, it feels unnecessary, but ergonomically it's fine. Also it's a key less ignition with a button to start. Again I don't see why this benefits me, but I can deal with it. I do worry about having a smart key though as I'm often on the water kayaking/surfing but it's been ok in a waterproof case so far.

neogodless2• 3 years ago

We just bought a 2023 Mazda CX-5 Select for $29k. No touchscreens in the whole car! And no dealer markup - we paid slightly under MSRP.

But... it is certainly satellite connected (you can manage locks, windows, etc. from your phone, as well as remote start). Wish it was included in this privacy investigation. I'd love to know more about what they do with what they know about our car and how we use it.

tiffanyh• 3 years ago

Do you ever use your mobile phone while driving?

Call, talk, text, maps, etc.

How is it any more dangerous than how a typical person uses their phone today while driving?

For safety: all common systems are accessible on most steering wheels (e.g. radio, etc) so that your hands never have to leave the steering wheel.

gumby2• 3 years ago

I recently rented a cheap sedan and was shocked: there was a small screen for carplay that didn't interfere with the dashboard and all the other controls (volume, climate, etc) had hard buttons. After a couple of days of driving I could do everything without looking away from the road.

Meanwhile the expensive cars are frightening to drive as you need to look away from the road to do anything.

Pxtl• 3 years ago

I drive a Prius and while the actual implementation of the touchscreen leaves a lot to be desired (dodgy software and usual issues with obsolescence), I do like the way it splits between touchscreen and buttons.

Buttons: all car controls, audio volume and selection, temperature.

Touchscreen: GPS, setting radio presets, changing climate mode.

Now, it's not perfect -- there are some climate options I'd like on buttons. But in general that's pretty good.

The big flaw is the lack of upgradeability. It felt a decade old, stylistically, when it was new, and it will never get newer. You can't even pop in a new car stereo to replace the whole thing anymore - and it's a massive chunk of the dash. And has no support for Android Auto.

recursive• 3 years ago

I'm part of the market segment that demands them. I didn't have an opinion, but then I lived with one for a year. I don't think I could go back.

devilbunny• 3 years ago

I don't know about their markups, but Mazda has been pulling out touchscreens and putting back buttons for audio and climate control purposes. Not sure how far it's made it through their models.

ghaff11• 3 years ago

A 2022 Honda Passport has physical buttons for pretty much everything. The only thing I use the touchscreen for is as a display for maps from CarPlay (and the backup camera). So reliance on the touchscreen for things like environmental controls isn't universal even in new cars.

tristor8• 3 years ago

Sadly Mazda doesn’t make any AWD cars, only a crossover. AWD is a requirement for me. I loved a Mazda 2 I previously had and loved the Miata track car I sold when I moved last year. Mazda makes great cars but unfortunately none that meet my base requirements.

for1nner• 3 years ago

Mazda always refused to go fully touchscreen.

Instead they have somehow rationalized that a control wheel and featureless buttons down in the center console are safer for people to use while the vehicle is active.

It's idiotic.

ranger_danger2• 3 years ago

FWIW Mazda's current lineup allows you to turn off telemetry while still allowing emergency calls, and they still make non-touchscreen models.

wahnfrieden2• 3 years ago

Including govt wiretapping of those sensors?

nilespotter• 3 years ago

I have a crossover, it's nice

yafbum2• 3 years ago

Kia driver here. There is a screen in my car, but also actual knobs and steering wheel controls for everything I might need (audio controls, climate controls) and when I use the screen to project my phone, almost all functions there can be activated through voice control.

spacemadness3• 3 years ago

These markups are insane, and I wonder if anyone actually gets anywhere near paying them. I don’t really see the point since for those markups you can just get a nicer car. Unless car collectors really are that out of touch and flush with cash.

seattle_spring3• 3 years ago

Unfortunately lots of people are happy to pay the markups. Some subreddits, including /r/rav4prime , will ban you for speaking negatively about dealer markups or those who pay them. Here's their hilariously condescendingly worded rule 4:

No demonstrations of economic illiteracy. No negativity regarding markups. You are encouraged to post about current prices and markups and your dealership experiences, but please DO NOT express moral value judgments about markups or their absence (except those involving bait-and-switch).

Animats• 3 years ago

Dealers being able to insist on those huge markups ended a few months back. Overall, US auto dealerships now have more cars in stock than usual. Don't take those markups seriously.

brandonagr2• 3 years ago

If you want best in class safety tech and no dealer markups, you can just order a Tesla online

r2_pilot2• 3 years ago

Not to mention the occasional automated drive into stationary objects. Guess that's partly why they have the "best in class safety tech".

hoot• 3 years ago

I’m not an Elon hater but Tesla is the worst offender on Mozillas privacy study.

FireBeyond4• 3 years ago

“Best in class” safety tech…

No, Teslas have a specific safety rating.

In the Luxury Sedan segment with the same safety rating are 13 other vehicles.

In the Luxury SUV segment there are 19.

“In a high safety class” is accurate, but there’s nothing in those ratings to say the Tesla is the safest of them.

klaussilveira• 3 years ago

Try Mazda. No touchscreens, no account shenanigans. Make sure you decline the app in the dealership, though.

hedora7• 3 years ago

I was planning to get a Nissan Leaf (worst privacy among all manufacturers in the round up) but luckily stumbled on a BMW i3 instead. They have the best telemetry story by far, and it has a well-implemented jog wheel instead of a touch screen. Also, it has a carbon-fiber frame. It looks like a tall econobox, but handles extremely well.

The i3 has been discontinued and the new models have a touch screen in addition to the jog wheel, so it's possible the jog wheel on those is poorly implemented, and not enough to actually use the car.

I haven't test driven one of the newer models, but I'd carefully check the computer UI before purchasing one.

Anyway, I'm hoping BMW succeeds with their contrarian approach of having physical controls, and not treating their customers terribly, and that the other manufacturers follow their lead.

thfuran6• 3 years ago

Didn't bmw turn seat heaters into a subscription service? I'm not sure avoiding treating customers terribly is really their thing.

dataminded• 3 years ago

This is me. I bought two new cars every 2 years like clockwork. We replaced one car because we NEEDED a larger family car and have gone without the 2nd for over a year.

It feels impossibly hard to buy a great car today.

bonestamp22• 3 years ago

The touchscreen is great for some things of course, but most regular people that comment seem to agree that tactile controls for radio and HVAC are their preference. The only explanation for why manufacturers are dropping the tactile controls is for cost savings/higher profits. Because it sure doesn't seem like most people want those items on the screen.

tim333• 3 years ago

Theres something to be said for old bangers. I had a 31 year old mx5 and now a 13 year old E class. They don't have the touch screen sillyness and tend to be much cheaper to run if you include depreciation. You have to get stuff fixed about once a year with those.

lunias• 3 years ago

I currently own a 2012 VW GTI that I bought new 11 years ago. It has 123k miles and lots of modifications. I recently compiled a short list of both EVs and ICE vehicles to compare against it; the Toyota GR Corolla was on my list:

2023 Toyota GR Corolla AWD

3285 LBS / 300 HP = 10.9 LBS / HP

RANGE: 25 mpg * 13.2 gallons = 330 mi

PRICE: 44k

--------------------------------------------------

2012 VW MK6 GTI (K04) FWD

3000 LBS / 330 WHP = 9.1 LBS / WHP

RANGE: 23 mpg * 14.5 gallons = 333 mi

PRICE: < 30k (to buy a used GTI and install the same mods including labor)

--------------------------------------------------

I think the GR Corolla is great, but even after 11 years it's sadly not really a convincing upgrade for me. The GR Corolla is less powerful (in both torque and horsepower), it has one less cylinder and less displacement, it weighs more, it gets essentially the same mileage and has the same range, and it costs much more. The Corolla does have AWD though.

Here's the common "upgrade" for me:

2023 VW Golf R AWD

3400 LBS / 315 HP = 10.8 LBS / HP

RANGE: 28 mpg * 14.5 gallons = 406 mi

PRICE: 47k

--------------------------------------------------

Again, the Golf R is also great, but it's also less powerful and weighs more. It gets slightly better mileage than my current car, but costs even more than the GR Corolla.

Finding something new that is "better" out of the box than my 11 year old GTI would cost me at least 56k (Toyota GR Supra RWD) or if I want AWD then it's more like 66k (Audi RS3 AWD). If I want something electric and "better" then it's at least 89k (Tesla Model S). These prices are really high to begin with; when you add in dealer markups they become insane propositions. For your money you'll also have to contend with with touch screens, capacitive buttons, and a bunch of other tech that you don't want or need. The market seems to be in a pretty sad state for car guys. Unless something changes I'll be rebuilding my engine with forged internals and continuing to drive my GTI.

tristor8• 3 years ago

FWIW, you’ve arrived at some of the same conclusions that I have. The only cars really in the running for me now are the GR Corolla, Golf R, RS3, and at least temporarily I’m probably going to start with a Mazda3 Turbo since it’s AWD now.

taylodl2• 3 years ago

This article doesn't go into any benefits to the driver/user, if available. With all the cameras and microphones in cars these days they can at least send the insurance companies all the data when an accident occurred. Were you on the phone? Driving the speed limit? Have your seat belt on? Braking hard to avoid (or cause) an accident? Heck, give me a monthly riding report with information such as how fast I accelerate, how hard I brake, how often I speed, and stuff like that. Then provide tips on how to improve my driving. At least that would be useful.

lost_tourist5• 3 years ago

that sounds like a nightmare to me and should have to be opted into, I would never purchase a car with that. I'll just get a motorcycle and risk my life.

taylodl2• 3 years ago

Nightmare? It's a black box. It can save your bacon if you're falsely accused. Cars have a lot of sensors these days and if those two cars get into an accident you can re-create the entire accident.

kayodelycaon• 3 years ago

I have a new Toyota and the owner’s manual mentions the car has a black box that records a number of parameters.

Nifty39293• 3 years ago

The biggest problem I have is tracking that the government has access to. We're in a situation where the government knows everywhere your phone has been, and everywhere your car has been. I doubt we're far from the gov't being able to de-activate your car at will also.

I would like to have privacy from corporations, but I really wish we'd keep the focus on privacy from our governments, since they have such ultimate power over us.

kornhole3• 3 years ago

Kill switches are now required for cars produced after 2026. https://www.musclecarsandtrucks.com/biden-infrastructure-bil... It is for your safety. ;)

eficek• 3 years ago

https://apnews.com/article/fact-checking-402773429497

TheLoafOfBread4• 3 years ago

Of course, that it won't be disabled by crooks and used for crimes like kidnapping people.

Nextgrid2• 3 years ago

The problem is that the private companies tracking you can be compelled (if they don't voluntarily) give up your tracking data to the government.

Stopping government tracking starts with stopping private industry tracking, as the latter is happy to give it away/sell the data or can be forced to by law.

Nifty39293• 3 years ago

I agree with your premise, but disagree with your conclusion.

Yes, of course data that goes to the corporations gets scooped up by the government.

But we need to stay laser focused on the main goal of maintaining privacy from our government, which may include efforts at privacy from corporations.

hedora7• 3 years ago

In the US, the government has access to 100% of the information the corporations have.

Also, corporations have all sorts of power over us that should be reserved for the government. For instance, they control electronic currency, freedom of association (online), and your ability to distributed and purchase most media.

The government has been able to use onstar to deactivate GMC vehicles at will for over a decade. Of course, GM can do this too.

mantra2• 3 years ago

I think I'm alright - I mean - my FJ Cruiser doesn't even have carpet.

b8• 3 years ago

Also as shown in Mr Robot, the LE can remotely stop a car via OnStar.

flangola73• 3 years ago

Is that really a thing?

CatWChainsaw• 3 years ago

Yes, and it has been.

bjnewman85• 3 years ago

Can't capture audio info when i'm blasting music at max volume with the windows down on the highway yelling at my friends. Privacy Win!

lost_tourist5• 3 years ago

That's one reason I'm saving up for an EV conversion lol. I just need a car to go from A -> B. I don't need self driving, constant updates, a blackbox, cameras everywhere, etc. Just an EV, with a good drive train, decent range, etc. It's the only reason I'm still using a dino car. Legislation for privacy will needs a huge overhaul in preference to the rights of individuals rather than corporations.

ricktdotorg2• 3 years ago

The worst offender was Nissan, Mozilla said

this is ironic; my wife bought a brand new 2020 model year Nissan 370Z 50th anniversary edition in 2021, and it feels like it is from the late 90s.

no touch screen (actually no screen at all!), no GPS/navigation, no tracking, no Bluetooth audio streaming(!!) it does have mobile phone Bluetooth connectivity and a terrible backup camera but those are the only bits of modern in-car tech it has.

it feels like a very analog modern sports car without any of the crap that most modern sports cars have.

more of this please!

sadly, seems like the new Z coupe went all-in on the in-car tech, much like Nissan's other offerings.

EricE8• 3 years ago

How can it have no screen? They even forced Mazda to put a back up camera in the Miata - which is beyond idiotic.

bas3l1ne2• 3 years ago

Backup cameras weren't required in vehicles until (i think) 2018. My guess is that (similar to banning popup headlights), it was only required for new vehicle models released. The 370z had a ridiculously long production run starting in 2008, so they weren't required to put one in

ricktdotorg2• 3 years ago

it really does have no screen at all!

the backup camera shows up on the rear-view mirror, taking up about ~40% of the width. it's really the jankiest thing and is shockingly bad for a 2020/2021 car!

(edited for clarity)

wahnfrieden2• 3 years ago

The kind of information collected varies from personal information like medical data to how drivers are using the vehicle itself — such as how fast they drive, where they drive, and even the music they listen to. Both Nissan and Kia are noted to allow the collection of information regarding a user’s sex life.
Eighty-four percent of the reviewed car brands share personal user data with service providers, data brokers, and potentially sketchy businesses, according to the report, with 76 percent claiming the right to sell that personal data.
Tesla was the worst-ranked brand in the study, getting flagged in every privacy category — only the second time this happened.
Alongside the report, Mozilla also published a breakdown explaining how car companies collect and share user data. This can include anything from the user’s name, address, phone number, and email address to more intimate data like photos, calendar information, and even details on the driver’s race, genetic information, and immigration status. Mozilla says it also couldn’t confirm that any of the automakers could meet the organization’s minimum security standards regarding data encryption and protection against theft. In fact, it claims dating apps and even sex toys typically provide more detailed security information about their products than cars.

intrasight• 3 years ago

I just don't see this issue getting much traction until something really bad happens to a large group of powerful people. But even then it may not come to light as said people will cut a deal with car companies to exclude them from telemetry sighting "national security". They of course won't publicize this and when it inevitably becomes public they will just shrug.

It won't get traction for the average person because the immediate effects are positive (lower insurance) and the dangers are very theoretical (a bad actor knowing where my car is). People are much more concerned about the near and present danger of bad actors hacking their financial accounts and stealing they hard-earned money.

kornhole3• 3 years ago

I spent a lot of time researching all this a few years ago when looking for a new car. Despite the ability to afford any car, I am still riding a bike and taking public transit because of what I discovered. I know this is a difficult option for people in many places, but I am happy. Car makers should take notice that a growing number of people like me want a FOSS OS rather than an Iphone on wheels.

renegat0x0• 3 years ago

In modern era everything mechanical, or analog is being replaced with digital, or with something "as a software". Product is replaced with "service".

When everything becomes in the end connected with the Internet, everything is dependent... A system crash of AWS, Google, or any other monolithic provider will have drastic results. A system crash could halt many cars in a country. In the future Hackers could stall entire country transportation.

With oligopoly,monopoly the power player can decide with very granular precision what you can, and cannot do, where you can go. You have no power to object. Even government bodies could be against you, or could be too small to fight big corporations.

- cameras in cars. What they will detect? If I am drunk, or something more? Will there be glitches to record more stuff? Will the cars have back doors for governments?

- what kind of data will cars collect? Audio? Video? Biometrics? Facial data? Hate speech?

- they can analyze where you go, why you do something, maybe for analytics, for governments, or for ad business

- they can define terms of conditions, which of course can allow the producers to sell your data to third parties for cheaper models of cars

At first you will be able to mitigate. You will be able to buy older cards. Eventually we will not be able to choose a different life. There is no really opt out if everybody implements techno-feudalistic software patterns.

enriquto• 3 years ago

There is no really opt out if everybody implements techno-feudalistic software patterns.

I have bad news for you: https://www.gnu.org/philosophy/right-to-read.en.html

lotsofpulp3• 3 years ago

cameras in cars. What they will detect? If I am drunk, or something more?

The more would be if you are watching your phone, in 99% of cases.

whoChumpedwho• 3 years ago

exactly the wrong question will not be asked. at any rate, you built this theme park; you protect this theme park. no worries

charles_f3• 3 years ago

This is very much in line with the industry trying desperately to get into the tech recurring revenue model.

the manufacturer collects information including sexual activity, health diagnosis data, and genetic data, though there’s no details about how exactly that data is gathered

How is that even possible? Without more details about what this means and how it's done, this sounds a bit fishy to me.

Mozilla said it was unable to determine whether the brands encrypt any of the data they collect

Given the auto industry's track record at security, I'm gonna go ahead and assume they _all_ store all that in a 2005-era non updated mysql database protected by root/password exported nightly as a clear-text csv file to an open network folder. And since they all do it they can call it an industry standard.

Berg said the MercedesMe Connect app gives users privacy settings and the ability to opt-out of certain services.

Given that these folks try to sell you everything in the car you already bought as a service, that's a nice way of saying "if you're concerned about us collecting stool sample while using rated seats, you can use your car as a decorative piece in your garage if you want,l".

lambdasquirrel• 3 years ago

How is that even possible? Without more details about what this means and how it's done, this sounds a bit fishy to me.

Did you visit some explicit site without VPN (or at least a private tab)? Bingo. The data brokers will correlate you. Once your data can be correlated, whatever they gather is thrown into the pool. I'll bet that there's some back-scratching going on somewhere. Hey we know all about where John is at when he's driving, and we'll sell/give you that data and in exchange we'd like to buy/trade some ads on those other sites-of-interest he/she goes to.

charles_f3• 3 years ago

When it comes to privacy data handling, the term "collecting" is a very specific term that means they are directly collecting it from you, so, unless they use the term in a non standard way, that means they supposedly collect your genetic material and sexual preferences _from you_. Which, erk, but also, how?

alwaysbeconsing2• 3 years ago

Without more details about what this means and how it's done

The article seems to be based on a review of the privacy policies rather than sniffing actual collected data. We can conclude the policy leaves openings for them to do it, but it may not in fact be done at this time.

cortesoft2• 3 years ago

How is that even possible?

Yesterday, you visited a dating site a bunch. Today, you drove to a house that wasn’t yours and the passenger side door opened. Then you drove to a restaurant and the passenger side door opened again. Then you drove back to the house you don’t live at and the car was there overnight.

m4632• 3 years ago

Or more directly:

https://www.reuters.com/technology/tesla-workers-shared-sens...

they have interior cameras too, above the rearview mirror.

araes• 3 years ago

From: https://www.nissanusa.com/privacy.html

"How is this possible" re:

collects information including sexual activity, health diagnosis data, and genetic data
Sources for collection: Direct contact with users and Nissan employees.

Also:

by occupying a vehicle that is utilizing such services you agree to Nissan collecting and using the information
You promise to educate and inform all users and occupants of your Vehicle

Interesting Note: I think this implies if you are a Uber / Lyft / ect... customer you consent to Nissan collecting your sex activity and genetic information and all related secondary analyses by occupying the vehicle.

UtopiaPunk2• 3 years ago

Who wants to see my impression of an HN commenter? OK, here it goes:

"I'm tired of Mozilla's agenda and politics!! They should only make a web browser!!"

spacemadness3• 3 years ago

OK? I don’t think that sounds like an HN commenter at all.

OnionBlender• 3 years ago

The other thread delivers.

https://news.ycombinator.com/item?id=37406265

temp_gnuser2• 3 years ago

FYI, on many systems you can rip out or otherwise disable the lte/sat boards and prevent data transmission. Sometimes it takes a touch of soldering.

charles_f3• 3 years ago

Note that this is all based on this source material. https://foundation.mozilla.org/en/privacynotincluded/categor...

I haven't dug too much into the methodology, but it seems like it's done based on privacy policies rather than actually looking into the car telemetry traffic. It's also written in a very caaual and sensationalist "omagad" tone that doesn't serve well the seriousness of the topic or findings

sfaxon2• 3 years ago

I own a VW ID.4. For reasons I wanted to reverse engineer some of the API. After authenticating to the account tied to my car, the landing page (https://www.vw.com/en/owners.html) makes calls to a lot of analytics trackers. I'll just list what pi-hole defaults block:

analytics.tiktok.com

sp.analytics.yahoo.com

googletagmanger.com

universal.iperceptions.com

cdn4.userzoom.com

snap.licdn.com

secure-ds.serving-sys.com

bat.bing.com

ct.pinterest.com

adherent.com

And a few others. I would guess the phone app (which has access to the car location) has a similar list of trackers. I hope to get some time to MITM the app to be able to know for sure.

creeble• 3 years ago

Just to be clear, these are trackers from the web page, not trackers called by your car, correct?

I'm never surprised by the web trackers (which my ad blocker generally filters too), but 3rd-party trackers called from devices/vehicles seems more insidious.

Although the car / IoT companies can just as easily outsource the data once they have it anyway.

spookie• 3 years ago

The language also took me by surprise. Not a fan. Really, if you want to connect with people on this topic just mention "abortions", and "data sold".

JeremyNT• 3 years ago

Thanks.

I read the original article and conspicuously absent is the actual mechanism of the data collection that is occurring here. Some of the claims seem barely believable.

Is data exfiltrated from the phone, via some kind of data access loophole in Android Auto / Car Play? Are the microphones in vehicles actively listening to conversations and shipping them off for analysis? Or is this all purely hypothetical (i.e., they say they have the right to use it, so clearly they must be trying to acquire it...)?

The only techniques I can imagine that might lead to collection of data such as sexual activity are truly egregious indeed, and although I have incredibly low trust in auto makers such techniques seem like a bridge too far, even for them.

philsnow2• 3 years ago

Are the microphones in vehicles actively listening to conversations and shipping them off for analysis? Or is this all purely hypothetical (i.e., they say they have the right to use it, so clearly they must be trying to acquire it...)?

All data that they can acquire will be acquired because data can be sold, leading to higher quarterly profits. There are almost no other considerations.

TheRealDunkirk• 3 years ago

A lot of people are making comments about defeating the telemetry, but it's not just about selling ads this time. This is about actual surveillance and (eventually) control, and the governments of the world will make this a requirement, and make circumvention of it as illegal as copyright infringement. In the US, the government will throw up it's hands and say it's not us; it's the "free" market, and this must be what people want, while all the automakers collude to do it, collect the data, and either let the NSA have it, or don't resist when they tap into it. And some people will think this is a good thing, because then we could throw literally everyone who was at J6 in prison, but then a conservative government gets thrust into power, and now they can go after everyone who was present at a BLM protest that turned violent (but I repeat myself). Whatever power "we" let "them" have will eventually be used against "us."

EricE8• 3 years ago

just wait until insurance companies demand access to your telemetry or they triple your rates.

lotsofpulp3• 3 years ago

Why would they triple your rates? Insurance regulators do not let insurers increase premiums unless they have evidence showing the new data indicates a higher risk factor.

So if you are getting your rates tripled, then you were being subsidized by safer drivers before, which seems like something that should be fixed.

Dash cams have already probably given insurers a better idea on who is a riskier driver and who is not since collisions can now be more accurately attributed to the at fault party.

eclipticplane• 3 years ago

They already do the opposite. Usage-based insurance gives you per-day/per-trip insurance in exchange for tracking (Milewise) or to drive discounts off your existing rates. (RightTrack)

Night_Thastus7• 3 years ago

I had to go this route already. As a new driver, my rates were quite high - and the best option for lowering that was letting them track my driving through an app on my phone.

I don't particularly like it, but it's something I'll just have to live with.

m4632• 3 years ago

The telsa insurance already does this.

remember, the dark pattern of this is to raise the price, then discount for access.

yafbum2• 3 years ago

The article is not very clear about whether this kind of abusive data collection is actually happening and they can prove it, or whether they found the text of the privacy policies to be overly broad. I have no idea how a car would infer my sexual orientation.

drdebug• 3 years ago

May be if you drive often near bars or places with specific orientation?

dangus4• 3 years ago

Bingo. Lawyers write extremely broad TOS and EULAs but it’s really a mystery whether any of this data is actually being collected. Mozilla can’t see any of the code so they can’t really say what’s going on.

Yes, it’s bad that it’s a mystery and it’s bad that consumers have little control over it. We need more comprehensive national privacy laws.

bigbacaloa2• 3 years ago

That's easy. But they know that already anyway.

MarkusWandel• 3 years ago

Possibly the high-end ones more so. My new, relatively low-end Honda Civic EX-B appears not to have cellular connectivity (no HondaLink) and no Wifi connectivity. The only cameras are the ones looking out the front and back. Of course it does have an interior microphone for the Bluetooth. But all in all the car seems "old school" and not spying on me. Am I wrong?

lapcat• 3 years ago

It appears that Mozilla simply read the privacy policies of the manufacturers and did not actually test any cars.

Features vary widely among models, of course (as the owner's manual says repeatedly).

uranium• 3 years ago

I've been shopping for a new car recently, and got it down to the Chevy Bolt and the Hyundai Kona [because I want long-range electric and have a narrow garage]. On the Bolt it looks like you can just yank a fuse to kill the cellular radio, and on the Kona, there's a modem you can remove. I've even gotten the dealer to agree to have their shop do the removal, so as not to void any warranty =*).

bilsbie2• 3 years ago

Oven been thinking of getting a pickup truck from the 90s and just keep replacing the engine and transmission if needed.

I’m just wondering about the safety.

mbg721• 3 years ago

Having lived through the 90s, I can say it wasn't that unsafe.

hn8305823• 3 years ago

Most American cars up through the mid 1980's were unsafe and crap. By the mid 1990's they were much safer, especially if they have air bags.

jeffbee• 3 years ago

The funny thing is normally privacy hawks hate google but the unified privacy policy of Android Automotive is way tighter than any of these. The automakers with their own stacks want to collect, use, and sell any and all data.

bilsbie2• 3 years ago

It would be cool to buy an older car you like and convert it to electric yourself. Are there any good services or kits for this?

whalesalad• 3 years ago

I have a RAM 1500 that updates itself with new software over the air. Much to my surprise it works pretty well and happens quite often. Seeing as this is an FCA/Stellantis product I fully expected the first update to completely brick my system. Thank you Java for being older and more reliable than dirt.

ashafer• 3 years ago

Certain cars let you physically disable this. For example, the Tacoma has a "Data Communication Module" (DCM) that performs all of this and has a cell radio to phone home. There's a fuse in the fusebox you can pull to prevent the DCM from getting any power. Only side effect is the in-cabin microphone stops working and you can reconnect the fuse at any time.

It's as if the engineering team didn't want to develop a spying product and made a convenient way to disable it...

EricE8• 3 years ago

lol - if they were only that altruistic. Toyota doesn't make the tech, they buy modules from suppliers and integrate the tech. Better hope someone doesn't come out with a fancy super module that has everything integrated because there will be no disabling it as soon as that happens :/

Don't forget Toyota was the manufacturer that was going to charge a monthly subscription just for the key fob (!) to work until they got a massive backlash over it. A freaking key fob that doesn't use cellular or the cloud at all - it's 100% local between the fob and the car. And don't think for one minute that they won't try to sneak it back in.

RealityVoid• 3 years ago

Better hope someone doesn't come out with a fancy super module that has everything integrated because there will be no disabling it as soon as that happens :/

Well, hello there, zone ECU!

philsnow2• 3 years ago

Better hope someone doesn't come out with a fancy super module that has everything integrated because there will be no disabling it as soon as that happens

I was just thinking about how to find and disable all the microphones in a car and realized that, with software, any speaker can be used as a microphone, so the logical conclusion is that you'd have to disable all the speakers as well.

Night_Thastus7• 3 years ago

FWIW, getting to that fuse is a massive, massive pain in the ass on some of their newer cars like the 2023 corolla. It's basically not possible. The alternative requires taking off the dash and manually pulling out some wires.

In the process you may lose some functionality like some speakers, the radio, wireless android auto, microphone, etc.

motohagiography• 3 years ago

The problem when you don't have competitive markets is that companies collude to use their oligopoly power and start exploiting people instead of making products for them. It's socially destructive because without privacy and moral context, all that is left is nihilism. Without privacy for the human exceptions to ideals, who gives a fuck if you lie, cheat, drive recklessly, cultivate morbid sexuality, or worse, as you're being monitored the whole time and nobody is doing anything about it, so there are no consequences, and even when there are, they are random. It's the social equivalent to being in a jail. Surveillance has become the most socially destructive force in our society today.

I'm looking at getting a new truck after driving an old wrangler without infotainment or even power windows, and part of that is looking for aftermarket services to disable most of this distracting and dangerous crap. Maybe that's going to be my next product play.

EGreg3• 3 years ago

Modern cars use a variety of data harvesting tools including microphones, cameras, and the phones drivers connect to their cars. Manufacturers also collect data through their apps and websites, and can then sell or share that data with third parties.

Do I understand this correctly? So all my conversations in a modern car potentially ARE actually being recorded and sent to be indexed and used against me later? Or to sell me stuff based on what I said in the car?

Is this like when ISPs sell my data?

lisper2• 3 years ago

Some of the cars tested collected data you wouldn’t expect your car to know about, including details about sexual activity, race, and immigration status, according to Mozilla.

It's not just that I would not expect my car to know about these things, it's that I cannot imagine how my car could possibly know these things. Immigration status? Sexual activity? WTF? How?

SubiculumCode• 3 years ago

cameras, mics? and/or uploading pics from your phone

lisper2• 3 years ago

Who uploads pics from their phone to their car??? Is that even possible?

umeshunni• 3 years ago

I think Mozilla's definition of 'tested' is made up here.

godelski• 3 years ago

This is the first "Mozilla" thread I've seen in awhile where HN isn't getting all up in arms about them. So I take it we're cool with this type of stuff? Beyond FF? Because honestly I really appreciate this work.

ecf2• 3 years ago

I’m not. Mozilla “foundation” is a cancer on the browser I used to love.

yumraj• 3 years ago

I’m assuming that this is not an issue if the phone is not connected to the car via Bluetooth, yes? The worst they’ll track is my locations and some other telemetry.

I know this is not ideal, but personally I’ve never connected my phone to the car and I’ve managed. So maybe that’s what I’ll need to keep doing.

Also, can I not control this via iOS permissions?

codedokode2• 3 years ago

Isn't "free market" supposed to provide a choice between privacy-respecting and disrespecting products? No regulation required.

Well, it seems like market forces do not work for minorities.

kredd• 3 years ago

Free market can’t decide on things it doesn’t really understand consequences of. Ideally, that’s why we would have specialists from different fields in the government to make unbiased recommendations.

jcrash• 3 years ago

The actual article: https://foundation.mozilla.org/en/privacynotincluded/article...

alexfromapex• 3 years ago

This type of authoritarian tracking is extremely egregious but the good news is that we are hackers and can detect the RF and other signals with detectors and disable them if we really want to. At any rate, it's a sad state of affairs.

bick_nyers3• 3 years ago

"Data signal has been lost for the last 3 days. Disabling car startup. Please tow to your nearest local dealership to re-activate."

eximius• 3 years ago

I don't understand. This seems clearly illegal to have policies like this that claim consent by sitting in the car but the "user" has never been presented the policy in a way to consent to!

Is this just a good lawsuit away from being thrown out but no one has done it? Is there some particularly fucked up legal precedent that makes this tenuously legally stable?

lelandfe• 3 years ago

You promise to educate and inform all users and occupants of your Vehicle about the Services and System features and limitations, the terms of the Agreement, including terms concerning data collection and use and privacy, and the Nissan Privacy Policy

Similarly, how is this kosher? Do we think anyone, even a single person, has ever followed through on this promise they’ve apparently agreed to in using a Nissan?

nonrandomstring• 3 years ago

In a small informal survey we found that _absolutely nobody_ knows about the new intrusive interior and exterior surveillance from cars.

https://cybershow.uk/media/episodes/watchers_2023-07-01.mp3

It is, to all moral (if not legal) purposes, covert and certainly illegal in the UK on all sorts of grounds that have yet to be challenged in court.

The work is in getting the message out to people.

EricE8• 3 years ago

Just wait until insurance companies demand access to your cars telemetry for either a "discount" or even to insure you at all. I'm seriously thinking of stockpiling a few extra used "dumb" cars. This is beyond nuts.

bick_nyers3• 3 years ago

I would love it if it was economical/possible for repair shops to do "dumb swaps" where they cut out all the "smart" bullshit and give you physical buttons and knobs on your dash.

ReactiveJelly2• 3 years ago

In my moments of programmer hubris I often think, "It can't be _that_ hard to make an open-source controller for a Hybrid Synergy Drive. It's only two motors and a small engine. Come on!"

Scoring6931• 3 years ago

Already a thing in the UK, where the cheapest insurance options require the installation of a telemetry black box in the car.

sedro2• 3 years ago

It's the same in parts of the US. In California, insurers are only allowed to collect the mileage.

salawat• 3 years ago

https://cccis.com

In case you were curious about one of the faces behind the tech stacks that specialize in data exfiltration w.r.t your care. They pitch as being the source of info for the actuaries of auto insurers. Interviewed for them once, and even though the offer didn't materialize, I crossed them off my list of people I'd work with after putting in some time reading up on their offerings and thinking on what you could make out of them.

chevyboltowner3• 3 years ago

For many cars (like the Chevrolet bolt) the information the car collected is available for purchase at lexisnexis https://www.chevybolt.org/threads/disable-or-opt-out-of-onst...

redbell• 3 years ago

Many people think of their car as a private space — somewhere to call your doctor, have a personal conversation with your kid on the way to school..

The above quote was 100% true just a few years ago but it appears to be vanishing in speed light as the tech advances and the race to collect private data reaches its peak.

I’m afraid we will have to check the “I Agree to Terms and Conditions” in our new cars and before even leaving the dealership parking or getting the usual message: “Hey there, we’re updating our terms and conditions, accept to unlock your car”

I’m afraid that once we reach fully-autonomous driving, Ads will start showing up in the car’s digital cockpit and/or head-up display.. probably, based on your current location, mood, the radio station you’re currently listening to.. you name it..

What a time you might not want to live to see!

kccqzy2• 3 years ago

Ads in cars are already a thing in China: https://carnewschina.com/2021/10/18/does-nio-play-advertisem...

(It has gradually occurred to me that without the safeguards of privacy ingrained in western societies, the state of ad tech in China has already surpassed the U.S. and Europe in its sophistication.)

bonestamp22• 3 years ago

True, although I have some hope -- people have been disabling the onstar hardware in cars for decades and I assume this kind of thing will expand as these systems become even more invasive.

The solutions will probably have to advance. I assume the first stage will be just unplugging the telematics ECU (Electronic Control Unit). Then the automakers will get wise, and punish the driver if that ECU is offline (reduce/remove some unrelated features). Then we'll have to make hardware that plugs into the telematics and gps antenna connectors that acts like a man in middle to ensure only the minimum (and possibly fake) data is received by the ECU. Then they'll probably add something that calls home every so often and requires a valid response to know everything is ok... etc.

fidotron• 3 years ago

These cars are simply indicators of what smart homes would look like if marketers got their way: mechanisms to capture the hormonal state of inhabitants to better advertise to them.

That isn’t a joke btw. For example women are far more susceptible to advertising based on their menstrual cycle. Gad Saad, of all people, wrote a very serious book about basically that.

Night_Thastus7• 3 years ago

I honestly don't get the hate for modern cars that some people have.

I recently got a 2023 Corolla, and it's fantastic:

* Android Auto gives me a great GPS to navigate anywhere, anytime. It watches out for traffic, accidents, speed traps, etc. and keeps me informed and on the fastest route

* I can have my phone's whole music library to listen to instead of fiddling with another copy on a USB stick that I'd have to keep in sync

* Automatic headlights and brights

* Automatic climate control (no more adjusting!)

* Amazing MPG (I can get 48 on the highway)

* Tire pressure sensors

* Automatic parking brake so I don't accidentally ruin the transmission

* Automatic lane centering and adaptive cruise makes hour long drives effortless. It's even great in the city.

* All the safety features like brake assist, pedestrian detection, etc. It hasn't saved me from an accident yet, and hopefully won't need to - but it's great to know that it's there

I basically never need to touch the screen except when initially setting up my route. Everything else is on the wheel or sticks.

Seriously. Cars have never been better.

Yes, if you're an enthusiast who wants a fun, sporty and unique car you're eating expensive scraps at the moment. But for MOST people, it's never been better.

tredre3• 3 years ago

I'm not sure if you're being deliberately obtuse or not, but this is an article about how cars collect telemetry. This is what everybody is talking about in the comments.

I'm sure everybody here enjoys most modern car features you've listed. They just don't like being spied on.

Night_Thastus7• 3 years ago

I know what the article about, but the comments of the post are full of unrelated new-car-hate, at least that's what I saw.

dicing• 3 years ago

FYI If you don't like that, you can act with Mozilla's petition:

https://foundation.mozilla.org/fr/privacynotincluded/article...

rabuse• 3 years ago

This is why I ride a motorcycle.

Glench• 3 years ago

I signed the petition and donated to Mozilla after reading this article. This is really important work they're doing. https://foundation.mozilla.org/en/privacynotincluded/article...

dmitrygr• 3 years ago

Find and unplug cell antenna. Plug in 50 ohm resistor. Live happy.

robbywashere_• 3 years ago

How long before those screens start to play targeted ads and the data is shared across your devices, but you’ll get a discount on the msrp

diego_moita• 3 years ago

security tests conducted by Mozilla

I just bought a Kia Niro. So I read the articles on Kia and Hyundai (Kia controller) and couldn't find any "tests" on them.

Most of it is just "the privacy policy says this and that" and "they may collect this and that".

Not saying I am not concerned. But I'd prefer a lot less fear mongering and more hard evidence.

Like my TV, will keep my car of the internet, then.

anjel• 3 years ago

How much would you pay for a service to pull the Mfr's sim chip from deep inside your new car's dash?

husamia• 3 years ago

So we need to redesign the internet before our cars will be safer?

Internet-connected cars fail privacy and security tests conducted by Mozilla

Related Stories