Car Privacy is Shit
from ExperimentalGuy@programming.dev to privacy@lemmy.ml on 02 Aug 2024 19:17
https://programming.dev/post/17642185
from ExperimentalGuy@programming.dev to privacy@lemmy.ml on 02 Aug 2024 19:17
https://programming.dev/post/17642185
I wanted to get others’ takes but it seems like the only real way to get a non-spying car is to get an older car without any sort of telemetrics. I saw a video about different car companies’ security policies, well specifically the new Mental Outlaw video, and it just blew me away how even our cars aren’t safe. Anyone got tips for how to anonymize their car?
#privacy
threaded - newest
Remove the cellular modem.
What are the chances the software is designed to throw errors and “See a technician” messages if you dk?
Depends on the car but I’d say the chance is above 50%
I’ve heard it can cause problems in some models, so people need to do their research. With my truck it’s dead easy and are no drawbacks.
Not small, but I think you’ll have better chances with the mid level commuter cars. You’ll probably get some error messages on some of them, but if you can ignore them, they wouldn’t stop the car from running.It’s the high end ones and EVs that have a higher chance of bricking if you disable the antenna.
My suggestion, if you’re looking for a new car, is to research where the modem in the car is, and unplug it during the test drive (assuming it’s reachable).
I unplugged the one in my work truck, 2023 Ford F150. They call it the “Telematics unit” and it’s on the rear cab wall on the right side, hidden behind the sound deadening foam. I did this after it was bought, but if I had known about it before my boss paid it, I definately would have tried it before the test drive to make sure, and I plan to do it if/when I look for a newer car!
I unplugged every cable coming into it - power, antennas, data, all of them! The only issue that comes up is the center screen on the dash crashes back to the main menu when you try to open the data/wifi settings.
No other issues so far after almost 5k miles! No warnings, no lights on the dash, nothing! Android auto/carplay even still works! Don’t know yet if the dealer will try to plug the unit back in during the next service, but I intend to raise hell if they try!
We need an iFixit-like database giving each car a score about how easy it is to unplug the telematics units and what errors it may result in, complete with a score.
And add a Faraday’s cage. There are other things except for cellular connection used in cars such as WiFi and Bluetooth.
That’s impractical. Bluetooth and Wi-Fi also needs modems so just remove those too.
I mean sure if you can find and remove them. They’re very small.
They’re going to be in the same location for a given model year, which somebody will likely have documented online.
I’d want bluetooth for music from my phone though. And it’d be nice if my phone’s cellular and GPS didn’t get blocked.
But then the car can send the data via unprotected WiFi spots. I don’t think you can turn off autoconnect.
Isn’t your phone far more connected to your identity than your car? As in, if your worried about Toyota or Ford tracking your vehicles driving statistics it seems using GPS and wifi and Bluetooth on your phone that also has all your payment info, browsing history, and all your passwords saved defeats the entire purpose of worrying about your car. However, at least your phone gives you a benefit to using it like navigation and music, your car just mines your location data.
Privacy is not just black and white.
Get rid of the car
Most of the cars will still try to connect to open Wifi when available to upload data.
Very nice ! That’s when you can start spying on your car’s behavior.
Not really. If they use TLS / HTTPS then you won’t see a damn thing.
Yeah. Believe me most of these embedded controllers are not very well programmed. Play a bit with fake certificates and I won’t be astonished if you to catch something.
Perhaps disconnecting the RF antenna, and replacing it with an appropriate termination?
I did not watch the mentioned video so I am not sure if what I am about to mention is discussed there or not. Also, sorry for the really long reply!
I am not aware of any available truly privacy respecting, modern cars. However, assuming theat you obtain one or you can do things like physically disconnect/remove all wireless connectivity from the car to make it as private/secure as possible, there still is little you can do to be truly anonymous.
Your car likely has a VIN and license plate as well as a vehicle registration. Assuming you legally obtained the vehicle and did not take any preventative measures prior to purchasing the car, those pieces of information will be tied back to you and your home address (or at least someone closely connected to you). You would need to initially obtain the vehicle via a compsy/LLC/partnership/etc. as the owner/renter/leasee of the vehicle and an address not associated to you. Additionally, you would need to find some means of avoiding or limiting the additional information connected to you that is likely required to obtain the vehicle like car insurance and your drivers license.
Additionally, any work that certain mechanics perform may be shared (either directly or indirectly) with data brokers - even just routine maintenance like an oil change or alignment. Hopefully you didn’t use your credit card, loyalty rewards program, etc. when you had any work done!
There is also CCTV, security cameras, and other video recorders that are nearly impossible to avoid. Given enough time/resources and maybe a little bit of information, your car could be tracked from its origin to destination locations. This location history can be used to identify you as the owner (or at least driver/passenger) of the car. Unless your car never leaves your garage, you can almost guarantee that your car is on some Ring camera, street camera, etc.
Furthermore, anything special or different about your car (custom decal, unusual window tinting, funny bumper sticker, uncommon color for the car, uncommon trim/package for the car, dented bumper, fancy rims, replaced tires, specific location of toll reader placement on the windshield, something hanging from your rear mirror, etc.) all help identify your car. The make/model and year of your car can also be used to identify your car if its not a common car in the area. These identifiers can be used to help track your car via the video feeds mentioned above.
Then there are license plate readers which are only slightly easier to avoid than the video recordings. Permanent, stationary license plate readers can be found on various public roads and parking lots. There are also people who drive around with license plate readers as part of their job for insurance/repossession purposes. You may be able to use some sort of cover over your license plate(s) to hinder the ability of license plate readers to capture your plate number, but that could be used to help identify your car in video feeds/recordings.
Take a look at motorcycles. They tend to be far behind the curve technology wise, and only Zerocycles have a telemetry system afaik.
they’re also dirty as fuck.
If you mean emissions wise, that’s really going to depend on the bike. Old two-strokes rocking carbs? Yeah, they’re terrible. Modern fuel injected four strokes with cats? Pretty good, actually. And they get better mileage than most hybrids. I get 60mpg on my 900cc Triumph, which is a mid-sized bike by American standards and a big bike by world standards. Smaller bikes and scooters can get over 100mpg.
Your license plate is public, not private. Heck it’s not even yours, just like a driver’s license. The government is essentially loaning it to you which gives you permission to drive, same with the plates.
The point I was trying to make is driving a car is inherently not private due to license plates. Of course license plate readers can’t get information directly from the ECU, but thinking you’re going to be driving privately because you don’t have a modem in your car is naive, IMO. Car privacy is shit even if you disable the modem, which I wasn’t recommending against. Of course you should disable it. It’s still a very public activity you’re doing that’s likely being tracked by license plate readers.
Really not sure why you got down voted so hard and it’s a shame your comment was deleted. Your comment was relevant, accurate, and focused on an issue that others aren’t talking about in here (and apparently don’t want to). You were also the only person in this thread who provided any sources.
I’m not sure what argument can be made against what you said. Just because a piece of information “is public” doesn’t mean everyone wants that public information collected and shared with little (if any) control/input by you. If that were the case, doxxing wouldn’t be an issue.
I reconstructed my comment. I believe people thought I meant disabling the modem is pointless due to ALPRs, but that wasn’t what I was trying to communicate.
Yes, banning mass surveillance systems including ALPR is a good idea too. In the mean time, go ahead and take care of the problems that are your own responsibility. Disable the modem, and don't buy a car that has one unless you're sure you can do that.
I don’t have any tips, but I wish I did. My car’s just over a year old and I don’t even like driving it since I found out it’s spying on me all the time. The ‘infotainment’ system is also integrated with everything in the vehicle so turning it off isn’t an option. I really like the car, but I feel like privacy is something that shouldn’t have to be a consideration when buying a vehicle. I’m just about positive there’s not a new vehicle available in the US market without one of these things in it unless you’re buying fleet vehicles.
Sell it and get a old pickup truck. Those things go forever
I’ve got a 2009 dumb car and I am babying it because I dread having to try to buy a new to me car that isn’t full of telemetrics and other modern car garbage.
Learn how to work on it
I already do. I’m no mechanic, but I’ve made numerous repairs over the years and am familiar with and can do basic car maintenance.
Do you do any rust proofing? Keeping the rust away is key if you want to keep it for a long time. My car is ten years old and practically rust free, been applying Fluid Film every other year.
Old and serviceable. Don’t give me plastic
The problem with the “just buy old cars” is that I want a used electric car for like $10k.
We need a wiki of EVs that.has a section on each model enumerating which components are used to spy on you and videos showing how to neuter them.
Exactly. Like I got a new android phone last week and I want to make it more.private. I want be afraid of making mistakes. Any mistake I can do can be undone.
Yeah fortunately there’s tons of info on the internet on how to security harden phones. Its down to a science
Hardening cars is wild west right now.
The cars should not need to be hardened. That is what needs to stop, imo!!
Yeah with EVs it seems like improving the privacy would be a pain, since they are reliant on parts of the digital system that is causing the privacy problem in the first place. I’m planning on sticking with a gen 3 Prius for awhile.
Are you sure the gen3 Prius doesn’t have these sensors and privacy issues? I had a gen2 Prius and that thing had loads of sensors everywhere.
I ask because I’m seriously considering buying a gen3 Prius. Do you have any resources you can link me to where researches actually did an audit of this car to see what info it collected and what was uploaded to Toyota or the mechanics?
I don’t really know much about that except for the fact that it does not have any form of a digital transponder that actively sends data it could be storing it though. Here is a site about vehicle privacy where I just looked up a random gen 3 Prius vin. (vehicleprivacyreport.com/report/?vin= JTDKN3DU1A0…)
The best privacy from an EV is an electric bicycle
Well, would be nice to be able to haul drywall and not get wet. There are some projects for this, but they’re a bit immature and documentation is lacking
openmotors.co
You can haul a lot of weight by bike, especially if you use a trailer. How often do you really haul things? Just rent a panel van on days you want to move shit.
I live on a bicycle, but I’m going to be building a house soon, which is why I was looking at buying an EV.
An EV van has the same privacy issues, and we’re back at square 1
And then they’ll add the same tracking to them too.
Not all. Bosch equipped ebikes send name/address when they get serviced.neither rad nor aventon have systems smart enough to record data at all. I dont think shimano ebikes are smart either.
I’m saying in the future.
My ebike comes with a GPS tracking app to locate it. Luckily it’s optional but it’s already begun
I have been thinking we need something like this but for all new vehicles, not just EVs. Like instructables but for how to locate and rip out the cellular radio/antenna on every make and model that has one.
Definitely. But its more complicated than that.
My understanding is that many cars store the information airgapped and then upload it to the dealer when the mechanic pluggs into the car doing routine service checks.
So we need the wireless/radio neutering, but also someone needs to hook up to the car and see if/what data can be leaked via hard wire. And possibly find ways to disable the sensors, send random/nonsense data, update the software to not store sensitve data, automatically wipe the data every time the car turns on, or at least document how to manually wipe the data when you pull into the shop for maintenance.
Oof, yeah, didn’t think about that. Much more complicated.
I was driving in a rented car and just decided to start randomly singing and… yeah, the car’s AI asked me to repeat.
Cars have had GPS capable black boxes for a long time. They claim it is for the same reason as airplane black boxes, but I call bullshit on that.
Would be interesting if people demand their car modems disconnected enmasse contractually before they bought newer cars. Then have an independent mechanic confirm its disconnected or dealer pays out the arse. Make em think twice about this crap
Also ford recently redesigned their app so the users have to use built in google maps in order to track their car.
Also ford recently redesigned their app so the users have to use built in google maps in order to track their car.
As long as data harvesting is legal and profitable, privacy will be a cat and mouse game. Gotta wonder how much capital and human effort is invested into all these anti-consumer innovations.
Let me try this comment again.
There is no driving with privacy or anonymity unless you’re on private land.
Remove the license plate. You will rarely have privacy driving a car on a public road. You should disable the modem, of course, but you’re still not going to be driving anonymously or privately. Automated license plate readers means your travels are going into databases that very well could be breached at some point in time.
brennancenter.org/…/automatic-license-plate-reade…
Adding to this, automatic plate flippers exist and are pretty popular for show cars to display something else when parked. Typically wired to ignition so it shows your plate only when the cars running.
Issue is if you street park dependent on the state, if the vehicle registration is hidden by the plate being flipped they can likely tow it. Would work great for at work/in your driveway though. Could maybe just have a bypass switch for if you need to park somewhere and display the plate.
Still a pain in the ass that it’s this bad though.
Theyre also recording the make model car type car size etc so you’re still not immune from fingerprinting
The fact that your data is exposed to someone doesn’t mean that you have to give up and just let everyone else have it as well.
That’s not the point I’m making. You should disable your cars modem if it has one, but you still should have no expectation of privacy. Thinking you can have anonymity with a license plate displayed to everyone is foolish. It’s like asking how to be anonymous while wearing a name tag and the same clothes every day.
Yea, that part is true.
I don’t entirely agree with this: I know there are no ANPR cameras within my town for example. There’s a speed camera that only takes photos if you’re speeding, but ANPR cameras are limited to motorways and trunk roads, I can move around my town and the surrounding ones without clocking ANPR. Of course I’m still on regular CCTV and cell towers triangulate my phone, but that requires authorities actively looking into me which I doubt they are.
I tend to use an eBike where possible but again the phone triangulates if I have it on me, and it wouldn’t be too hard to follow on cctv if you really wanted to. Everyone and their mother has a doorbell camera now
Mozilla Foundation did a deep dive into this. And the results where abysmal. The only brands not completely horrifying where Renault/Dacia because they are European and only serve the European market so they have to follow GDPR.
Wait, Renault doesn’t ship anything outside the EU?
It does, to India.
They used to but stopped AFAIK. I am not completely sure but that’s what I read when the Mozilla Foundation report came out. The other reply said to India so maybe my information is not completely accurate…
Nice to know
I don’t recall what kind of car it was, but there was one that saved the phone number associated with any phone that connected via Bluetooth.
While I don’t think it’s likely as a way to trick people to connecting to get their phone number, it was a rental car which opened them up to impersonation scams. Knowing they just rented from the company and where in the city provides quite a bit of information on you.
Android has the ability to deny this information. If iOS has one it does jack shit because Apple doesn’t care about your privacy.
Depending on the car you might be able to physically disable telemetry. Here are some thoughts/ideas I’ve been collecting:
You need a line break between your paragraph and your list.
Depending on the car you might be able to physically disable telemetry. Here are some thoughts/ideas I’ve been collecting:
Oh, it looked Ok in my app (Voyager). But I added the line break.
Quite a few cars also still have a SIM card hidden somewhere, which can be removed. The location of it varies widely though and they’re usually pretty hard to find.
I am a private person. Not because I have something to hide, I just don’t like the idea that my data is being sold which exposes me to various scams. I got to the point where some of my online purchases are marked as fraud due to measures I took - vpn, email alias, delivery to a parcel locker, spoofed phone number, one time cc. But with cars I cannot help myself. I truly enjoy all the “smart” features. Collision detection, ability to press SOS button when I need help, ability to remotely start/stop/lock/unlock/turn on/off ac/etc. I know how privacy invasive those things are but in this case I’ve chosen convince over privacy.
Should be quite easy to remove any WiFi/cellular/satellite antennas from the car’s computer. (Might be trace/chip antennas, so make sure to get those). If you’re extra paranoid, get the GPS antenna too, so it can’t simply record data indefinitely.
Might take a few hours to go through the car to make sure you get everything, but you won’t be limited to super old cars.
I don’t believe for a second that the car won’t be sending either an unremovable error message, a constant and un-mute-able audible alarm, or a complete lockout of subsystems or the entire system itself. The best case scenario is that this is a mild inconvenience.
Does your car lock up outside of cell coverage? I’m not suggesting removing the radios themselves, just the antennas. To the car, it will just always be out of range.
The antenna used for talking to the keys might cause trouble, but those are either inherently short range inductive systems or are receivable using a 20$ RTL SDR to verify it’s not sending anything else.
Definitely keeping me far away from upgrading, newest vehicle is an early 2000s Corolla and still does 40mpg.
Honestly with how cheap and easy it is to fix at home, barring safety improvements I really don’t see a point in upgrading. Infotainment is just another component that will eventually go obsolete like the ones from ~2010 that are dog slow and a pain to go aftermarket on.
Yeah, this is something always in the back of my mind. There’s no way I could replace the one in my car without serious modification. There’s a bunch of shit integrated into it (heat/air controls, safety feature toggles, etc.) and it takes up the entire center of the dashboard.
Another awful “innovation”. The screen in my 2016 van just does maps, music, and radio. I can swap it out no issue if I want (but I don’t want android auto so I don’t). The climate controls are still physical knobs thank god.
Buy an electric bicycle and use the money you would have spent on a car to run for a seat for local office on the platform to improve local transit infrastructure
How good are they in ice and snow? Probably a bit dangerous and cold I’d think.
There are studded tires you can get for ice but I’m not certain about their application on electric bikes.
The problem with that though is they aren’t legal everywhere. I know where I’m at we can’t have studded tires.
Bicycles can’t or vehicles can’t? There’s a vast difference in weight and I imagine most wouldn’t even notice.
I know you can’t on a motorcycle so I’d assume you can’t on an ebike as well.
I don’t live in the snow so never tried in real life, but local laws usually classify different levels of two wheeled vehicles. Some laws treat level 2 and under, where most e-bikes are, the same as bicycles. Mopeds and motor-driven cycles are a level above that are allowed on surface streets the same as cars but too underpowered for the highway. Then the level above that is the traditional motorcycle that are allowed on streets and highways.
tl;dr, it might be allowed for e-bikes to have studded tires depending on how local laws classify it.
I did all my transportation and shopping with a mountain bike for a year and it’s kind of difficult on snow and ice, fell over some. The trick is to never turn at all when on that stuff, but it’s still hard. The cold makes the oil for the mechanisms work worse too, you need special oil. My hands got very cold holding on to the handlebars, you need to find some balance between gloves that hold warmth and resist the wind and gloves that let you have enough dexterity for the brakes and shifters.
These things can be found for cheaper as off brand, but you get the idea.
I live in the nordics, while you can get chain lubes meant for extreme cold, negative twenties to thirties should be fine to ride using any lube.
Internal bearing lubrication is not a concern, same for shifters and brakes. Hydraulic breaks are not a concern, provided there is no moisture in the system.
Gloves are a must, of course, but I’ve several sets for a range temperatures, you can do just fine all the way up to pretty thick finger gloves. Some people here like to use three finger gloves to let some of their fingers buddy up.
Studded tires also make a huge difference. I can ride without them, but studs basically eliminate the most common way to fall without seeing it coming, your tires just sliding out from under you on smooth ice.
Though it doesn’t help on loose snow thick enough the tire won’t sink through to contact the ground. For that you need width and tons of tread.
Bike poggies are worth looking into to keep your hands warm. Studded tires can help with slipping too
Yes buy studded tires will help a lot
Cars are fascist, don’t drive one
It’s possible to get cars as new as 2019 where you can just pull a fuse. But it starts to get tricky.
Example my C7 Vette it only took about that (it was a bit of an ordeal to not brick the car) but it’s not connected to shit anymore.
Telemetry data will still be saved in the car systems, but not broadcast anywhere. So not too bad
Right to repair must apply to cars as well.
Holding onto my 2016 van with zero telemetry for as long as possible.
I plan to buy 2003 Skoda Octavia for obvious reasons or some car with automatic transmission.
My cousin still drives her 2003 Octavia and it’s still in great shape. Diesel, manual and four wheel drive. Amazing car!
My car is built in 2003 and I don’t think I’m ever moving it on.
It peaked in 2005 before the driver inputs got overrides and and speed outputs started lying to you.
I couldn’t even imagine a car connected to the internet.
DIY ?
Now just hope the batteries don’t have a radio.
ITT people are all dismissive because you can’t actually be anonymous on the road (license plates, speed cameras…), but, honestly, I just want a car that doesn’t listen in on my conversations, sell my data to brokers, require any passanger to accept the privacy policy, or record the times I have sex (jk it won’t be able to if I don’t have any)
I have a 06 jeep wrangler, used to do 20 mpg but gets more around 15-17 now, which I plan on making some efficiency improvements. But its a pretty reliable engine and I live in a rural area so having an all terrain vehicle gives me some piece of mind.
If your planning on getting an older vehicle, do some preventative maintenance such as a new battery, make sure amps are equal or greater. Change the oil if it hasn’t been done. Get new belts. Get new spark plugs. Get a decent set of tires. Use fuel system cleaner.
If you plan on getting a newer vehicle you could probably pull a fuse to disable it from transmitting, but I don’t know if it would actually work.
Are there any write-ups on the situation in Europe under GDPR-legislation? Mostly I read about the US-situation which seems like the wild west, but I can’t imagine that it is perfectly fine in the EU either even if you opt-out of using their apps etc.