Hacker News

And once you've gotten rid of Google and Apple, your telecom company tracks you, your CC payments help track you and even cameras in public do.

It's hard to not want to throw your hands in the air screaming "whatever" when almost everything you use in public is somehow used to track you either as you move around, or in the future.

Is there any information about precisely what vehicle telemetry they capture and retain?

I know the laws are far from perfect, but isn't there some legislation compelling them to disclose what they collect?

What specifically would be the most relevant law/regulation? (If it varies by geography, pick any major market, eg. California, that is big enough to impact their engineering design and the content of published material). You mentioned they're cagey, and my aim is to examine if there's a gap between what they're supposed to disclose and what they do, which could be rectified by litigation. Eg. If they just say "vehicle telemetry" that doesn't tell you much, and I'd happily contribute to an EFF effort to get them to elaborate.

Alternatively someone who works close to this code could provide some examples of what a "typical" smartphone OS platform collects these days.

You need GrapheneOS to sever the link to Google. You can also deny specify apps and services Internet access.

> They are both very cagey with how they talk about this (or don't).

No, not really - at least not apple. They are very clear on what CarPlay’s privacy stance is, and they’ve got privacy white papers on pretty much everything:

Eg. https://www.apple.com/privacy/docs/Location_Services_White_P...

Again, at least on the apple front this comes off as a ton of “stated without evidence “

>if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota

Source? Can bluetooth devices do that without the user's knowledge?

Standard Carplay is essentially an additional screen for your phone - your existiing privacy settings carry across. What's your concern?

> then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota

How?

A 12v bluetooth to FM transmitter can at least give you tunes and a speaker phone feature.

I use android auto through grapheneos thankfully! this is crazy!

In a perfect world they wouldn't collect it either, but I'd rather Apple have it than the car manufacturer (or rather, only Apple vs both Apple and the car manufacturer)

I trust Apple more than I trust Toyota.

What about if it's just paired as an audio device rather than through an app?

> The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected.

Do you have evidence or a citation for this? Or is it just the sort of statement that’s made in the pretty certain expectation of upvotes on HN?

Yeah, but at least for now they don’t have the power to remotely disable my car or jack up my insurance prices and I trust Apple 1000% more than any of the other random car companies do not sell my data.

> then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota [...] so I exclusively use CarPlay via USB.

I would be concerned that a passenger connecting their phone to it while I was driving.

In other cars I've been successful picking up the relevant modules for peanuts from surplus/scrap then just desoldering the RF-active components (like bt radios, etc) and swapping them in. YMMV but if it doesn't work you're just out the cost of a junk part.

Even if some radio feature is benign its existence means that its hard to be confident that there isn't some other telemetry feature you missed. With no connectivity at all you don't need to worry that you missed something because you can monitor the car with a spectrum analyzer and observe its never transmitting.

Unfortunately in some newer cars you can't swap any modules without a dealer tool to pair the module to the car, presumably in a bid to prevent third parties from fixing the car (presumably preventing people from lobotomizing their surveillance isn't on their radar yet).

They are cagey because they get nearly $100k upfront with crazy interest rates, and then they make a ton of money through their spyware.

Yeah, I'm a little suspicious about that claim.

Bluetooth tethering is a thing, actually predates wifi tethering. Though it's not enabled unless you enable Personal Hotspot in your phone settings (and Android requires it to be enabled separately).

CarPlay complicates things, as it only uses bluetooth to pair, then it switches to using a wifi network (as bluetooth doesn't have anywhere near enough bandwidth). Maybe Apple automatically shares internet over that carplay connection?

I have no doubt that the car will use the internet connection if one is exposed, I just doubt it will be exposed automatically.

Bluetooth tethering is a thing, and I believe is enabled by default on Android, maybe it's using that?

For me on Android 16, the setting is in Network & internet > Hotspot & tethering > Bluetooth tethering

I have exactly the same problem in my (latest-model) Honda Civic / Android Auto! I thought I was going crazy, I'm glad to hear someone else has the same problem.

The only fix I've found is to disconnect the phone and use its map standalone, just sending audio over Bluetooth. Maybe it's possible to get Android Auto or Carplay to reject GPS data from the car? I don't know...

Stop "reporting this to them multiple times" and sue them.

This is exactly why the civil legal system exists.

I promise you a consumer rights attorney will be interested in going after Toyota if you have clear evidence of it.

Or you could take it to an independent mechanic. It's likely just a bad connection to the "sharkfin".

> I realize these problems exist with all cars today.

Nah. It really doesn't, not to the same degree. Consumer Reports has demonstrated this handily for many, many years.

Some brands take software very seriously. This isn't an "entire industry" problem.

My experience is pretty small; I've owned the same Tesla Model 3 LR for the last 6.5 years, and the software has been pretty much solid the entire time. There was briefly a problem with echos when I called land lines using the bluetooth and my iPhone, but that problem eventually went away - not clear if it was because the iPhone changed, the software was updated, or perhaps the particular landline I was calling got an upgraded CO, but for a car that's a pretty good track record. There were some sensor glitches but they got fixed.

I've test driven other cars. Lucid Air - tons of weird glitches. Rivian - almost as good as the Tesla, but laggy UI on a brand new car. My Tesla is almost seven years old and still smooth as the day it was new! How do they do it?

Compass heading specifically does seem to be unusually challenging. Does anyone else recall the bizarre "Google Maps on iPhone is 90 deg off" problem? Totally strange.

I don't know about internet, but it actually works the other way for GPS; Carplay/Android Auto relay the car's GPS data to your phone, because that is usually more accurate and it means your phone doesn't have to burn battery constantly polling its own GPS.

> I have reported this to Toyota multiple times with videos detailing the problem and they have denied the problem and ultimately when faced with the evidence simply refused to fix it.

I don't work for Toyota, but I do wonder, who exactly within Toyota have you contacted? Maybe you're reaching people who have no idea how to reach out to a real engineer within Toyota?

Kias have a “Massachusetts mode” flag hidden behind a service menu (that needs a dealer code) that disables telematics at the owner’s request. However, the service menu pin also has timeout protection that will inject a waiting period between retries so there is no guessing.

I don’t think there’s convincing my dealer to get into the service menu and disabling it.

I would presume that other manufacturers might have this as well.

Older Toyotas also had a DCM fuse, and this was the easiest way to get rid of telemetry. I am not sure if partially disassembling the dash and physically removing the DCM is now necessary.

I've bought multiple Toyotas from the same dealer, and each time the sales person has been overly aggressive about setting up the app and connecting to the car. The first time I let them do it to a point as I had not seen what it did, but had to prevent them from syncing contacts. After that, I had to be very stern about not needing help to set up an app I was never going to use. I don't know if they are used to neophytes being unable to handle this and think they are doing a service or if it's a push to get people to connect/sync as much as possible.

This aligns with my understanding.

Before 2018-2019, the opt-in process for data sharing was hidden on a website somewhere. Around that time, the form became part of the vehicle purchasing process.

There was a recent class action suit against GM for this.

It's for the safety of the children.

When reading the article I think he appears to be talking about car play/android auto connection not audio only connections. I think Bluetooth in AA and Carplay is used to configure a local network between the phone and the car to transmit the images to the cars screen. I would assume that that data capability can also be used for the car to communicate with the Internet.

I think there are details being left out. But several people in the comments indicate that there is a Toyota app that provides various features. I bet the app implements some proprietary bluetooth service that the head unit connects to and feeds information through. Or maybe they give the head unit a straight pipe to the internet via that service.

There is a bluetooth protocol for cars to piggyback on your phone's internet connection. There was an article about it here a couple of years ago but I've forgotten the name of the protocol, and trying to search for it turns up a lot of irrelevance.

The fix for this is a phone that doesn't implement that protocol, i.e. not Android or iOS.

Is this specific to carplay, or can other bluetooth devices also silently and nefariously hijack your cellular data connection?

The bluetooth protocol includes the ability to network, and share connections like a mobile/personal hotspot.

Older versions of bluetooth may have other networking capabilities.

If you are considering purchasing a Kia, insist on getting a loaner or a 24 hour test drive.

The active driver assistance features are criminally dangerous.

Sadly, the current administration is more interested in illegally locking Kia’s engineers in cages than actually enforcing consumer protection or safety regulations.

Anyway, avoid them and Hyundai. If you don’t believe me, drive in rush hour for 30 minutes and frequently change lanes. Be sure to be on the road at dusk and dawn to get the full experience, where glare confuses the onboard cameras, so regen braking flaps on and off, and it repeatedly overrides steering and sets of spurious cabin alarms.

I’d suggest parking a few times at a costco during peak hours, but I don’t want to get anyone killed.

Any clues on how to disable any telemetry on a Kia Stinger?

Bluetooth PAN seems to work pretty seamlessly once you've paired your phone and set it up. It's possible some kind of "seamless hotspot" functionality is remotely activating PAN on a paired device.

Also thought about it. It’s possible, but requires enabling hotspot on the phone. Without it, it will not share internet via BT.

It's from the linked rav4world post

>Gas stations with cameras.

Everything has cameras these days. On my street almost every house has a cloud connected camera. Every major road has cameras, every store and business. Now I’m not suggesting we give up the fight for privacy but avoiding gas stations does nothing

If you think your Tesla is somehow more "private" then my pre-2010's ICE car with no tracking electronics, then you are delusional.

> the car will not be bricked if you cut the antenna wires

They can't brick cars with bad antennas. They have to allow for cars that drive into tunnels or that are used in areas with no cell service.

They could choose to throw up increasingly annoying messages if the car hasn't phoned home for some time. Tesla does this if you haven't updated your software in a while but the screens are pretty easy to close and ignore.

They beep when you go above the speed limit, and only for a couple seconds. If they do that 'constantly' the problem is in the driver's seat...

It takes two seconds to turn off in my car (though by law it has to reset on every drive), but I never bother. In situations where it's "ok" to drive a little over the limit, it's a small price to pay and a gentle reminder.

It’s horrible since it gets the speed wrong 25% of the time and 25% of the time it beeps because you are doing 33 in a 30kmh zone because you are just going along with traffic.

When you get in a car, you have to spend 20 seconds disabling all those systems. Lane keep assist is downright dangerous as it keeps you in your lane if you do an emergency avoidance manoeuvre.

I don’t hate safety system like emergency brake assist or ABS but I don’t need a nanny keeping me in my lane. I also don’t need a coffee symbol for taking a break.

Lane assistance on hire cars piss me off. If I need to swerve I shouldn't need to be pulling against the wheel -.-

Isn't eye tracking required there too now? If you look away, or even not in the direction the car expects, for more than a couple of seconds >> more beeps.

I though this was just a crazy commenter, but here:

https://rabbit-labs.com/product/cancommander/

Crazy commenter, tell us a little about this. Can I use it on any Can bus?

> to pre-heat or pre-cool the car remotely before going to work, while it is still plugged to the wall charger

Modern aftermarket remote start systems work with both ICE and EVs alike. Take a look at Compustar. You can remote start your Leaf with a key fob from 1/2 mile away, no telemetry, connectivity, or silly app needed.

That is crazy. 5 years and they are already shutting down the servers? They should be forced to open up the API when they shut it down. Running a replica yourself should be pretty doable.

How are you dealing with the chademo only charger thing?

Yeah, like AdNauseam. We're way too polite when it comes to these exploitative corporations. Start poisoning their data sets. Start costing them as much money as humanly possible. Drive their returns on investments as close to zero as possible, ideally well into the negatives.

I'm always surprised there aren't more projects that just pump random data back into all of these system. I think awhile back there was a plugin that would click on every advertisement it saw over and over, but got shutdown for some reason. But how hard is it to just have everyone inject nonstop data to all of these tracking systems? if nothing else a drive somewhere is going to eventually fill up.

Just be aware, this is something that will be noticed. I've been building analytics systems for a while now and have had people do this. Usually it gets picked up by the anomaly detection system or as an alert in the ETL pipeline when we try to transform it.

Personally, I just plop it into a "dead letter office" table, then verify it's not malicious. But it's possible other companies would handle this differently.

Feed it the current location of the ISS and see what happens to your insurance rates.

this is great idea! Hackers of Hacker News let's have more projects to overwhelm bad actors with bad data. Perhaps using OSS LLMs for that.

TIL:

> eCall was made mandatory in all new cars approved for manufacture within the European Union as of April 2018.

https://en.wikipedia.org/wiki/ECall

There's going to be a lot of value in keeping cars from 5-10+ years ago around indefinitely.

> Fr*nce

What's this?

Just use public transit.. oh, wait, (https://reclaimthenet.org/the-eurail-breach-and-the-digital-...)

If you disconnect the modem, the car can't share any information by itself. In my opinion, that is a huge win.

I think you can substantially reduce the information collected about you, without an enormous amount of time. Security - and any solution - isn't about perfection; it's about improving the situation and making attacks more expensive.

Every HN thread is accompanied by comments saying it's all hopeless.

I cannot imagine the lack of concern about my privacy that it would take to make me daily-drive a car that hadn't been put through this process.

(I dread the day my 2007 Civic is no longer usable.)

Get a determined ex-partner who knows a lot about you and wants to harm you or kidnap your children. For most people this represents the greatest immediate risk with this kind of data.

Step 1. Be very, very single

When I was a younger man, audio visual forums used to have an unfortunately sexist, but fairly good conceptual measure they called “wife acceptance factor”. It should really just be partner acceptance factor. Regardless of whom you are with, I hope they would physically intervene before letting you do this. What is the point? All of these posts feel like they miss the forest for the trees. Don’t like This Modern World? Fair enough, start by leaving your phone at home. Pay cash. And so forth. The author’s problems would be better solved by taking the bus. If you’re going to get into messing with cars, the wiring harness is not the place to start. Every trip to the dealer or any other mechanic is going to be painful right up until you finally give up and try to private sale the vehicle. At some point in that process, after you have dropped the price by over half the Kelley Blue Book value (or whatever Palantir shit replaces that) you may actually hear yourself explaining to the pleasantly smiling with a certain look in their eye non buyer about how you had to do this.

I will admit my bias. Fair play to the author for putting this all together but it reads like a very intricate aluminum foil hat.

Soon: ads on your HUD while you wait in traffic.

[meta] this response was clearly not from an LLM. i wonder what sorts of distinctive styles could be telltales going forward.

What type of fucking "safety" update could be performed?

If the car has a recall or safety issue with the suspension part failing prematurely, what possibly could some software nonsense do?

Its probably an antipattern on a car to need an OTA "safety" update in the first place.

Resolution of less than 1 meter is normal with a decent view of the sky and a lack of interference. GPS itself is always receive-only on our end as consumers.

What problem are we trying to solve here? At this point in time, guided navigation with completely offline maps and GPS has already been a no-brainer off-the-shelf thing for decades.

I don't think cell tower connection will give you any more precision, GNSS fix will be much more accurate. (within few meters)

You could get more accurate fix with RTK data, but I'm not sure if that's actually widely used. And in any case that doesn't require active communications either, you could get correction data from satellite broadcasts too.

>That requires a cell connection.

Technically it only requires an antenna that can listen on the LTE band (or even GSM). Trilaterating based on cell towers with a hackRF or other SDR is a fun exercise.

GPS is exceedingly accurate compared to cellular signals on it's own. What it isn't is fast. So the "enhanced GPS" is mostly just proving satellite ephemerides so your GPS device can lock onto the overhead satellites faster.

If your device has zero GPS signal then you can get ~100m accuracy from the cellular signals alone. If your device doesn't have "enhanced GPS" then you can get ~1m accuracy from the GPS signals alone.

This is what I thought about doing instead. Removing the whole module seems overkill. Removing the signal should be enough to disable it.

Which car manufacturers are not pushing this garbage?

All the Chinese car manufactures are doing the same, they aren't likely to go under soon.

They would have to prove the modification caused the accident.

I've been saying this for years! I agree.

That's a hell of a defeatist attitude, and exactly the result they are hoping for.

What's the advantage in having a self-driving car?

Why is a self-driving car so important to you? Is it really worth giving up your privacy, and advocating that others should give up theirs, just for some shortcoming in your own capabilities?

Cars are now using eSIMs. Cutting an antenna wire only limits the effectiveness of the communication. You can wirelessly send and receive data with a solder terminal on a board if you're dedicated enough.

I wonder if removing the antenna would possibly cause the modem to try to transmit at a higher power level, thus running the car's battery down.

> electric-drivetrain with onboard gasoline generator

Generally speaking, it's more efficient to power a car using a series-parallel hybrid system than an electric drivetrain with generator (series hybrid) while not really being any more complicated.

In a series hybrid (electric with generator), you're losing energy converting the rotational energy into electric energy. It's better to use the engine's output to power the wheels while it's in an efficient range. It's why Toyota's series-parallel hybrid design offered better mileage than vehicles that (primarily or fully) operated as series hybrids like the Chevy Volt.

> No screens

You can't really sell a car without a screen due to government regulations which require backup cameras (since 2018 in North America, since 2022 in the EU and Japan).

> no assists

Automatic Emergency Braking is going to be required in the US in 2029 (detecting frontal crashes about to happen and automatically braking, including pedestrian detection).

The EU requires even more including blind spot detection and lane-keeping assist.

I certainly agree that cars need knobs and buttons for controls like AC/heat, music, etc. However, it'd be hard to make a car where you aren't putting in a screen and assistive technology. I think a better argument would be to make a car where the screen was simply Apple CarPlay/Android Auto and a backup camera - rather than shoving a lot of garbage UX into it.

It is probably like with smart TV's where the value of the telemetry data ends up subsidizing a significant fraction of the hardware. Car manufacturers seem to be doing a lot of experiments with what they can charge for in terms of ongoing subscriptions. I am sure if they could show ads without it being considered distracting they would.

I think the problem is there isn't a fortune there. It would be a successful endeavor, but not something to rake in huge piles of cash. The kinds of leaders and investors who could pull off what you're describing are instead working where they can make multi-millions rather that multi-hundreds of thousands.

Well, Bollinger Motors tried just that, but they couldn't make it fly.

However, you now have a chance to buy one of the rare prototypes!

https://finance.yahoo.com/sectors/technology/articles/bollin...

A screen for the back-up camera is federally required for new cars in the US, afaik. But using the screen for additional purposes is still optional... for now...

There's a post earlier linking to someone doing that for a Tacoma

You would be surprised how leaky RF can be and how hard to completely suppress. There is a reason things like anechoic chambers and test labs are very expensive.

In case of Subaru turning off 2G made their modems keep trying to reconnect 24/7 draining and killing battery. Subaru refused replacing batteries killed by defective car.

You just need to cap the connectors with a terminator.

https://rangerovers.pub/downloads/rave.zip

Can't do the design bits, but there's full service manuals for any 1990s to early 2000s Landrover. Only NAS models, unfortunately, so for some things in UK/EU you need to interpolate a little.

Notice the complete absence of phone-home GSM modems or other tracking stuff?

You'd think people would be doing that already. Has anyone posted details?

Can you skirt the GDPR by making it hard to discover who you need to ask?

My hilly 25 mile commute isn't really bicycle compatible, unfortunately