> Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota. However, if you use a wired USB connection then it does not do that (see the discussion here and elsewhere), so I exclusively use CarPlay via USB.
The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected.
They are both very cagey with how they talk about this (or don't).
embedding-shape 15 hours ago [-]
And once you've gotten rid of Google and Apple, your telecom company tracks you, your CC payments help track you and even cameras in public do.
It's hard to not want to throw your hands in the air screaming "whatever" when almost everything you use in public is somehow used to track you either as you move around, or in the future.
dualvariable 15 hours ago [-]
This is one of those things that can't ever be solved with individual solutions but needs to be solved through legislation and standards, and ideally a fundamental right to privacy (and a fundamental redefinition of what privacy means when it comes to corporate surveillance of individuals).
GJim 1 hours ago [-]
Needless to say, cars in the UK/EU have no such privacy invading features without an explicit opt-in thanks to sensible data protection legislation; including the GDPR.
The FUD spouted on here by the scummy adtech industry about legislation to protect YOUR privacy is mind boggling. These are the people doing the digital equivalent of sniffing your underwear to work out what you had for breakfast.
(And before somebody shouts FUD about the UK/EU vehicle eCall 112 system, that certainly doesn't track you or seek to invade your privacy on any level!)
monegator 26 minutes ago [-]
>cars in the UK/EU have no such privacy invading features
If you say so.
Maybe if you buy the car with cash, but if you finance it you are leasing from a company that has definetly accepted all the terms and conditions to capture and sell all the telemetry to various parties
>without an explicit opt-in
check out at a modern volvo/audi/whatever, they are making it so difficult to say no every single time the screen is powered on
GJim 15 minutes ago [-]
> if you finance it you are leasing from a company that has definetly accepted all the terms and conditions to capture and sell all the telemetry to various parties
No it isn't. Stop spreading FUD.
It is illegal in the UK/EU to make provision of a service dependent on allowing your personal data to be sold to third parties. This is BASIC data protection law here. You should be embarrassed for not understanding this.
> (And before somebody shouts FUD about the UK/EU vehicle eCall 112 system, that certainly doesn't track you or seek to invade your privacy on any level!)
How do you know?
BTW, the checking all the opt-ins is usually the first thing the sales person does when selling a new car.
GJim 51 minutes ago [-]
> How do you know?
And the FUD has started. Maybe try reading the law?
No doubt you believe any adtech request for personal data should be met by the subject promptly bending over and grabbing their ankles with both hands?
golem14 59 minutes ago [-]
I'm tempted to say "oh you sweet summer child", because it seems just unbelievable that the statement is true (in the sense that the small print in rental cars and sales contracts doesn't allow it, ot it's done by law enforcement agencies surrepticiously).
But maybe it IS true. I know it's legally mandated.
GJim 44 minutes ago [-]
> it seems just unbelievable that the statement is true
So do you think UK/EU vehicle manufactures are deliberately in mass breach of data privacy law... fully knowing the cost of a consumer backlash, fines and vehicle recall costs to fix any law breach?
Really?
It's genuinely amazing how many Americans on here (a tech news site!) are unaware of data privacy law and expectations outside their homeland.
whamlastxmas 14 hours ago [-]
[flagged]
throwway120385 12 hours ago [-]
I guess we'll just sit on our hands and do nothing, then.
foresto 13 hours ago [-]
> Government leaders will never give up their pipeline of knowing everything about everyone.
Then let us hire different leaders into government. Public servants, not overlords.
HenryBemis 13 hours ago [-]
If you have noticed, every independent candidate almost never gets elected. Vast majority of those who say they will "change the country to the better" either never get elected or are ousted early on.
And those who stay change their tune.
I fear that only blackmail-able people with the potential to win elections, get the support, so that they are beholden to someone who ultimately gives them the job (e.g. funding their campaign) and has to return the favor x10 when elected, so promises go out the window and new reality sets in.
mothballed 12 hours ago [-]
Someone tried to create an entirely new country with minimal governance by dumping sand on a submerged reef until it became an island[]. Even then it was quickly co-opted by the nearing statist powers (Tonga) with the blessing of western powers.
So it's not just that the primary process will crush anyone who will seriously roll back government powers. They won't even let anyone peacefully create an entirely new fucking island to try and get away from the tyrants and do it while leaving everyone else alone and not messing with the powers that be.
Isn't that the libertarian paradox in a nutshell, the entire reason why "government" exists? Because in reality, the alternative is "might makes right" and a larger, stronger group will band together and steamroll the smaller and uncoordinated individuals?
mothballed 11 hours ago [-]
Government is might makes right, just with a nice name slapped on it. Minerva was minarchist, not anarchist, but for whatever reason they chose not to defend their country by force. Somaliland and the remains of Rojava come to mind as present-day ~minarchist governments that defended their territory by force and ~succeeded. The point being is these kind of changes won't be allowed by election or peacefully. The primaries stop the election process and the militaries stop the peaceful separation process.
America did have a period of relatively small government intervention at the beginning, but that took a war with Britain. It also had some periods of it during the pre-founding (some of 1600s Pennsylvania and Rhode Island while Britain was occupied elsewhere). Pennsylvania (before it was a state) in particular was basically straight up anarchist for I want to say, about 20 years.
margalabargala 6 hours ago [-]
> but for whatever reason they chose not to defend their country by force
When forced off the reef, the founders went back to places like Australia, Manhattan, and London with considerable wealth. Pretty easy to see why that was preferable to possibly dying by firing on the armed forces of another country.
Somaliland and Rojava don't have that option.
PaulDavisThe1st 8 hours ago [-]
> relatively small government intervention at the beginning,
Yes, the women, slaves, non-land-owners and native Americans all loved that phase! It was paradise on earth and the embodiment of the eternal liberty to which all (*) humans are entitled.
(*) your experience may vary, depending on your membership of various demographics. Some restrictions apply. Please see package for details.
mothballed 7 hours ago [-]
Thank god you mentioned that. You foiled my diabolical plan of introducing slavery as utopia, as clearly imposing slavery is a way to shrink government intervention. No mention of early USA is complete without damning any experiences drawn on it because muh racism/sexism. Nevermind that whittling down to even that point took a war with Britain, which was relatively more free than before when yet still slavery and Indian slaughter was still happening.
PaulDavisThe1st 7 hours ago [-]
Thank god you responded. You have effectively disarmed my diabolical plan of refuting the idea that early American history was some sort of libertarian paradise, by pointing out that I have used the old canard of slavery as if it, by itself, could invalidate the many good things that came from the early, limited form of government.
I have no option other than to lay down my intellectual tools before you and declare you the winner of this battle of the ages. I am humbled by my idiocy in even bringing up the fundamental economic engine of the early American republic, as if it actually mattered at all in the face of the noble, if perhaps a little selfish, goals of those proud young Americans.
mothballed 6 hours ago [-]
I would say relatively true of the southern colonies. New England, slavery import was banned rapidly, slavery itself banned fairly early (some states almost immediately) and it was arguably never a load bearing pillar. Virginia in particular and the southern colonies only avoided starvation by stumbling on tobacco.
I'd also note slavery was also influenced by how land distribution happened in the colonial era. Lands dispersed under more feudal models lent themselves more to slavery and indentured servitude. Lands that for various reasons that were rapidly sold were more likely to end in the hands of small holders without slaves or fewer slaves.
wahnfrieden 4 hours ago [-]
I've read Graeber/Wengrow. Any new recommendations?
8 hours ago [-]
wahnfrieden 4 hours ago [-]
Hierarchical power conflicts with servitude
simplyluke 11 hours ago [-]
> your CC payments help track
Not only that. Them and the point-of-sale vendors (aptly shortened PoS), sell that data. They tend to attempt to do this anonymized. How successful they are in anonymizing that is very much so up for debate.
The websites (and even their retail locations) you buy from send your purchase data to meta and other advertisers directly via APIs so they can better track their marketing conversion rates. You can browse their APIs [1][2] to see what kind of data they like to get, but it tends to be every piece of identification they have on you. Rewards programs make this a much richer data set. You don't need to be a user of Google/Meta for them to build a marketing profile based on this. Google links your physical conversion from ads based on your maps data. Facebook does the same if you give them your location data. Many retailers attempt to use the bluetooth/wifi signals from your phone to track the same data even if you pay in cash [3].
There's no legal framework preventing this outside of the EU and California.
> They tend to attempt to do this anonymized. How successful they are in anonymizing that is very much so up for debate.
Yeah I think the big thing to push or talk about is that there is no such thing as "anonymized".
There's only such as a thing as "can only be identified as X many people". Like for a given dataset you can make any data point correlated to 1 of say 50 people. If somebody is anonymizing data and they don't provide a k-anonmizity [1] you should just assume it's 1:1 and effectively not anonmized.
K-Anonymity isn't the only technique. Differential Privacy is arguably more robust.
orthecreedence 4 hours ago [-]
> They tend to attempt to do this anonymized. How successful they are in anonymizing that is very much so up for debate.
let anon_id = md5(SSN);
like_any_other 7 hours ago [-]
In the good old days, if you were found to be informing on your neighbors to hostile powers, you were liable to find yourself in a mass grave when the political winds shifted, or even sooner.
But now it's so convenient and discreet and common, we think nothing of it. Plus, Google and Apple and Facebook and their partners and everyone they sell data to are our friends, not enemies :)
brikym 8 hours ago [-]
A friend used to work in ad tech years ago. The telecoms sell real time location data to digital billboard companies which are targeted at whoever is nearby. It's basically minority report. I can definitely imagine they're now using visual processing and face recognition on the billboards.
everdrive 14 hours ago [-]
Nonetheless I'll still try to maintain what privacy I can.
B1FF_PSUVM 9 hours ago [-]
You do you, John C. Calhoun of Minerva Road, Springfield, CO.
An agent will be shortly with you to assist in that endeavor.
kQq9oHeAz6wLLS 8 hours ago [-]
> An agent will be shortly with you to assist in that endeavor.
In some parts of the world that's a death sentence for the target. In other parts, it's one for the agent.
B1FF_PSUVM 7 hours ago [-]
Oh, please. We're not cavemen here. A little coaching on internet best practices, a dash of psychological assistance, perhaps a girl scout cookie or two ...
port11 2 hours ago [-]
It’s still worth minimising how many companies get your data, and minimising the data itself. I’m not sure what data Apple and Google get specifically out of their car thingies, but it’s very easy to avoid using their car thingie.
drnick1 12 hours ago [-]
> And once you've gotten rid of Google and Apple, your telecom company tracks you, your CC payments help track you and even cameras in public do.
Maybe, but what happens without the mod described is that Google and Apple track you in addition to the telecom company. That, of course, assumes that you carry a cell phone tied to your identity. Some people refuse to carry cell phones altogether because of the privacy implications, or use them mostly in airplane mode with an anonymous SIM for backup.
jazzyjackson 6 hours ago [-]
I use a googleless flip phone and just don't do anything important on it, and leave it behind often. We didn't always carry tracking devices with us, you can choose not to.
You can also buy an older car that doesn't come with a SIM card installed.
asdff 10 hours ago [-]
At least you can shut your cellphone off and pay in cash.
asdefghyk 11 hours ago [-]
RE .... company tracks you ..... [ somewhat off topis ]
Did you know ... in many countries government tracks car number plates and the data is stored for many years.
zekyl314 14 hours ago [-]
Exactly, and more and more places are removing cash as a payment option :(
razakel 14 hours ago [-]
Cash handling isn't free, and for smaller businesses might actually end up being more expensive than accepting electronic payments.
bigfishrunning 14 hours ago [-]
If your margins are so razor thin that the cost of handling cash is significant, you need to raise your prices. Cash is legal tender -- not accepting it for in-person transactions is really shitty (maybe shouldn't be allowed?)
9x39 12 hours ago [-]
> you need to raise your prices.
And if the competitor doesn't? Ouch.
I think there should be a "digital equivalency act" or something to hamper full digital capture, but my feelings aside, there's a few powers that dislike cash:
Free people like cash, but businesses with low-skill/low-trust workers dislike cash because despite the CC fees, there is less theft, less overhead with cash reconciliation, cameras to watch cash with, less safes to manage, less cash pickup services.
The IRS hates it because there is a cash industry (as there should be, imo, but I'm injecting too much opinion already) that doesn't report earnings. I personally know barbers, housecleaners, handymen that admit to reporting no or few earnings, and synthesize a living off cash and benefits. If you stop paying taxes, this actually works pretty well compared to a low-end tax-paying job. My housecleaner takes overseas vacations (like, thrifty ones in hostels) 2-3 times a year this way.
Banks (arguably the IRS again, deputizing them with KYC) squint at you when you deposit or withdraw significant cash - ask any weed industry participants. Untrackable currency is a natural catch-all for people they don't want to bank with, so it's just friction and headache naturally.
leothecool 13 hours ago [-]
You can't even get coins counted for free at retail banks anymore. Cash handling is too expensive even for the place that ostensibly provides cash handling services to the general public.
speed_spread 13 hours ago [-]
Just make all your prices round up to the nearest dollar bill after tax. Eliminate coins at the source.
razakel 13 hours ago [-]
"Legal tender" only means it must be accepted to settle a debt.
rdiddly 13 hours ago [-]
Walking out of the store with groceries generates a debt, no?
phainopepla2 12 hours ago [-]
I believe that's more likely to generate a criminal charge
rdiddly 7 hours ago [-]
You're being more literal than I was. My point was that "a debt" is a broader concept than the GP comment acknowledges. A debt is incurred any time you propose or agree to buy something. And legal tender is the way you settle it.
dotancohen 11 hours ago [-]
Then how about paying after ordering and eating a meal?
pixl97 11 hours ago [-]
Depends.
If there was a posted notice that no cash is accepted it's unlikely you'll get a criminal charge, but you can get civilly sued. Most places will just accept the cash then put up a picture saying "If this asshole shows up again, trespass him"
davchana 6 hours ago [-]
No, eating food & then paying is a debt. After the services have been rendered. If seller can pull back the items, never provided the service, no debt.
fragmede 13 hours ago [-]
You can't go into a store with a gun and demand the cash out of the register if there is no cash.
skrtskrt 12 hours ago [-]
The actual cost is shrinkage from general human accounting mistakes and all the extra time it takes to manage.
I worked at the gym in college and we sold like one item a day and it was still a whole bunch of work and pain to keep up on the cash counts correct.
I definitely believe that all businesses should take cash as much as is reasonable, but logistically it is understandable why some choose not to
bigfishrunning 13 hours ago [-]
You shouldn't do that anyway; also, you can't skim a credit card I'm not using/carrying. There are crime arguments on both sides.
whamlastxmas 14 hours ago [-]
It's not about "just raise prices", it's about some industries (e.g. upstart restaurants) that already have massive failure rates and have hyper competition. Even airlines don't make money on flights, and instead only on selling credits cards or other perks.
If your operating costs are some percentage higher for accepting cash versus the coffee shop across the street that doesn't, you're more likely to fail.
bigfishrunning 13 hours ago [-]
If everyone has to accept cash, then everyone has the same costs and the point is moot. At any rate, courts are required to accept legal tender, and I think that requirement ought to extend to businesses as well.
angoragoats 11 hours ago [-]
> At any rate, courts are required to accept legal tender
Assuming you’re talking about the US here: there is no such requirement, at least not at the federal level. Individual states may have their own laws, but see for example this notice [0] from a Texas federal court that they will no longer accept cash as of May 21, 2021.
The real problem for those businesses is way upstream of payment processing costs, namely in the cost of business loans, the general poverty of the American consumer, and (for brick-and-mortars) zoning. The latter is a matter of getting municipalities to relax restrictions put in place mid-century literally to support segregation, and the former two are a matter of forcing the wealthy to eat the costs of their poor decisions from the last few decades, rather than continuing to allow them to socialize related losses through avenues like scandalously low labor pay vis a vis productivity and various investment/asset market scams (which, through housing and passive retirement investment, they've roped in Boomers and older Gen-Xers).
If you wish to make an apple pie shop from scratch, you must first invent an economy that isn't hamstrung by legacy obligations from ventures that people who are long-dead somehow were allowed to finance with your paycheck. (Somewhere, a middle-aged nepo-baby is clutching her pearls at the thought, and I just think we should cherish, rather than shy from, the opportunity to throw her and her siblings under the bus.)
Dylan16807 8 hours ago [-]
Handling cash isn't free, but $0.30 + 3% or whatever is also a significant distance from free.
kyleblarson 7 hours ago [-]
1987 4runner, no phone, use cash.
King-Aaron 6 hours ago [-]
I have heard whispers at times that people who operate 'off grid' like this end up being viewed heavily as persons of interest.
Anecdotally via friends in law enforcement.
Henchman21 8 hours ago [-]
Perhaps it's time to give up some convenience for old ways, eh?
nullsanity 8 hours ago [-]
[dead]
rkagerer 13 hours ago [-]
Is there any information about precisely what vehicle telemetry they capture and retain?
I know the laws are far from perfect, but isn't there some legislation compelling them to disclose what they collect?
What specifically would be the most relevant law/regulation? (If it varies by geography, pick any major market, eg. California, that is big enough to impact their engineering design and the content of published material). You mentioned they're cagey, and my aim is to examine if there's a gap between what they're supposed to disclose and what they do, which could be rectified by litigation. Eg. If they just say "vehicle telemetry" that doesn't tell you much, and I'd happily contribute to an EFF effort to get them to elaborate.
Alternatively someone who works close to this code could provide some examples of what a "typical" smartphone OS platform collects these days.
pbhjpbhj 11 hours ago [-]
GDPR should work to get a copy of the data, also it would only be allowed to be collected with explicit permission -- I'm assuming that data about your car is PII about you.
KennyBlanken 12 hours ago [-]
Generally speaking the author seems to wave a bunch of conspiracies around without the evidence to support it, or frankly, much technical knowledge.
The author seems unaware that in iOS you can uncheck nearly every single location usage the OS and Apple Apps themselves collect.
On iOS not only can you shut off things like traffic reporting while using Maps and cellular/WiFI/Bluetooth data collection...unlike Google, Apple will let you use those services without requiring you contribute to them.
mmooss 11 hours ago [-]
> the author seems to wave a bunch of conspiracies around without the evidence to support it
The author provides links at the top to credible reporting on relatively well-known privacy concerns.
happyopossum 7 hours ago [-]
> They are both very cagey with how they talk about this (or don't).
No, not really - at least not apple. They are very clear on what CarPlay’s privacy stance is, and they’ve got privacy white papers on pretty much everything:
Again, at least on the apple front this comes off as a ton of “stated without evidence “
like_any_other 7 hours ago [-]
What does a user see when enabling CarPlay on their iPhone, and not browsing apple.com for random .pdfs?
drnick1 15 hours ago [-]
You need GrapheneOS to sever the link to Google. You can also deny specify apps and services Internet access.
MSFT_Edging 14 hours ago [-]
Is android auto still available with Graphene? AA is genuinely one of the few life-changing features introduced in the last decade that I'd prefer not to go without.
subscribed 13 hours ago [-]
Yep and works flawlessly via USB for me. That was a deal breaker for me for the longest time too.
Allowing it to connect over Bluetooth requires granting AA plenty of additional permissions which I didn't want to do (but hey, on GOS at least you can muzzle that thing).
wing-_-nuts 12 hours ago [-]
I like the idea of graphene, but I worry my banking / brokerage apps wouldn't work anymore and that'd be a deal breaker
drnick1 12 hours ago [-]
The Graphene community maintains a list of compatible banking apps.
Another possibility is to keep an old/cheap, stock Android phone at home with WiFi only for apps like this.
monkpit 5 hours ago [-]
Doesn’t that defeat the point of using an app at all? Use a computer at that point.
Angostura 15 hours ago [-]
Standard Carplay is essentially an additional screen for your phone - your existiing privacy settings carry across. What's your concern?
vk6flab 14 hours ago [-]
Unfortunately that's not quite true, since the "app screen" on the media display during Android Auto use has an additional "Toyota" icon that AFAIK isn't coming from my phone.
What's more concerning is that it's entirely unclear exactly what information is shared over the Android Auto link, in my case, over Bluetooth.
tadfisher 14 hours ago [-]
There's a protobuf-based API for two-way communication between the Android Auto app and the head unit [0]. It depends on what the headunit supports, but this includes data such as GPS location, steering wheel button activation, accelerometer data, parking brake activation, gear selection, touch screen input, dimmer switch position, odometer, and much more.
A lot of this has obvious use within the AA interface; for example, the parking brake position is used to prevent scrolling too far through lists, and the car's GPS is usually much more accurate than the phone's and better on the phone battery.
One of the things I notice CarPlay has access to is the fan speed. In one of my vehicles, when I say “hey siri” it turns the HVAC fan down so it can hear me better. I’ve always wondered if the interface is the phone telling the car “hey make things quieter” or if it’s explicitly turning the fan down. It’s also interesting that this only happens in one of my cars. I assume it’s because the other car is a higher end vehicle and has a quieter fan.
dmitrygr 13 hours ago [-]
In GM cars (as observed in my last few), the logic is in the head unit: "mic on -> hvac lower", while "hotword detect" uses a different "mic on" method that does not
EDIT, previously "does not" above said "doe snot", which explains the reply below
addaon 13 hours ago [-]
I'm sure it's not great, but deer mucus is a bit of an extreme description.
tadfisher 12 hours ago [-]
I appreciate this comment, FWIW.
dmitrygr 11 hours ago [-]
I never learned to properly touch type, i have my own method, somehow, which uses two fingers of the left hand and three of the right. Spacebar being pressed too soon or too late is, sadly, common :(
Dylan16807 8 hours ago [-]
Proper touch typing doesn't fix that issue.
adestefan 14 hours ago [-]
That icon is a "close Carplay/Auto" button. My Subaru has a Subaru button; my wife's Mazda has a Mazda button.
gruez 15 hours ago [-]
>if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota
Source? Can bluetooth devices do that without the user's knowledge?
MRPockets 15 hours ago [-]
I assume that the original article statement is referring to connecting to CarPlay/Android Auto wirelessly, not simply connecting via Bluetooth for a speaker-type setup. But I do not know that this is the case. Certainly, I would assume all privacy bets are off if you connect CarPlay/Android Auto in any manner.
jklinger410 15 hours ago [-]
> then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota
How?
colordrops 15 hours ago [-]
They are probably confusing google auto with bluetooth.
brg1007 14 hours ago [-]
On Android there is an option called "Bluetooth tethering - Share phone's internet connection via Bluetooth" . If it is On and you are connected to the car's bluetooth it will have internet access via your phone.
jklinger410 14 hours ago [-]
I'm suspicious that the car's system can do this. I don't think we should be assuming your car can tether internet through bluetooth until we see someone snoop Toyota-bound traffic being routed through their phone.
kccqzy 9 hours ago [-]
That's Bluetooth PAN. I would be very surprised that a car will implement this profile.
nullify88 1 hours ago [-]
I have a 2025 Renault 4 etech and I frequently enable bluetooth thethering so I can access Spotify, HBO etc via the in car entertainment system (It runs a flavour of Android called OpenR Link) , not via android auto. Though I frequently need to enable the bluetooth tethering setting on the phone before the profile can be activated via the cars paired devices menu (where you can select other profiles such as Audio, calling, etc)
While the car has a sim card already, I can't use it for general purpose apps without a subscription. Only updates, remote control and I suppose telemetry.
I usually opt for choosing a bluetooth tether instead of wifi since I already establish a connection for calls, or music / audio books.
It isn't hard to imagine Android being able to transmit vehicle telemetry via the same means.
Projectiboga 9 hours ago [-]
A 12v bluetooth to FM transmitter can at least give you tunes and a speaker phone feature.
arkadiyt 16 hours ago [-]
In a perfect world they wouldn't collect it either, but I'd rather Apple have it than the car manufacturer (or rather, only Apple vs both Apple and the car manufacturer)
zackify 16 hours ago [-]
I use android auto through grapheneos thankfully! this is crazy!
b00ty4breakfast 15 hours ago [-]
this sounds like donning a TNT vest to diffuse a bomb
andrepd 16 hours ago [-]
Can you clarify? Does it feed it bullshit data? Because android auto expects car telemetry data which it streams to Google's servers. Which is a big no-no for me for obvious reasons.
piaste 15 hours ago [-]
It doesn't stop Android Auto from doing whatever with the car data, but it's sandboxed to have no more default privileges than a regular app, so it can be denied access to your phone's data by default (apps, contacts, etc.). Wireless AA will only work if you grant it extra privileges; wired AA does not need them.
You can also "firewall" AA via something like TrackerControl, this would let you block connections to eg. Google Analytics servers without denying network access altogether (which would likely cause AA to stop working). I've only used AA with short-term rentals so I didn't spend too much time exploring these options.
andrepd 15 hours ago [-]
Fair enough. Streaming my location and an OBD dump to Google whenever I'm driving is a non-starter for me, so I'll stick with the aux cord!
everdrive 15 hours ago [-]
What about if it's just paired as an audio device rather than through an app?
embedding-shape 15 hours ago [-]
Don't get CarPlay/Android Auto that way though, so no navigation/maps for example.
everdrive 14 hours ago [-]
Sure -- I'm not asking a general question, but thinking about my wife's phone, which is paired as an audio device. It sounds like we're probably in good shape.
Jblx2 14 hours ago [-]
Are there any cars that support CarPlay/Android Auto that don't have built-in navigation/maps?
embedding-shape 14 hours ago [-]
AFAIK, every single one of those "built-in navigation/maps" either require the car itself is internet connected (with its own modem), or that you every year get a SD card with map updates to stick into the car.
I guess it's fine in an emergency, but I wouldn't want to use it day-by-day, the live traffic/road closure information in my case ends up saving us tons of time over the year.
Jblx2 10 hours ago [-]
It is also OK if you only use GPS 3 times per year.
grokx 13 hours ago [-]
Mine is from 2013. There is no longer map updates for the built in nav system.
So I bought an Android auto / Car play module that integrates with the car touch screen. Now I have up to date maps and navigation for ever. :)
bigfishrunning 14 hours ago [-]
My 2019 Subaru legacy supports auto and does not have built in navigation. The aftermarket dashboard display in my 2011 Ford ranger also supports android auto but has no built in GPS.
hoistbypetard 14 hours ago [-]
Mine (a US 2017 subaru impreza) supports both and doesn't have built-in navigation/maps.
vel0city 13 hours ago [-]
Yes. I can't remember which cars (some base-model Hyundais I think) but I know I've rented a few that did have Android Auto but did not have any navigation included.
internet2000 12 hours ago [-]
I trust Apple more than I trust Toyota.
sneak 12 hours ago [-]
You shouldn’t. Apple preserves backdoors in iCloud encryption to enable warrantless government surveillance. They have no other option.
willis936 12 hours ago [-]
It's weird to hang up on this specific item because they do actually offer an E2EE icloud option. Lose your key: lose your data.
Nobody has it on, and unless BOTH sides are using it, your iMessage conversations are all readable by Apple, because they are backed up twice - one for each end.
This option is also disabled in the UK - an intentionally preserved backdoor for government access.
Okay fine but I use it and so does everyone in my immediate family and we're not in the UK. So... you're wrong.
phony-account 12 hours ago [-]
> The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected.
Do you have evidence or a citation for this? Or is it just the sort of statement that’s made in the pretty certain expectation of upvotes on HN?
platevoltage 7 hours ago [-]
I would have liked to have seen this citation too instead of seeing you get downvoted.
dyauspitr 8 hours ago [-]
Yeah, but at least for now they don’t have the power to remotely disable my car or jack up my insurance prices and I trust Apple 1000% more than any of the other random car companies do not sell my data.
nullc 14 hours ago [-]
> then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota [...] so I exclusively use CarPlay via USB.
I would be concerned that a passenger connecting their phone to it while I was driving.
In other cars I've been successful picking up the relevant modules for peanuts from surplus/scrap then just desoldering the RF-active components (like bt radios, etc) and swapping them in. YMMV but if it doesn't work you're just out the cost of a junk part.
Even if some radio feature is benign its existence means that its hard to be confident that there isn't some other telemetry feature you missed. With no connectivity at all you don't need to worry that you missed something because you can monitor the car with a spectrum analyzer and observe its never transmitting.
Unfortunately in some newer cars you can't swap any modules without a dealer tool to pair the module to the car, presumably in a bid to prevent third parties from fixing the car (presumably preventing people from lobotomizing their surveillance isn't on their radar yet).
downrightmike 16 hours ago [-]
They are cagey because they get nearly $100k upfront with crazy interest rates, and then they make a ton of money through their spyware.
pfortuny 16 hours ago [-]
Honest question: what do you mean?
downrightmike 16 hours ago [-]
You pay inflated prices for the car and then they still steal and sell your data. This isn't hard to understand, same thing smart TV mfg do.
Jblx2 15 hours ago [-]
$100k is in Canadian dollars? I just added almost every accessory/package and option to the the 2026 GR Sport Plug-in Hybrid RAV4, and it came out to $55,821. If there were options that were nearly identical, I only added the most expensive one. So I only added one hammock ($340) and one of the Pelican Dayventure Backpack Cooler ($301). This includes the dog first-aid kit, and the human first-aid kit. Maybe all the options will come through this link:
...maybe there is a lot of dealer markup in your area?
epicide 16 hours ago [-]
I think you mean "subsidized" instead of "inflated".
Rooster61 15 hours ago [-]
No, they meant inflated. Cars are quite expensive right now, and dealers are notorious for raking in cash through financing. If they were subsidized, prices would be lower to increase user base, as in the aforementioned dynamic present in the current smart TV market.
I think the inital point was that car manufacturers/dealers are double dipping through initial cost/interest AND data harvesting.
alext5 15 hours ago [-]
Both an high end tv or a car are expensive items where the manufacturer shouldn’t be making additional income on your personal data.
A free 55 inch tv supported by ads would be subsidized. A big ticket item price likely does not change even if it intrudes on your privacy and the manufacturer makes additional income on your data. In that sense it’s not subsidized it’s just greedy business practices.
funimpoded 13 hours ago [-]
I haven't had any insight into the industry lately, but did work for a company in that space several years ago.
Most (all?) ordinary TVs, plus things like Roku streaming devices, are sold essentially at-cost. The profit comes from ads and information-brokering stuff. This makes it basically impossible to break into the market without doing the same thing.
alext5 10 hours ago [-]
What you describe is a business decision.
Different products exist at different price points to cater to different customers.
If you want to sell a subsidized product with the implication that there will be ads, that’s one business strategy, but to say that it’s not viable to have a higher end product that will not sell the user data because it’s not commercially viable is something I’ll have disagree with.
Computer monitors with no smart features wouldn’t viable if that was the case.
funimpoded 9 hours ago [-]
It’s a business decision, but one of the options won’t move enough units to keep Wal-Mart and Target and Costco and Best Buy using shelf space for your product, and the other might.
codezero 7 hours ago [-]
Does anyone have any details on this claim?
Important: Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota. However, if you use a wired USB connection then it does not do that (see the discussion here and elsewhere), so I exclusively use CarPlay via USB. I wish I had a way to completely disable the car’s Bluetooth functionality, but it’s deeply integrated into the head unit.
How can data via Bluetooth be routed to an active internet connection? I assume this would only work if you have the manufacturer's car application installed on your phone.
One caveat, if you use bluetooth to connect your phone to the car DCM will use your phone to connect to the mother ship and presumably send your data. I only use my iPhone cable to connect to the car which does not have this effect.
This sounds like pure speculation, and I would love to hear if there is any information that can substantiate what they are claiming.
phire 6 hours ago [-]
Yeah, I'm a little suspicious about that claim.
Bluetooth tethering is a thing, actually predates wifi tethering. Though it's not enabled unless you enable Personal Hotspot in your phone settings (and Android requires it to be enabled separately).
CarPlay complicates things, as it only uses bluetooth to pair, then it switches to using a wifi network (as bluetooth doesn't have anywhere near enough bandwidth). Maybe Apple automatically shares internet over that carplay connection?
I have no doubt that the car will use the internet connection if one is exposed, I just doubt it will be exposed automatically.
ruszki 1 hours ago [-]
My iPhone automatically shares the internet without enabling hotspot with my Toyota via Bluetooth. It happens automatically. I just start the car, and it happens. And CarPlay is not involved, since there is no such thing in my car.
trinsic2 5 hours ago [-]
One thing I notice is that it doesn't appear to upload contacts from your phone in usb mode. I haven't confirmed this.
yonatan8070 4 hours ago [-]
Bluetooth tethering is a thing, and I believe is enabled by default on Android, maybe it's using that?
For me on Android 16, the setting is in Network & internet > Hotspot & tethering > Bluetooth tethering
lucisferre 14 hours ago [-]
I have the same car and want to do this, but not for the reasons the author noted but because the GPS unit in the car is broken when paired with Carplay and has the wrong compass heading causing navigation to be completely useless.
I have reported this to Toyota multiple times with videos detailing the problem and they have denied the problem and ultimately when faced with the evidence simply refused to fix it.
I've been a big fan of Toyota's Production System and their management culture, but this experience has really diminished the brand for me. I realize these problems exist with all cars today. The pattern seems to be to foist low-quality hardware and software on their customers and take no responsibility for the results. Software bugs aren't what they consider a "typical car problem" so they simply don't fix them.
maxwells-daemon 13 hours ago [-]
I have exactly the same problem in my (latest-model) Honda Civic / Android Auto! I thought I was going crazy, I'm glad to hear someone else has the same problem.
The only fix I've found is to disconnect the phone and use its map standalone, just sending audio over Bluetooth. Maybe it's possible to get Android Auto or Carplay to reject GPS data from the car? I don't know...
kioleanu 15 minutes ago [-]
I had the same problem with my Skoda, but it was fixed under warranty, albeit it took 7 months for them to do it, although they've acknowledged it from day one.
I use Apple CarPlay and one thing that consistently worked was starting the navigation on the phone before it connected to the car.
Otherwise, the fix is relatively simple and cheap: the ECU has to be replaced, it doesn't cost too much, but it's pretty labour intensive.
KennyBlanken 12 hours ago [-]
Stop "reporting this to them multiple times" and sue them.
This is exactly why the civil legal system exists.
I promise you a consumer rights attorney will be interested in going after Toyota if you have clear evidence of it.
Or you could take it to an independent mechanic. It's likely just a bad connection to the "sharkfin".
> I realize these problems exist with all cars today.
Nah. It really doesn't, not to the same degree. Consumer Reports has demonstrated this handily for many, many years.
bdamm 13 hours ago [-]
Some brands take software very seriously. This isn't an "entire industry" problem.
My experience is pretty small; I've owned the same Tesla Model 3 LR for the last 6.5 years, and the software has been pretty much solid the entire time. There was briefly a problem with echos when I called land lines using the bluetooth and my iPhone, but that problem eventually went away - not clear if it was because the iPhone changed, the software was updated, or perhaps the particular landline I was calling got an upgraded CO, but for a car that's a pretty good track record. There were some sensor glitches but they got fixed.
I've test driven other cars. Lucid Air - tons of weird glitches. Rivian - almost as good as the Tesla, but laggy UI on a brand new car. My Tesla is almost seven years old and still smooth as the day it was new! How do they do it?
Compass heading specifically does seem to be unusually challenging. Does anyone else recall the bizarre "Google Maps on iPhone is 90 deg off" problem? Totally strange.
mft_ 27 minutes ago [-]
I had an M3LR during 2021/22 as a company car and during that time they “refreshed” the UI completely which made it objectively worse as a means of interacting with your car (i.e. more taps/levels/menus to get the same simple things done).
Aside from that, it was always pretty solid and IMO better than the typical legacy manufacturer offering.
cheema33 13 hours ago [-]
As a fellow Tesla Model 3 LR owner, I can confirm that this has been my experience as well. I bought mine in 2008. So nearly 8 years old and still going strong.
natch 6 hours ago [-]
You mean in 2018 maybe?
selcuka 4 hours ago [-]
The year is correct. They omitted to mention that it was a Tesla DeLorean.
NewsaHackO 13 hours ago [-]
Yeah, this is similar to what I hear about Tesla's everywhere. While some members of the company leadership can be polarizing, the product itself seems very solid. Have been saving up for my first "good" car since starting my end-career job, really want to get a Tesla, but wish there was a hybrid option due to charger anxiety. Otherwise, would get one already.
dreamcompiler 6 hours ago [-]
> charger anxiety
I've done many USA cross-country trips in a Tesla. Chargers are a non-issue if you stick to interstate highways. I often don't, which means I have to do some advance planning. I find that fun. Others might not.
But if I were in the market for an EV today I wouldn't buy a Tesla. It's a great car but until the Musk family is no longer part of the company I won't buy another one or recommend them to others.
UltraSane 12 hours ago [-]
"some members of the company leadership can be polarizing" What a cowardly way to say "make multiple nazi salutes"
KennyBlanken 11 hours ago [-]
and has repeatedly made racist statements
and amplified racially bigoted conspiracy theories
and likes eugenics
and runs companies which have set a record for the highest number of complaints about racial discrimination and bigotry in its workplaces
and bought an entire social media platform solely so he and people with his ideologies could spew bigotry without having their accounts deleted
and, uh, came from a very wealthy white family that lived in one of the most racially oppressive countries on the planet during his youth
UltraSane 8 hours ago [-]
and seems intent on recreating apartheid in the US.
drnick1 12 hours ago [-]
> Some brands take software very seriously. This isn't an "entire industry" problem.
This does not change the fact that Tesla is shamelessly spying on you. In fact, Tesla takes the software so seriously that it can probably fully remotely control your car. This is not something that I would want, and, if I were to be gifted a Tesla, the first thing that I would do is unplugging the cellular modem. If the car becomes unusable because of this, I would get rid of it.
KennyBlanken 12 hours ago [-]
All you need to do is convince your Tesla that it's in a constant state of having just crashed, and the poof, nobody will ever see your data!
Brian_K_White 13 hours ago [-]
Tesla takes software very seriously, but for their goals not yours.
bdamm 8 hours ago [-]
This is just fearmongering trope. You can imagine whatever you like, but there's no evidence that they're anything other than a car and technology company that wants to sell lots of its product.
p_j_w 7 hours ago [-]
Their employees were caught viewing and sharing nude photos of their customers on slack.
KennyBlanken 12 hours ago [-]
> Some brands take software very seriously.
> Tesla
It's really hard to take this claim seriously about a car company that programs its self-driving system to disengage if it detects what it thinks is a likely crash, so said company can then tell investigators, regulators, juries, and the public that "the car wasn't in self-driving mode when it crashed." "I'm not touching her, Mom. THE STICK is touching her!"
...and touts itself as having the most advanced driver assistance and self-driving capabilities, yet has the highest crash rate of any brand? Beating out Mustang and Imprezza WRX STi owners is truly an accomplishment, though.
...and (still?) hasn't fixed its issues with "phantom braking" that have caused multi-car pileups
...and has self-driving software documented as being so bad it will randomly swerve at cyclists, steer at light poles while turning, and swerve at crowds of pedestrians on a street corner waiting for the light? Which after years of refinement drives about as well as a highly distracted teenager who just got their learner's permit?
Yeah, taking software "very seriously."
bdamm 8 hours ago [-]
We were talking about the fundamental experience of driving the car. If you want to pick at the features that the Toyota can't have, then sure, but you might as well complain about it not being able to fly.
My personal experience of the FSD function is that it works as its supposed to; it handles the mundane tasks of driving while I look around, and it's easy for me to interject when I feel I need to, which is almost never. That's what I wanted and that's what they delivered. It was not so good earlier, yes including phantom braking, but it's very good now.
babypuncher 13 hours ago [-]
I don't know about internet, but it actually works the other way for GPS; Carplay/Android Auto relay the car's GPS data to your phone, because that is usually more accurate and it means your phone doesn't have to burn battery constantly polling its own GPS.
giancarlostoro 12 hours ago [-]
> I have reported this to Toyota multiple times with videos detailing the problem and they have denied the problem and ultimately when faced with the evidence simply refused to fix it.
I don't work for Toyota, but I do wonder, who exactly within Toyota have you contacted? Maybe you're reaching people who have no idea how to reach out to a real engineer within Toyota?
bdamm 8 hours ago [-]
Resolving basic usability issues shouldn't require infiltrating the company.
everdrive 15 hours ago [-]
The 2024 Ford Maverick has a single fuse for the telematics unit that you can remove without throwing a code or an error. No idea if this remained true after the 2025-2026 refresh, but worth knowing.
Kias have a “Massachusetts mode” flag hidden behind a service menu (that needs a dealer code) that disables telematics at the owner’s request. However, the service menu pin also has timeout protection that will inject a waiting period between retries so there is no guessing.
I don’t think there’s convincing my dealer to get into the service menu and disabling it.
I would presume that other manufacturers might have this as well.
It let me disable telematics, and Kia support confirmed that my car was flagged as a "Massachusetts variant" even though it wasn't purchased in MA.
ok_dad 15 hours ago [-]
Give one of the mechanics $500 and I bet they’ll accidentally drop the password on the floor of the car as they get out after moving it inside to change the oil.
s3p 14 hours ago [-]
Or someone get access to 5.5 cyber or mythos and brute force their way in
cucumber3732842 11 hours ago [-]
I bet if you can speak to the mechanic without the service advisor supervising the innteraction $100 would do it.
ok_dad 10 hours ago [-]
Yea but it’s worth at least $500 to me so I’d give the guy more, personally. $100 is a nice dinner out, $500 might help pay a bill.
bell-cot 14 hours ago [-]
> I don't think there's convincing my dealer...
How far do you live from Massachusetts, and how do your feel about driving vacations?
formerly_proven 10 hours ago [-]
> I would presume that other manufacturers might have this as well.
On newer vdubs there’s both a “location services” and a “offline mode” toggle in the infotainment, though this only turns the infotainment SIM off. Obviously this also disables remotely controlling the car using the app.
And the secondary eCall SIM cannot be disabled - not without triggering a fault code and a tell-tale. Since eCall is considered a safety-critical system it has self-monitoring and must work for the vehicle to pass inspection. It even has its own separate power supply. This is true for any vehicle (type) newer than ~2018 in the EU. This probably makes tracking the rough location of any eCall-equipped vehicle quite easy, if you have signaling-level access to the cell network – exactly like in all those SS7 exploits.
edit: turns out they thought about that and eCall modules aren’t supposed to constantly stay connected to a cellular network (dormant mode). Instead they only log onto the cellular network when needed. Difficult to verify as a consumer though.
nullc 14 hours ago [-]
> Kias have a “Massachusetts mode” flag hidden behind a service menu (that needs a dealer code) that disables telematics at the owner’s request.
I would be very concerned that the flag just continues to submit your data but with a "telematics disabled" bit set on it. This is absolutely how location privacy is implemented in some devices. Moreover, even if it is effective it could be remotely reset including accidentally as part of an update.
Better than not setting it, I suppose! :)
giancarlostoro 12 hours ago [-]
I'm more afraid of the likelihood of someone smashing the window on a modern Kia thinking they can start it up with an iPhone lightning cable (just look up "Kia Boys" if you're confused by any of this) and drive off with it, when in fact, they cannot anymore. Unfortunately, until people stop breaking into Kias I'll avoid the brand in perpetuity.
xattt 8 hours ago [-]
Nah, not an issue in Canada since immobilizers are mandatory.
giancarlostoro 8 hours ago [-]
Not an issue with modern Kias in the US since they come with them but previous models did not, so guess what people will break into it regardless. Criminal will break the window, try and then leave your car damaged.
10 hours ago [-]
drnick1 15 hours ago [-]
Older Toyotas also had a DCM fuse, and this was the easiest way to get rid of telemetry. I am not sure if partially disassembling the dash and physically removing the DCM is now necessary.
arkadiyt 15 hours ago [-]
There's still a fuse for the DCM even in this car but:
- It has an internal battery and will keep running for quite a while after pulling the fuse. This is a safety feature in case you get in a crash that disconnects the 12V battery
- It will break your in-car microphone as discussed. Repairing that requires opening up the dash
- That won't do anything for disconnecting the GPS antenna
brewdad 14 hours ago [-]
GPS is receive only. If you've disabled the ability to send telemetry, there should be no reason to be concerned about the GPS antenna.
fc417fc802 14 hours ago [-]
If it keeps collecting telemetry it could upload it later if it ever gets the chance. Better it isn't collected in the first place.
drnick1 12 hours ago [-]
Good point, but in practice I think the only way onboard data could be exfiltrated is by a dealer while the car is being serviced. If you DIY or hire an independent mechanic, this seems unlikely.
throwway120385 12 hours ago [-]
Or by the FBI, NSA, CIA, DHS, or some other interested entity.
willis936 12 hours ago [-]
If a TLA is interested in you then you don't need to worry about a data log in your car.
Arch-TK 10 hours ago [-]
I find comfort in thinking that, if a TLA is interested in me, they have to work a little bit harder.
willis936 7 hours ago [-]
They don't. They have all internet traffic dragnetted and satellite imaging and radar far beyond what is publicly disclosed. They don't need to check in with some low res crap that insurance companies use to nickel and dime you. If you're trying to escape surveillance and control from TLAs then you better start your moon base plans soon.
mothballed 10 hours ago [-]
The kind of organized crime that those people should be focused on are also resistant to this kind of tracking. The cartels and gangs just use burner cars that they dump, possibly with the keys and title still in it. Good luck doing much with the log but you've got the log and even the entire car to try and gather all the evidence you want. This tracking is mainly for hemming up small fry and productive citizens.
willis936 12 hours ago [-]
That also means it isn't passed to your phone via android auto / carplay. Phone GPS is much worse than car GPS for road navigation. It's basically unusable.
Arch-TK 10 hours ago [-]
I've successfully used it in my 2006 Ford Fiesta for about 10 years now...
The reliability is way better than GitHub's uptime.
Better even than my car's uptime.
You must work in telco.
99.9999% or it's unusable :P
willis936 7 hours ago [-]
My SO immediately sniffed out when the GPS antenna was unplugged from a car with carplay. Unacceptably low spouse approval factor.
arkadiyt 13 hours ago [-]
This is addressed in the blog :)
ezfe 15 hours ago [-]
Just a note about Toyota specifically - There are many blog posts and articles out there alleging that Toyota shares your data with insurance companies.
As I own two Toyota's I have read through these carefully and consistently the theme is that the owner was opted into this program without knowing it (likely by the sales person clicking through setup steps to enable every feature). If you are not opted in, I have seen no evidence they share driving data.
When I set up my Toyotas, the app clearly walks through the programs they have and you must click either "yes/opt in" or "no/opt out" for each program. It is not opted in by default.
dylan604 14 hours ago [-]
I've bought multiple Toyotas from the same dealer, and each time the sales person has been overly aggressive about setting up the app and connecting to the car. The first time I let them do it to a point as I had not seen what it did, but had to prevent them from syncing contacts. After that, I had to be very stern about not needing help to set up an app I was never going to use. I don't know if they are used to neophytes being unable to handle this and think they are doing a service or if it's a push to get people to connect/sync as much as possible.
giancarlostoro 12 hours ago [-]
> I don't know if they are used to neophytes being unable to handle this and think they are doing a service or if it's a push to get people to connect/sync as much as possible.
Likely doing it to remove any frustrations from the brand new buyer being unable to figure out how to set it all up. The last thing you need is someone changing their mind about the car they just bought, because well if setting up the app is a PITA, what else is terrible about the car?
dylan604 12 hours ago [-]
The main problem I had with it is the fact it requires an app in the first place. Once they have an app on your phone, they have access to so much data. The app by nature of the functions it performs will need GPS, Bluetooth, and Contacts at a minimum. Once they have that access, there's nothing stopping them from using it for whatever they want. That's just absolutely not something I'm willing to give a car app. Do we really think their map/routing app will be better than something else I could use instead? I don't even like using map apps because of their power to snoop and report.
ezfe 11 hours ago [-]
There's no app requirement to use the car, only the app features.
10 hours ago [-]
dylan604 10 hours ago [-]
wow, did you read too much into that one my friend. of course it's not needed for using the car. it's needed to use the in dash mapping feature.
ezfe 8 hours ago [-]
Okay so I read your comment to say you didn’t want their mapping service so assumed it was more broad. My bad.
That being said, on re-reading the Toyota app does not require location/Bluetooth/Contacts to set up.
jabroni_salad 13 hours ago [-]
according to some guys on r/askcarsales the manufacturers have required KPIs for onboarding app users so they just have to do it.
addaon 12 hours ago [-]
I assume any dealer who's comfortable signing a contract (terms of service) on your behalf is comfortable with you signing a contract on their behalf. Time to write yourself a new car.
danbrooks 11 hours ago [-]
This aligns with my understanding.
Before 2018-2019, the opt-in process for data sharing was hidden on a website somewhere. Around that time, the form became part of the vehicle purchasing process.
ndesaulniers 12 hours ago [-]
There was a recent class action suit against GM for this.
Barbing 15 hours ago [-]
> Unfortunately I think it’s only a matter of time before the modem and GPS become more deeply integrated into the car (making this blog post infeasible), or cars have more drastic failure modes when the modem/GPS is removed, or anti-right-to-repair laws get passed to further clamp down on this behavior.
Guaranteed
hughw 9 hours ago [-]
It's for the safety of the children.
eigencoder 13 hours ago [-]
> Important: Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota.
How is this the case? I thought bluetooth was just sharing my phone's audio. Why would it allow requests over the internet? Surely there's a way to tell the phone not to give its internet connection to any connected bluetooth device?
stuckindoors 13 hours ago [-]
When reading the article I think he appears to be talking about car play/android auto connection not audio only connections. I think Bluetooth in AA and Carplay is used to configure a local network between the phone and the car to transmit the images to the cars screen. I would assume that that data capability can also be used for the car to communicate with the Internet.
ezfe 13 hours ago [-]
It does produce a local Wi-Fi network but there's no evidence that it supports internet communication. That would be considered a hotspot, which not all carriers even support.
zakisaad 11 hours ago [-]
I've never understood how this can be limited in practice: surely as far as the carrier is concerned, all traffic from the mobile device is the same (unless there are identifiers on the traffic coming from hotspotted devices via the mobile device). Here in Australia we've never had any form of hotspot detection/segmentation - if you have a data plan, all data features work (across all carriers). I do recall lots of online chatter from the US though, especially years back when mobile data was more of a precious resource.
ezfe 11 hours ago [-]
Your phone voluntarily tags the hotspot data with specific TTL values which carriers use to segment the data. Not all carriers work the same though.
singron 9 hours ago [-]
Specifically it decrements the TTL of routed packets, so hotspot traffic will tend to have a TTL of 63 instead of 64. You could theoretically disable this at the risk of creating infinite routing loops, although android probably makes it inaccessible if the kernel has a setting for it at all, so you might have to rewrite packets in user space.
josh3736 18 minutes ago [-]
It has been a long time since I've done this, but:
If your Android is rooted, it's pretty easy to get tethering working. There's magisk modules that can fix the TTL problem and/or disable the hidden carrier-installed software that Android will ask for permission before enabling tethering.
rkagerer 10 hours ago [-]
Different applications on a single device can't apply different TTL's? I thought TTL was a pretty basic knob exposed to applications. e.g. A sensor that transmits fresh data every 20 seconds doesn't need stale packets bounding around clogging up the pipes, while a file transfer over an intermittently delayed link might benefit from a higher TTL.
eptcyka 10 hours ago [-]
Voluntarily tags specific TTL values much like your home router does. Some providers assign a different IP to hotspot users.
taneq 9 hours ago [-]
> voluntarily tags
Aah, you mean ‘snitches’. :P
jamiek88 10 hours ago [-]
Super easy to spoof too.
drtz 11 hours ago [-]
> surely as far as the carrier is concerned, all traffic from the mobile device is the same
Going on a bit of a tangent, but deep packet inspection can identify packets routed using NAT, so if the phone is operating as a typical hotspot it would be identifiable by your carrier. Carriers in the USA used to block / denylist / charge extra for tethering using this exact approach.
HDBaseT 11 hours ago [-]
Deep Packet Inspection presumably requires a certificate to be installed on my device to allow my connection to be MiTM'd.
codebje 10 hours ago [-]
DPI can refer to inspecting beyond just the headers, but since it's more of a marketing term than a technical one, you could also say you're "deeply inspecting" the IP headers of a packet and no-one would show up to arrest you for bad terminology.
Anyway, one way to detect NAT is to observe different TTLs originating from one device. Is that deep inspection? Probably depends on who you ask. The fact that you have to track information across multiple packets counts for something, though.
Off the top of my head I wouldn't really expect there to be much value in a MITM inspection of the contents of HTTP traffic for the purposes of NAT detection. You could probably come up with some scenarios in which it might be possible, but I'd content those scenarios aren't very practical. Easier to compare TTLs between packets, say, or track connections to known OS "phone home" destinations. While these just use information from the IP layer, they're stateful observations requiring comparisons across multiple packets, and that might count for something.
One way to detect a shitty carrier service, though, is that they're inspecting your traffic for "good" or "bad" uses of their service, because that is a good indicator that they're not just a carrier. I call it Dickish Practices Identification, or DPI.
akerl_ 10 hours ago [-]
DPI is distinct from TLS MITM (though many enterprise devices offer both).
The delineation here is between "shallow" packet inspection (which basically nobody refers to because it's just a normal part of networking), where network devices look at just the bits of the packets they need to route / NAT / etc them appropriately.
DPI can tell a ton of things without needing to MITM encrypted layer 7 traffic.
A boring example is that you can tell TLS from OpenSSH traffic just by seeing the initial handshake. sslh ( https://github.com/yrutschle/sslh ) takes advantage of this on the server side to let you run both on the same port.
A less boring example is identifying OpenVPN, Wireguard, etc traffic regardless of what port they're run on, to enable blocking VPN traffic on a network.
ninjaoxygen 10 hours ago [-]
At one point it was definitely not so deep... carriers were literally looking at the IP TTL and seeing whether it was a recognised value from the phone or a few hops less than one of the common defaults, in which case it was considered tethering traffic.
You could spoof it by finding out your mobile's TTL, overriding the TTL in the connecting device to be one higher than the mobile.
HnUser12 10 hours ago [-]
I recently switched to a carrier (Fido/Rogers in Canada). My plan limits hotspot by disabling the hotspot settings on ios. However, I was able to enable it again by changing the access point name.
Centigonal 10 hours ago [-]
On android, there is an OS-level feature that checks the cell tower to verify if you're allowed to create a hotspot. It runs whenever you try to enable the hotspot feature. On rooted systems, you can disable this check. There are also apps that let you run a hotspot without using the OS feature, bypassing the check.
taneq 9 hours ago [-]
I believe there’s some stuff like that for commercial things. One project I worked on used an ‘IoT portal’ for cloud based telemetry (at the customer’s request) and we had to get a special SIM card for it (although I don’t know if this is still needed.)
rconti 12 hours ago [-]
Plus it seems unlikely that the telematics module is even really related to the display screen stuff, let alone being configured to use alternate network connections to transmit data.
dotancohen 12 hours ago [-]
How does the carrier know that the traffic is being proxied for another device, and not e.g. requested from the phone's web browser or another app?
Does the phone add a proxy header? Can it be configured to not add the header?
svens_ 11 hours ago [-]
There might be multiple methods and heuristics, but one way that I have encountered was based on packet TTL.
Android and Linux use 64 by default - the block could be circumvented by setting the laptop to use 65 TTL.
ywain 11 hours ago [-]
Mostly by looking at packets TTL. It gets decreased by 1 by the hotspot’s NAT so if the value is something like 63 or 127 (instead of 64 or 128 which are the defaults for most platforms) then it’s almost certain the packet originated from a device behind the phone and not from the phone itself.
happyPersonR 12 hours ago [-]
Does anyone have a flow log or pcap or something from the phone showing this tho?
pelotron 13 hours ago [-]
I think there are details being left out. But several people in the comments indicate that there is a Toyota app that provides various features. I bet the app implements some proprietary bluetooth service that the head unit connects to and feeds information through. Or maybe they give the head unit a straight pipe to the internet via that service.
ezfe 13 hours ago [-]
That very much could be the case, in which case deleting the (now useless, because your car is not connected) app would resolve that - no bluetooth restriction needed.
masfuerte 10 hours ago [-]
There is a bluetooth protocol for cars to piggyback on your phone's internet connection. There was an article about it here a couple of years ago but I've forgotten the name of the protocol, and trying to search for it turns up a lot of irrelevance.
The fix for this is a phone that doesn't implement that protocol, i.e. not Android or iOS.
IncandescentGas 13 hours ago [-]
Is this specific to carplay, or can other bluetooth devices also silently and nefariously hijack your cellular data connection?
jrmg 12 hours ago [-]
Neither CarPlay nor regular Bluetooth connections allow this. It’s not a thing.
(There is the ability to set up a Bluetooth hotspot on a phone and allow Internet sharing over Bluetooth, but that’s a different thing entirely and you have to explicitly set it up and use it. It’s also slow compared to a modern WiFi hotspot).
j45 12 hours ago [-]
The bluetooth protocol includes the ability to network, and share connections like a mobile/personal hotspot.
Older versions of bluetooth may have other networking capabilities.
s3p 13 hours ago [-]
I would like everyone to know that if you have a brand new Kia, the process is even easier. I spent $20 on the Kia service manual access (didn't even know that was a thing until I read OP's post) it finally figured it out.
Modern Kias with the CCNC cockpit have a data connectivity unit that exclusively handles cellular. If you can get this unit unplugged, which only requires two Phillips head screws to remove, your set. It took me nearly 2 years to figure this out. Thanks OP
hedora 6 hours ago [-]
If you are considering purchasing a Kia, insist on getting a loaner or a 24 hour test drive.
The active driver assistance features are criminally dangerous.
Sadly, the current administration is more interested in illegally locking Kia’s engineers in cages than actually enforcing consumer protection or safety regulations.
Anyway, avoid them and Hyundai. If you don’t believe me, drive in rush hour for 30 minutes and frequently change lanes. Be sure to be on the road at dusk and dawn to get the full experience, where glare confuses the onboard cameras, so regen braking flaps on and off, and it repeatedly overrides steering and sets of spurious cabin alarms.
I’d suggest parking a few times at a costco during peak hours, but I don’t want to get anyone killed.
4rt 1 hours ago [-]
I hired a peugeot something (MPV) to drive in the french alps and it was insanely dangerous.
Driving mountainous switchbacks with very tight corners it was so strict about not wanting to cross the central line that it frequently tried to dump me into either the mountain or over the cliff.
Similarly on straight 2 lane roads where only really the centre was clear of snow and ice it was adamant that I should be driving with 2 wheels in deep snow instead of daring to drive in the middle.
HDBaseT 10 hours ago [-]
Any clues on how to disable any telemetry on a Kia Stinger?
s3p 1 hours ago [-]
Yes!! I still have access to all their service manuals for the next 48 hours.
What's your year model and engine? I'll look it up.
a-dub 15 hours ago [-]
> Strong Federal privacy laws would make posts like this unnecessary, that’s the world I’d rather live in.
yes. there ought to be a right to reasonable expectation of behavioral privacy where if it's not obvious and intrinsic to function that behavior is being recorded then it must be consented with functional opt-out.
gps tracking to the manufacturer of a car seems egregious. i wonder if it runs afoul of anti-stalking laws.
cbdevidal 13 hours ago [-]
I was looking into this with Teslas. Apparently the car will not be bricked if you cut the antenna wires. They are in the side mirrors (both sides) and the wires are exposed when you pull the interior door panels.
If you then charge only at home you’re even more private than gas cars, which must stop at gas stations with cameras.
But both types of vehicles are easily spotted with Flock cameras. And if you keep your phone on that tracks you, too.
I’m not that paranoid so I won’t do it, I just wanted to know.
pfp 11 minutes ago [-]
I tried looking into this too but couldn't get further than some reddit bickering and a handful of forum posts. Not a Tesla owner myself but might want to be if the privacy issues can be fixed.
Ideally I'd like to keep my cake and eat it: keep navigation (preferably offline), spotify, etc. working but disable the telemetry, remote control, etc. From what I could gather, Teslas can use Wifi (your phone's hotspot) as a backup uplink. So depending on how they've implemented the cloud features, after disconnecting the antennae, you might be able to set up a tiny router and whitelist certain DNS queries, HTTPs connections, etc. But it might also be that they just use a big ol' VPN tunnel to the mothership and pipe all the cloud features through it.
Slightly less ambitious: does the navigation in Teslas work offline? Offline maps and route calculation have been around since the 00's in standalone GPS navigators, so it's not impossible.
left-struck 10 hours ago [-]
>Gas stations with cameras.
Everything has cameras these days. On my street almost every house has a cloud connected camera. Every major road has cameras, every store and business. Now I’m not suggesting we give up the fight for privacy but avoiding gas stations does nothing
cbdevidal 37 minutes ago [-]
That’s specifically why I said ”Flock cameras”.
asdff 10 hours ago [-]
Difference is most of those things you mention overwrite their data in a few days or weeks. Even doorbell cameras, no one's stuff is being stored indefinitely.
HDBaseT 10 hours ago [-]
How do you know?
Most of these are cloud connected, how do you know they aren't storing license plate information, or face data, or audio data for extended periods of time in the cloud?
Arch-TK 9 hours ago [-]
Are you implying that we shouldn't be annoyed at Flock and forced GPS tracking in cars because my ignorant neighbours have a cloud connected doorbell?
Because I am instead annoyed at all three.
Not necessarily my neighbours, but the companies selling this spyware.
HDBaseT 9 hours ago [-]
That is not what I'm suggesting at all, what?
asdff 10 hours ago [-]
Nothing comes for free, so what's the profit angle to do this? Government is the obvious customer, but that would leave a papertrail too if such deals were worked out especially asking for perpetual storage until the heat death of the universe.
HDBaseT 9 hours ago [-]
The cost comes from your tax. Surveillance has an unlimited budget.
You can store an ungodly amount of data if you convert everything to metadata, e.g store a face picture for a short period of time, create a hash to match against other faces in the database. Same with license plates.
Using the metadata alone could effectively completely track your whereabouts.
dreamcompiler 6 hours ago [-]
> the car will not be bricked if you cut the antenna wires
They can't brick cars with bad antennas. They have to allow for cars that drive into tunnels or that are used in areas with no cell service.
They could choose to throw up increasingly annoying messages if the car hasn't phoned home for some time. Tesla does this if you haven't updated your software in a while but the screens are pretty easy to close and ignore.
HDBaseT 10 hours ago [-]
If you think your Tesla is somehow more "private" then my pre-2010's ICE car with no tracking electronics, then you are delusional.
cbdevidal 56 minutes ago [-]
With no antennas, can a Tesla transmit anything at all?
BTW I don’t own a Tesla. My car is like yours, a pre-2010 gas minivan with zero tracking.
venussnatch 16 hours ago [-]
What is the suspected method of Bluetooth communication?
Afaik phones do not share their internet blindly to Bluetooth devices.
jeroenhd 16 hours ago [-]
Bluetooth PAN seems to work pretty seamlessly once you've paired your phone and set it up. It's possible some kind of "seamless hotspot" functionality is remotely activating PAN on a paired device.
max8539 16 hours ago [-]
Also thought about it. It’s possible, but requires enabling hotspot on the phone. Without it, it will not share internet via BT.
buran77 15 hours ago [-]
The author probably means CarPlay and Android Auto. In wireless mode they share the phone's internet connection. The adapter linked in the article is a CarPlay adapter, not plain BT.
max8539 15 hours ago [-]
Seems like this way of using CarPlay isn’t documented. Bluetooth is used for discovery and WiFi/USB for CarPlay communication but not for providing car and internet access. Using users’ phone data without notice could be noticeable by users as well…
icehawk 8 hours ago [-]
That doesn't seem right at all, since my phone doesn't have tethering plan and I can still use CarPlay.
fragmede 16 hours ago [-]
It would also require that my phone not show my car using the hotspot, when it does show my laptop, and also for my cellphone plan to not show that usage (I have limited hotspot data), which is theoretically possible, but now we're talking three companies having to collude in a totally undetectable fashion, which seems a little far fetched.
ezfe 15 hours ago [-]
> Even after the modem is removed, if you connect your phone to the car via Bluetooth then the car will use your phone as an internet connection and send all the same telemetry data back to Toyota
What is the basis for this claim? I've never heard of this capability.
arkadiyt 14 hours ago [-]
It's from the linked rav4world post
ezfe 14 hours ago [-]
> One caveat, if you use bluetooth to connect your phone to the car DCM will use your phone to connect to the mother ship and presumably send your data. I only use my iPhone cable to connect to the car which does not have this effect.
A random post on a forum is not evidence that Toyota has found a magic way to exfiltrate data over a bluetooth connection without turning on hotspot/etc.
rightbyte 55 minutes ago [-]
If the car manufacturer got control of an app on the phone it is trivial to exfiltrate data via Bluetooth.
tadfisher 13 hours ago [-]
It's not evidence against it either. Presumably CarPlay and Android Auto could implement a network interface through the application layer, or even activate Bluetooth tethering at the system level as they are privileged apps.
But they could also do this over USB, so something doesn't add up.
throwway120385 12 hours ago [-]
RNDIS was a mechanism for tethering over USB, and you could certainly pair "Bluetooth Network Adapters" for years and there's a profile for it. So there's at least precedent for it. That makes it pretty plausible to me.
venussnatch 14 hours ago [-]
There's no basis mentioned there either. It's just stated as a matter of fact without explanation.
mono442 14 hours ago [-]
Modern cars are horrible. I recently discovered that all new cars sold in the EU constantly beep at you for supposedly speeding, even though the system doesn’t work well, and it has to be turned off every time you start the car.
ricardobeat 11 hours ago [-]
They beep when you go above the speed limit, and only for a couple seconds. If they do that 'constantly' the problem is in the driver's seat...
It takes two seconds to turn off in my car (though by law it has to reset on every drive), but I never bother. In situations where it's "ok" to drive a little over the limit, it's a small price to pay and a gentle reminder.
egorfine 35 minutes ago [-]
> They beep when you go above the speed limit, and only for a couple seconds.
No. They beep when they think I go above the speed limit.
Technically it is wrong 100% of time because the car underreports the speed. But even if we agree to ignore that fact, it is still wrong constantly because the car doesn't have nearly enough sensors and compute power to actually figure out what's the limit at the moment.
Thus this feature is as useful as cookie banners.
aniviacat 11 hours ago [-]
The car probably doesn't have perfect knowledge of speed limits across Europe.
phpnode 10 hours ago [-]
The car reads the speed limit signs too, they don't just rely on GPS.
bean469 2 hours ago [-]
In some countries the speed limit can change without a explicit sign (speed limits cancelling out at intersections / changes in pavement, etc.). In my experience, in multiple instances the systems offered a speed limit that is higher than the actual one, which can be dangerous if you're just blindly trusting the clanker
crimsontech 8 hours ago [-]
The signs also seem to take priority over GPS, I was on a road with a 50mph speed limit tonight and the car read something it thought was a 20mph speed limit sign. I have the beeps disabled but it still displays the red 20mph sign on the dash to let me know it thinks I'm breaking the law.
icehawk 8 hours ago [-]
from the last rental I had, they're not good at that.
Affric 10 hours ago [-]
Why wouldn’t they?
Dataset is readily available for most places. Pull local on entry to jurisdiction on every drive…
arcanemachiner 10 hours ago [-]
Have you ever actually worked with geodata in depth? It's a wall-to-wall nightmare.
Affric 7 hours ago [-]
Never for production at scale admittedly, only for research and on fixed line connections, mostly public transport related. Some datasets are better than others.
Internet connected options here in Australia generally have good speed limit data but there are generally very few variable speed limits that allow you to travel faster than usual.
Transition is never perfect but surely regulation would account for that?
I genuinely don’t know but to me it’s an interesting problem.
HDBaseT 10 hours ago [-]
Lick the boot more.
If you can't drive into a tree at 200mph and kill yourself in a car, then I do not what it.
retired 14 hours ago [-]
It’s horrible since it gets the speed wrong 25% of the time and 25% of the time it beeps because you are doing 33 in a 30kmh zone because you are just going along with traffic.
When you get in a car, you have to spend 20 seconds disabling all those systems. Lane keep assist is downright dangerous as it keeps you in your lane if you do an emergency avoidance manoeuvre.
I don’t hate safety system like emergency brake assist or ABS but I don’t need a nanny keeping me in my lane. I also don’t need a coffee symbol for taking a break.
trinix912 12 hours ago [-]
My Honda Civic gets the speed wrong almost 100% of the time in Slovenia where intersections automatically cancel out non-zoned speed limit signs (so no crossed out signs that the car could read). Luckily it doesn’t beep or nag about it.
(Which makes me wonder, is there a flag set to make it not beep on cars sold here? Cuz otherwise people would be returning them en masse)
doublerabbit 12 hours ago [-]
Lane assistance on hire cars piss me off. If I need to swerve I shouldn't need to be pulling against the wheel -.-
GJim 1 hours ago [-]
I'll raise you that.....
A completely empty straight country road with just a cyclist ahead of me. I pull out to pass the cyclist with plenty of room, and the lane assist tries to swerve me into the poor bugger. Very alarming considering I had no idea the car had such a "safety" feature.
brewdad 14 hours ago [-]
Isn't eye tracking required there too now? If you look away, or even not in the direction the car expects, for more than a couple of seconds >> more beeps.
mono442 14 hours ago [-]
The car I drove from 2025 didn't have it.
Cider9986 12 hours ago [-]
Related: Can I disable all data collection from my vehicle? (rivian.com)
760 points 14 days ago 361 comments
Buy Nissan instead, they will do that for you free of charge. I own 2021 Nissan Leaf and Nissan sent me an email early this year telling that the communication infrastructure costs too much for them and they are taking it down.
Jokes aside, I am seriously pissed at Nissan because it was one of reasons I bought it in the first place: to pre-heat or pre-cool the car remotely before going to work, while it is still plugged to the wall charger. And they just decided to take it down. Funny thing, they even mentioned in the email that "not to worry, I can still use my AC when I am in the car". Wow.
Sorry, rant. Anyway, my point being - buy Nissan Leaf, no connectivity guaranteed by the manufacturer, LOL.
866-RON-0-FEZ 12 hours ago [-]
> to pre-heat or pre-cool the car remotely before going to work, while it is still plugged to the wall charger
Modern aftermarket remote start systems work with both ICE and EVs alike. Take a look at Compustar. You can remote start your Leaf with a key fob from 1/2 mile away, no telemetry, connectivity, or silly app needed.
ThinkingGuy 8 hours ago [-]
There's also OPVS, which supposedly can be self-hosted (I don't know how good their product is; I'm content with 3G-only 2012 Leaf being permanently offline).
That is crazy.
5 years and they are already shutting down the servers?
They should be forced to open up the API when they shut it down.
Running a replica yourself should be pretty doable.
nathan_compton 13 hours ago [-]
How are you dealing with the chademo only charger thing?
alentred 1 hours ago [-]
Not sure what you mean, maybe it depends on region. I am in EU and have Type 2 and CHAdeMO connectors. I only charge at home and travel to go to work and back, so barely ever use CHAdeMO. I agree, though, that I don't and wouldn't travel long distances with this car.
CarVac 12 hours ago [-]
If you buy a ChaDeMo Leaf you do so knowing that it will likely never go more than a hundred miles from home.
p00ter 16 hours ago [-]
There's going to be a lot of this going on in the future. RabbitLabs CAN Commander go BRRRRRRRRRRRRRRRRRRR.
threecheese 16 hours ago [-]
I though this was just a crazy commenter, but here:
Crazy commenter, tell us a little about this. Can I use it on any Can bus?
disastronaut 14 hours ago [-]
CAN is a protocol, but the messages on the bus are implementation specific. Yes, you can use it on any CAN bus, but there's no guarantee that you will be able to decode the traffic. Some modern CAN networks are encrypted, too, because it's trivial to view the traffic. https://kentindell.github.io/2021/01/02/can2-wireshark/ has a great guide on decoding traffic with sigrok.
fullstop 15 hours ago [-]
From what I understand the CAN traffic on my vehicle is encrypted. Clearly this does not apply to all of the traffic, as I can fetch some OBD2 data with a generic dongle.
stefan_ 14 hours ago [-]
The data on the OBD2 port is legally mandated, so can't be encrypted. But besides encryption CAN buses in a car are also separated, the bus on the OBD2 plug often can't even talk to the most interesting components.
rdiddly 11 hours ago [-]
Thanks - Seeing how easy this was, encouraged me to do the same for my Subaru. The info and parts were easy enough to find.
Interestingly, Subaru itself used to make a DCM bypass kit for its cars. When AT&T shut down its 3G network, Subaru was stuck replacing all the DCMs, because they would search and search forever for a connection to a network that no longer existed, and slowly drain the battery. But there initially wasn't enough inventory to replace them all, so they offered these bypass kits if you weren't an active Starlink (cloud svcs) subscriber.
mistyvales 11 hours ago [-]
I was debating replacing the head unit in my old VW, but I actually like that it has a six-disc CD changer, SD card slot (32GB max, with support for MP3, WAV, etc.), 40-pin iPod connection, and regular AUX in. I use my phone with a USB-C DAC and have never felt like I needed anything else. With AUX I can plug in my Walkmans as well (both cassette and MiniDisc)!
Apps like Spotify in my Volvo are convinced I am in New Jersey while I'm on the opposite coast. On one hand I like that inaccurate data is being peddled to advertisers but at the same time I would actually prefer regionally relevant ads if I have to listen to them anyway.
ungreased0675 7 hours ago [-]
It’s pretty unhelpful to list off other ways one’s privacy could be compromised in response to efforts like this. Privacy isn’t all all or nothing binary choice. Taking measures to improve privacy are worthwhile, even if you don’t continue the journey to absolute anonymity.
s3p 60 minutes ago [-]
Exactly! I feel like a lot of people in these comments are saying privacy isn't achieved by doing this, and then move the goalposts to apple / google tracking you. I would love if we could just keep this about the scope of the car, and to that end I am so thankful of OP because after reading his article I was able to disable my car telemetry in 20 minutes. I've been wanting to do this for years but had no idea where to look. Spent hours on Google and couldn't get anywhere.
jmward01 15 hours ago [-]
We need more posts like this. I'd love a follow-up where instead of removing it injects fake data to the system. I am tired of passively being digitally assaulted. If they are going to do this to me without my knowing consent I want to fight back.
matheusmoreira 14 hours ago [-]
Yeah, like AdNauseam. We're way too polite when it comes to these exploitative corporations. Start poisoning their data sets. Start costing them as much money as humanly possible. Drive their returns on investments as close to zero as possible, ideally well into the negatives.
KumaBear 14 hours ago [-]
Just wait when L4 and L5 vehicles become mainstream. Tinkering with the car will be illegal. Because of our safety and the scare of bad actors.
analogpixel 14 hours ago [-]
I'm always surprised there aren't more projects that just pump random data back into all of these system. I think awhile back there was a plugin that would click on every advertisement it saw over and over, but got shutdown for some reason. But how hard is it to just have everyone inject nonstop data to all of these tracking systems? if nothing else a drive somewhere is going to eventually fill up.
jmward01 14 hours ago [-]
Hmmm... This isn't evil enough. This could actually work. This data is valuable which means there are entities that will pay to bias it. If you want a business to look more traveled, create fake driving tracks to it. If you want insurance to give you an amazing deal, build a system to slow your driving to look perfect. Random is likely easy to detect but why not get paid to forward fake data that someone else wants to inject! They will spend real time figuring out how to make it look real and get value out of it which will -really- destroy the dataset.
mywittyname 12 hours ago [-]
There have been plenty of projects that do send junk data to these endpoints. The problem is the junk data gets users noticed because some manager looking at dashboards gets an alert about some supersonic Corolla driving down the Pacific. And they go yell at the team responsible.
As a result, analytics endpoints generally have some authentication and verification built into them. Obviously, with enough time it's possible to reverse engineer these components. But that's a lot of time and effort vs just blocking the request.
mywittyname 12 hours ago [-]
Just be aware, this is something that will be noticed. I've been building analytics systems for a while now and have had people do this. Usually it gets picked up by the anomaly detection system or as an alert in the ETL pipeline when we try to transform it.
Personally, I just plop it into a "dead letter office" table, then verify it's not malicious. But it's possible other companies would handle this differently.
HNisCIS 14 hours ago [-]
Feed it the current location of the ISS and see what happens to your insurance rates.
rllearneratwork 14 hours ago [-]
this is great idea! Hackers of Hacker News let's have more projects to overwhelm bad actors with bad data. Perhaps using OSS LLMs for that.
summermusic 16 hours ago [-]
I dread the day I will have to start doing this when the 2015 vehicle I have finally goes
lqstuart 12 hours ago [-]
This is really cool. One of my favorite parts of the internet is getting to see these kinds of projects by people who aren't afraid to tear into stuff and take it apart and put it back together.
But you do all that for privacy... and then you use CarPlay?
hollow-moe 12 hours ago [-]
Can't do that in Fr*nce and likely other European countries, all vehicles must have eCall and your vechicle might not pass the mandatory routine check you need to do once in a while to be allowed on the road. Hope you like biking a lot.
djoldman 12 hours ago [-]
TIL:
> eCall was made mandatory in all new cars approved for manufacture within the European Union as of April 2018.
It's one thing for something to be mandatory original equipment, it's another for them to be necessary for passing an inspection (MOT / roadworthiness certificates). It's not mandatory in many countries, AFAIK.
asdff 10 hours ago [-]
There's going to be a lot of value in keeping cars from 5-10+ years ago around indefinitely.
hollow-moe 23 minutes ago [-]
Until they're outlawed for the poor because "they pollute way too much"
12 hours ago [-]
oblio 12 hours ago [-]
> Fr*nce
What's this?
djoldman 12 hours ago [-]
France.
oblio 11 hours ago [-]
Why not write France? I doubt HN has any censoring going on.
The reason I think this is a bad idea is that it lulls you into a false sense of security. The article makes recommendations that seem thorough and sensible - keyword "seem" - but, as mentioned elsewhere here, there are other potential hidden sources of telemetry (in CarPlay and Android Auto), and who knows what else.
For this kind of thing to succeed as a general lifestyle, you would need to invest an enormous amount of time making potentially irreversible modifications to all kinds of electronic equipment - only to be virtually guaranteed to miss something.
Do this kind of thing if you want, but don't be fooled into thinking you're actually solving the problem for real.
s3p 13 hours ago [-]
If you disconnect the modem, the car can't share any information by itself. In my opinion, that is a huge win.
egorfine 32 minutes ago [-]
There is no way to know for sure that this data is not collected somewhere inside the car and then uploaded at dealer's.
mmooss 11 hours ago [-]
I think you can substantially reduce the information collected about you, without an enormous amount of time. Security - and any solution - isn't about perfection; it's about improving the situation and making attacks more expensive.
Every HN thread is accompanied by comments saying it's all hopeless.
Riany 5 hours ago [-]
losing SOS/cloud features is real cost, but so is having an always-on telemetry device in a thing you own. this should be a software setting and a clear privacy contract
Last year we got a rental car when we were in Florida. When we first left the airport, we were using the navigation app that was in the car. First red light? Navigation app suddenly goes black and a commercial starts playing. My wife and I both look at each other like, "WTF is going on?!?" Light turns green commercial clips out and the navigation app starts working again. We waited to see if it happened at the next light. Sure enough, the last commercial finished and another started as the light turned green.
Tuned it off and used our phones from there to the hotel. That was the last time we used a rental cars navigation.
So yeah, its already happening.
4chandaily 14 hours ago [-]
This would be the last time I used that rental car company. If they wanted to make more money from you, they should have just raised the price. That is disgusting.
dylan604 13 hours ago [-]
There's only so many rental companies. It might look like there's a lot, but they are all pretty much a sibling company to a larger parent.
fc417fc802 13 hours ago [-]
I've got a great startup idea - airbnb but it's for renting out your car. Nothing could possibly go wrong!
d3Xt3r 13 hours ago [-]
New Zealand had a service called YourDrive[1] that was pitched exactly as "AirBnB for cars"[2]. I used it a couple of times and it was great, super affordable. Unfortunately they didn't survive the Covid crunch.
Thanks for the link. I once again find myself in that exceedingly strange zone where satire and reality become undifferentiable and I begin questioning my understanding of the world.
dylan604 13 hours ago [-]
Doesn't that already exist?
fc417fc802 13 hours ago [-]
... does it? I've seen stuff like zipcar but that's centralized ownership.
You buy a $40k car and it's still monetizing you. The hardware is just the entry fee. The real product is everything you do inside it.
asdefghyk 11 hours ago [-]
About removing the modem. ....
I always though ...just need to remove the ... the antenna .. modem would always get no signal and transmissons would always fail....
Same for the GPS.
To verify- no other hiddwen transmitters could use some RF( Radio Frequency) analyzers
[RF analyzer (ie spectrum analyzer) is a tool for measuring the power, frequency, and signal strength of radio frequency signals.]
dfee 11 hours ago [-]
[meta] this response was clearly not from an LLM. i wonder what sorts of distinctive styles could be telltales going forward.
pugworthy 7 hours ago [-]
As much as I should really care about this, I have to say... I don't. I should, but I don't.
To me it's a little bit like, "I love these new cellphones but I'm keeping it in airplane mode all the time because I don't want it online"
I mean what's the point of buying a new car if you're going to cripple features that are so much better because it's connected? Sure, use CarPlay or such, but to say forever end things like over the air software updates? Anything to prevent Kia from theoretically detecting sexual activity I suppose [1].
Just buy an old car. Or convert a classic into an EV [2].
There are A LOT of things in our lives that can be completely torn apart if one wants to. Glass is a vastly inferior window covering. Do you know how easy it breaks, and people can just look into it.
1
If you ask me, there's a whole whitepaper to be written about how to detect sexual activity in a Kia.
Excellent practical guide and pictures, if OP is around on this thread: well done! Your future self is going to appreciative too when this needs repeating at some point!
IFC_LLC 8 hours ago [-]
I bet in a couple of years you'll have to go straight to the dealership to fix your car, because it won't start.
On the other hand, as mentioned by others: Why bother if you use CarPlay?
inahga 14 hours ago [-]
Has anyone experienced a case where they needed an over-the-air safety update/recall performed, but weren't able to because they removed the cellular modem?
I'd like to think failure to apply an OTA safety update would trigger a mail-out notification requesting you bring the vehicle into the dealer. But that's probably optimistic...
HDBaseT 10 hours ago [-]
What type of fucking "safety" update could be performed?
If the car has a recall or safety issue with the suspension part failing prematurely, what possibly could some software nonsense do?
I think Chrysler does it too, but I only find mention of the time they bricked a bunch of Wranglers with a bad OTA update.
Broadly I don't think it's hard to imagine a software update being safety critical if the software is used in a safety critical system.
skiing_crawling 14 hours ago [-]
Its probably an antipattern on a car to need an OTA "safety" update in the first place.
fc417fc802 14 hours ago [-]
The safety update is physically removing the modem IMO. Can't be wirelessly broken into if you aren't on the network to begin with.
14 hours ago [-]
Animats 15 hours ago [-]
How good a position can you get from GPS today in receive only mode?
You can download and store Open Street Map for individual states. Map data doesn't have to come in over the air. That's not the problem. It's enhancing GPS with cell phone tower data that's the problem. That requires a cell connection.
ssl-3 11 hours ago [-]
Resolution of less than 1 meter is normal with a decent view of the sky and a lack of interference. GPS itself is always receive-only on our end as consumers.
What problem are we trying to solve here? At this point in time, guided navigation with completely offline maps and GPS has already been a no-brainer off-the-shelf thing for decades.
mmooss 11 hours ago [-]
> GPS itself is always receive-only on our end as consumers.
AFAIK it's almost always enhanced by things cell tower data, wifi network data, and external data sources (besides the satellites). Look up GPS/GNSS enhancement and augmentation for the latter.
ssl-3 10 hours ago [-]
I mean exactly what I wrote: "GPS itself" means GPS, itself.
Not GPS and WAAS. Not GPS and RTK. Not GPS + wifi + BT + cellular. I didn't mean any of those things, so I did not write any of those things.
If the thing is more than GPS -- by itself -- then that's outside the scope of what I was referring to with the juxtaposition of the words "GPS" and "itself".
(If a thing -- by itself -- can be better specified to be that way using concise phrasing, then I'm all ears.)
garaetjjte 14 hours ago [-]
I don't think cell tower connection will give you any more precision, GNSS fix will be much more accurate. (within few meters)
You could get more accurate fix with RTK data, but I'm not sure if that's actually widely used. And in any case that doesn't require active communications either, you could get correction data from satellite broadcasts too.
stackghost 15 hours ago [-]
>That requires a cell connection.
Technically it only requires an antenna that can listen on the LTE band (or even GSM). Trilaterating based on cell towers with a hackRF or other SDR is a fun exercise.
themafia 14 hours ago [-]
GPS is exceedingly accurate compared to cellular signals on it's own. What it isn't is fast. So the "enhanced GPS" is mostly just proving satellite ephemerides so your GPS device can lock onto the overhead satellites faster.
If your device has zero GPS signal then you can get ~100m accuracy from the cellular signals alone. If your device doesn't have "enhanced GPS" then you can get ~1m accuracy from the GPS signals alone.
fc417fc802 13 hours ago [-]
I think towers were historically already much more accurate than 100m in urban areas.
Note that this changed with 5G beamforming. The new towers have a much better idea of where you are. (My understanding (thanks to other HN commenters) is that technically it's possible to do beamforming without deriving precise 3D coordinates but that this isn't how it's done in practice.)
ro_bit 14 hours ago [-]
> Everything that relies on a data connection will no longer work. This includes things like over-the-air updates as well as Toyota cloud-based services and SOS functionality
I hate how this is a trade off. It’s totally possible for cars to broadcast their location only if the SOS is pressed or the crash sensor is triggered, but it feels like there’s no way to have that without also having everything else.
rbbydotdev 13 hours ago [-]
> Strong Federal privacy laws would make posts like this unnecessary, that’s the world I’d rather live in.
This is what I thought about doing instead. Removing the whole module seems overkill. Removing the signal should be enough to disable it.
freshnode 13 hours ago [-]
Writes long article about the concerns of software phoning home
Peppers article with Amazon affiliate links
Perfect summation of 2026
DarkmSparks 10 hours ago [-]
I'm still just refusing to buy this garbage in the first place.
All these car manufacturers pushing this horrorshow deserve to go under. Tbh it looks like most will soon....
HDBaseT 10 hours ago [-]
All the Chinese car manufactures are doing the same, they aren't likely to go under soon.
hoppyhoppy2 9 hours ago [-]
Which car manufacturers are not pushing this garbage?
chromadon 15 hours ago [-]
I wonder if insurance would refuse to pay out in the event of an accident due to this modification?
parliament32 11 hours ago [-]
They would have to prove the modification caused the accident.
HDBaseT 10 hours ago [-]
No they don't.
They can deny any claim for any reason, the onus gets flipped on you because if you want to fight back, you have to take a multi-billion dollar company to court .
omgJustTest 9 hours ago [-]
Could one cover the antenna with strategic foil?
Removing seems hard/complicated but foil seems within most ppls reach.
chzblck 15 hours ago [-]
I cannot imagine the paranoia that it would take for me to go through this process.
EvanAnderson 15 hours ago [-]
I cannot imagine the lack of concern about my privacy that it would take to make me daily-drive a car that hadn't been put through this process.
(I dread the day my 2007 Civic is no longer usable.)
b112 15 hours ago [-]
Not to mention, people kept saying "Who cares, you're being silly" then multiple companies were caught selling into to insurance companies.
s3p 58 minutes ago [-]
This is why I hate the online car owner forums. Car owners ask reasonable questions like these and people sneer in their replies saying "that's a horrible idea" as if somehow every car owner agreed to universal tracking into telemetry and is totally fine with it.
ErroneousBosh 12 hours ago [-]
My daily is a 1997 Range Rover. You want to update the computer? Sure, you need to remove the desktop PC-sized box of 68HC11-family chips from under the driver's seat and desolder the two big 144-pin ones.
Affric 10 hours ago [-]
Get a determined ex-partner who knows a lot about you and wants to harm you or kidnap your children. For most people this represents the greatest immediate risk with this kind of data.
cindyllm 10 hours ago [-]
[dead]
tclancy 12 hours ago [-]
Step 1. Be very, very single
When I was a younger man, audio visual forums used to have an unfortunately sexist, but fairly good conceptual measure they called “wife acceptance factor”. It should really just be partner acceptance factor. Regardless of whom you are with, I hope they would physically intervene before letting you do this. What is the point? All of these posts feel like they miss the forest for the trees. Don’t like This Modern World? Fair enough, start by leaving your phone at home. Pay cash. And so forth. The author’s problems would be better solved by taking the bus. If you’re going to get into messing with cars, the wiring harness is not the place to start. Every trip to the dealer or any other mechanic is going to be painful right up until you finally give up and try to private sale the vehicle. At some point in that process, after you have dropped the price by over half the Kelley Blue Book value (or whatever Palantir shit replaces that) you may actually hear yourself explaining to the pleasantly smiling with a certain look in their eye non buyer about how you had to do this.
I will admit my bias. Fair play to the author for putting this all together but it reads like a very intricate aluminum foil hat.
s3p 57 minutes ago [-]
So the authors goal is to reduce his car's ability to transmit his data to Toyota.
His solution: disconnect the cell modem
Your solution: Be single, never drive a car ever, and leave your phone at home.
?????
parliament32 11 hours ago [-]
Counterpoints:
1) My auto insurance is already too expensive. I have zero interest in "oh yeah we had to add to your driver factor because telematics says you exceeded the speed limit 11 times last year :^)". Less tracking is just a bonus.
2) He made no irreversible changes to the vehicle. Just keep the part and plug it back in when you need it for service/inspection or whatever.
3) "Telematics disabled" probably adds to the resale value of the car.
throwway120385 11 hours ago [-]
What are you talking about? People sell used cars with broken stuff all the time. You don't have to tell the buyer that you intentionally broke that feature. The mechanics that I use would all consider this modification entirely reasonable and not say anything about it after you explained yourself.
Also my spouse is just as paranoid as this guy is and when I told her what new vehicles collect she was happy she had an older model car. So this is not really a thing.
everdrive 14 hours ago [-]
Also worth noting that as recently as 2024, the S and SV models for Nissan did not have telematics whatsoever. This may still be true for the 2025 / 2026 models, I just haven't checked.
15 hours ago [-]
fuzzygaz 6 hours ago [-]
Be careful as there has been precedence of insurance companies using the fact cameras were removed/disabled to deny or reduce claims.
s3p 55 minutes ago [-]
Yeah this would be different. Also let me tell you my approach so I disconnected my car's data connectivity unit and all that does is forward the signal from the cell antennas down to the main head unit. So by disconnecting it my car doesn't actually know that it cell service has been turned off it literally just thinks there is no signal right now.
mchusma 14 hours ago [-]
I get this desire and commend the author, but I just want self driving cars and so I think we are just stuck with this.
dylan604 14 hours ago [-]
That's a hell of a defeatist attitude, and exactly the result they are hoping for.
ErroneousBosh 12 hours ago [-]
What's the advantage in having a self-driving car?
xyzelement 10 hours ago [-]
It drives itself.
antonvs 14 hours ago [-]
Why is a self-driving car so important to you? Is it really worth giving up your privacy, and advocating that others should give up theirs, just for some shortcoming in your own capabilities?
fc417fc802 13 hours ago [-]
Why should a self driving car need a network connection? It's an absurd false dichotomy. Certainly that's what will be produced if the manufacturers are allowed to get away with it but that's not a technical problem it's a social and legal one.
s3p 54 minutes ago [-]
This wasn't @fc417fc802's dichotomy, it was the person above them who posted. They were responding to another comment which assumed this
Sohcahtoa82 11 hours ago [-]
For some, driving is an absolute chore. A mind-numbingly boring task.
antonvs 7 hours ago [-]
They sound “special”.
addaon 12 hours ago [-]
> just for some shortcoming in your own capabilities?
It's a shortcoming each of us will have, if we're so lucky as to live that long.
swader999 15 hours ago [-]
If you get into enough trouble they'll get all your phone data and cell tower pings or your passenger's.
RachelF 10 hours ago [-]
Why not just remove the antenna or SIM card from the modem?
HDBaseT 10 hours ago [-]
Cars are now using eSIMs. Cutting an antenna wire only limits the effectiveness of the communication. You can wirelessly send and receive data with a solder terminal on a board if you're dedicated enough.
ThinkingGuy 8 hours ago [-]
I wonder if removing the antenna would possibly cause the modem to try to transmit at a higher power level, thus running the car's battery down.
Creamsicle47 4 hours ago [-]
Live free or die
btbuildem 13 hours ago [-]
There's a fortune to be made for whomever produces a car that has minimal features, and and electric-drivetrain with onboard gasoline generator. No screens, knobs and buttons, no assists. Extra fortune if you can licence designs and revive some of the old-and-loved classics with new safety features.
mdasen 12 hours ago [-]
> electric-drivetrain with onboard gasoline generator
Generally speaking, it's more efficient to power a car using a series-parallel hybrid system than an electric drivetrain with generator (series hybrid) while not really being any more complicated.
In a series hybrid (electric with generator), you're losing energy converting the rotational energy into electric energy. It's better to use the engine's output to power the wheels while it's in an efficient range. It's why Toyota's series-parallel hybrid design offered better mileage than vehicles that (primarily or fully) operated as series hybrids like the Chevy Volt.
> No screens
You can't really sell a car without a screen due to government regulations which require backup cameras (since 2018 in North America, since 2022 in the EU and Japan).
> no assists
Automatic Emergency Braking is going to be required in the US in 2029 (detecting frontal crashes about to happen and automatically braking, including pedestrian detection).
The EU requires even more including blind spot detection and lane-keeping assist.
I certainly agree that cars need knobs and buttons for controls like AC/heat, music, etc. However, it'd be hard to make a car where you aren't putting in a screen and assistive technology. I think a better argument would be to make a car where the screen was simply Apple CarPlay/Android Auto and a backup camera - rather than shoving a lot of garbage UX into it.
ErroneousBosh 12 hours ago [-]
> Automatic Emergency Braking is going to be required in the US in 2029 (detecting frontal crashes about to happen and automatically braking, including pedestrian detection).
I'm never going to want to drive a car that has that.
bdamm 8 hours ago [-]
My car has AEB and it's great. I'll never drive another car without it. Why not take the energy out of the impact? Humans aren't perfect, and even less so as we age.
advisedwang 11 hours ago [-]
Why? You presumably don't enjoy get into frontal crashes, are you worried about it doing false positives? Is that a significant issue?
ssl-3 12 hours ago [-]
I guess you know your cutoff date, then. My own perspective differs.
A couple of years ago, I was involved in a stupid car crash that probably would have been prevented by this kind of system. Everyone was pretty much OK (yay), but both vehicles were ruined. And for me, at least, it was a complete and utter pain in the ass to find something else to drive that fit my intended use.
0/10. Would rather be annoyed by false positives.
Mathnerd314 13 hours ago [-]
It is probably like with smart TV's where the value of the telemetry data ends up subsidizing a significant fraction of the hardware. Car manufacturers seem to be doing a lot of experiments with what they can charge for in terms of ongoing subscriptions. I am sure if they could show ads without it being considered distracting they would.
bobro 13 hours ago [-]
I think the problem is there isn't a fortune there. It would be a successful endeavor, but not something to rake in huge piles of cash. The kinds of leaders and investors who could pull off what you're describing are instead working where they can make multi-millions rather that multi-hundreds of thousands.
bdamm 13 hours ago [-]
Well, Bollinger Motors tried just that, but they couldn't make it fly.
However, you now have a chance to buy one of the rare prototypes!
A screen for the back-up camera is federally required for new cars in the US, afaik. But using the screen for additional purposes is still optional... for now...
bee_rider 15 hours ago [-]
Who’s responsible for presenting the privacy policy to passengers of a car, anyway?
fnord77 15 hours ago [-]
Couldn't you just ground or resistor out the car's cellular antenna so it can't transmit data?
class3shock 9 hours ago [-]
There's a post earlier linking to someone doing that for a Tacoma
13 hours ago [-]
sunshine-o 11 hours ago [-]
I love those type of posts. But there is probably gonna be an interesting discussion when he will get the car serviced at Toyota.
Maybe a simpler way is to to slap a Faraday cage on all antennas.
hughc 10 hours ago [-]
props for still using Skitch to annotate images in 2026
Any guesses at how large the addressable market is for a dumb car (or appliance)?
I would be the target customer, but I keep making convenience concessions and buying the nice car / appliance with smart stuff.
I appreciate this guide from a technical perspective, but despite a lot of the stated preferences, I’m not seeing a huge market for it.
Convenience is paramount.
java-man 16 hours ago [-]
Maybe two metal pins through the GPS and the cellular antenna coaxial cables would do the trick?
foobarian 16 hours ago [-]
You would be surprised how leaky RF can be and how hard to completely suppress. There is a reason things like anechoic chambers and test labs are very expensive.
amelius 15 hours ago [-]
Just hold it wrong. That should do the trick.
java-man 16 hours ago [-]
Leaky - possibly, but we are dealing with the real world where you have plenty of background noise. The cell tower will likely fail to receive the signal.
ssl-3 11 hours ago [-]
It doesn't take much of a leak. Radiation likes to radiate.
I used to keep my work phone in a Faraday bag sometimes. (I had my reasons[1]). It usually worked. Occasionally, it didn't work and the phone would demonstrate this by doing phone-stuff like ringing even while it was snug inside of that conductive bag.
So sometimes, the radiation was radiating well-enough despite my efforts.
Not so long ago, I was chatting with someone here on HN about blocking RF at GHz frequencies using aluminum foil. I was sure that it would be trivial, and they were sure that it would be difficult. So I tested that.
I started pinging my phone on its LAN IP, and wrapped it in foil. I found that I could increase latency some and also institute some packet loss.
But I couldn't stop it altogether -- not with a sheet of aluminum foil, anyway. No matter how carefully I made the creases, pings simply kept happening. (Having satisfactorily demonstrated to myself that were right and that it would be difficult, I stopped testing at that point.)
---
So here in reality, suppose the [car's] cellular connection finds that it has a connection occasionally. What's to stop it from buffering data and sending it in batches during times when it works? A few dozen lines of code that's geared to that purpose, perhaps? Or maybe a few hundred lines, instead?
Not that the difficulty matters much; the software is all closed up and inscrutable.
If the value of batching data to deal with intermittent connections is greater than the cost of producing the code to do this, then it can be assumed that such code has been or will be written.
---
[1]: An abusive manager I had liked to turn on the tracking system that the phone had. I didn't mind being tracked while I was on the clock, but I placed a higher value on my privacy than on her ability to be a snoopy bitch when I was not on the clock. My Faraday bag solution was adequate for that phone, at that time, with that particular tracking system, and for my particular desires, and I had access to the system with which to validate the adequacy of this success, but it was by no means perfect.
foobarian 13 hours ago [-]
That's just it - move in just the right spot where reflections combine in the right way, and it might be enough to get a ping. So the tracking would still be there just less reliable, with an unknown level of degradation. In the end you still wouldn't have any guarantees.
rasz 15 hours ago [-]
In case of Subaru turning off 2G made their modems keep trying to reconnect 24/7 draining and killing battery. Subaru refused replacing batteries killed by defective car.
retired 14 hours ago [-]
On my classic cars I fitted a battery quick disconnect in the boot. Might need to start doing that with modern cars too.
AngryData 12 hours ago [-]
Unfortunately for many modern cars that may make it run less efficiently and clean and have a rough start every time you do it for 30 minutes or more because many sensors are trained on-the-fly from a running vehicle and then the correct calibrator sensor values are then stored in volatile memory which is lost upon power loss.
I use to disconnect batteries all the time when fixing vehicles, but the last decade ive been avoiding it unless I have to because of how poorly new cars run afterwards. And people get really angry when you fix something on their vehicle and then go to drive it later and it hard starts and feels and performs worse than ever. Telling them to "just drive for 30 minutes and then restart your car again and hopefully it goes away" doesn't make people happy or confident in your fix, nor does it make diagnosing issues after replacing a suspected faulty module or sensor easier when it sounds and performs like trash for a long while afterwards.
retired 8 hours ago [-]
That makes sense! When I got a battery replaced recently, the shop kept my car powered with a jump-pack connected in the engine bay while replacing the battery in the boot. They said it was more convenient for customers to not lose any of their settings.
VTimofeenko 12 hours ago [-]
Modern cars sometimes have telematic units running off dedicated lithium ion batteries, so killing main battery might not do anything
kevin_thibedeau 16 hours ago [-]
You just need to cap the connectors with a terminator.
java-man 16 hours ago [-]
It might easier to find the cable than disassemble the car to get to the terminals.
vablings 15 hours ago [-]
Usually, the whole antenna is behind the rear-view mirror between the glass and mirror. Often glued together
estimator7292 15 hours ago [-]
That's an incredibly impractical and expensive place to put it. Frankly, I don't believe you purely because it'd be $200 cheaper for the manufacturer to put the antennas in the shark fin on the roof with all the other antennas
sleepyguy 10 hours ago [-]
This is why I want a Chinese car. At least they won't do anything with my data.
_blk 13 hours ago [-]
cool, well done. Now we just need it for the other gazillion "smart-cars" out there
Can't do the design bits, but there's full service manuals for any 1990s to early 2000s Landrover. Only NAS models, unfortunately, so for some things in UK/EU you need to interpolate a little.
Notice the complete absence of phone-home GSM modems or other tracking stuff?
TheChaplain 15 hours ago [-]
If you live in the EU and bought the car there, the GDPR still applies, even if data is sent to Toyota in Japan.
You have the full right to view and ask for deletion.
wiml 15 hours ago [-]
You'd think people would be doing that already. Has anyone posted details?
Can you skirt the GDPR by making it hard to discover who you need to ask?
chris_explicare 15 hours ago [-]
[dead]
surcap526 13 hours ago [-]
[dead]
aframemodular 16 hours ago [-]
Great guide! After getting to the end, I had no idea what AirPlay was so I looked it up... bro, all this effort to avoid telemetry and you are using an iPhone XD
lapetitejort 15 hours ago [-]
If you are wary of all the smart features in your next car purchase, consider buying a bicycle. We do not have to entertain the creeping invasion of our privacy
bigfishrunning 13 hours ago [-]
My hilly 25 mile commute isn't really bicycle compatible, unfortunately
fc417fc802 13 hours ago [-]
There are impressively capable ebikes these days. I wonder how long before tracking gets introduced to those ...
Rendered at 09:32:02 GMT+0000 (Coordinated Universal Time) with Vercel.
The problem with this is that both carplay and android auto capture their own vehicle telemetry. So even though the car is not able to use your phone as a general data pipe, Google and Apple still get access to this data when you're connected.
They are both very cagey with how they talk about this (or don't).
It's hard to not want to throw your hands in the air screaming "whatever" when almost everything you use in public is somehow used to track you either as you move around, or in the future.
The FUD spouted on here by the scummy adtech industry about legislation to protect YOUR privacy is mind boggling. These are the people doing the digital equivalent of sniffing your underwear to work out what you had for breakfast.
(And before somebody shouts FUD about the UK/EU vehicle eCall 112 system, that certainly doesn't track you or seek to invade your privacy on any level!)
Maybe if you buy the car with cash, but if you finance it you are leasing from a company that has definetly accepted all the terms and conditions to capture and sell all the telemetry to various parties
>without an explicit opt-in
check out at a modern volvo/audi/whatever, they are making it so difficult to say no every single time the screen is powered on
No it isn't. Stop spreading FUD.
It is illegal in the UK/EU to make provision of a service dependent on allowing your personal data to be sold to third parties. This is BASIC data protection law here. You should be embarrassed for not understanding this.
https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
How do you know?
BTW, the checking all the opt-ins is usually the first thing the sales person does when selling a new car.
And the FUD has started. Maybe try reading the law?
https://europa.eu/youreurope/citizens/travel/security-and-em...
So what is the point in having laws then?
No doubt you believe any adtech request for personal data should be met by the subject promptly bending over and grabbing their ankles with both hands?
But maybe it IS true. I know it's legally mandated.
So do you think UK/EU vehicle manufactures are deliberately in mass breach of data privacy law... fully knowing the cost of a consumer backlash, fines and vehicle recall costs to fix any law breach?
Really?
It's genuinely amazing how many Americans on here (a tech news site!) are unaware of data privacy law and expectations outside their homeland.
Then let us hire different leaders into government. Public servants, not overlords.
I fear that only blackmail-able people with the potential to win elections, get the support, so that they are beholden to someone who ultimately gives them the job (e.g. funding their campaign) and has to return the favor x10 when elected, so promises go out the window and new reality sets in.
So it's not just that the primary process will crush anyone who will seriously roll back government powers. They won't even let anyone peacefully create an entirely new fucking island to try and get away from the tyrants and do it while leaving everyone else alone and not messing with the powers that be.
[] https://en.wikipedia.org/wiki/Republic_of_Minerva
America did have a period of relatively small government intervention at the beginning, but that took a war with Britain. It also had some periods of it during the pre-founding (some of 1600s Pennsylvania and Rhode Island while Britain was occupied elsewhere). Pennsylvania (before it was a state) in particular was basically straight up anarchist for I want to say, about 20 years.
When forced off the reef, the founders went back to places like Australia, Manhattan, and London with considerable wealth. Pretty easy to see why that was preferable to possibly dying by firing on the armed forces of another country.
Somaliland and Rojava don't have that option.
Yes, the women, slaves, non-land-owners and native Americans all loved that phase! It was paradise on earth and the embodiment of the eternal liberty to which all (*) humans are entitled.
(*) your experience may vary, depending on your membership of various demographics. Some restrictions apply. Please see package for details.
I have no option other than to lay down my intellectual tools before you and declare you the winner of this battle of the ages. I am humbled by my idiocy in even bringing up the fundamental economic engine of the early American republic, as if it actually mattered at all in the face of the noble, if perhaps a little selfish, goals of those proud young Americans.
I'd also note slavery was also influenced by how land distribution happened in the colonial era. Lands dispersed under more feudal models lent themselves more to slavery and indentured servitude. Lands that for various reasons that were rapidly sold were more likely to end in the hands of small holders without slaves or fewer slaves.
Not only that. Them and the point-of-sale vendors (aptly shortened PoS), sell that data. They tend to attempt to do this anonymized. How successful they are in anonymizing that is very much so up for debate.
The websites (and even their retail locations) you buy from send your purchase data to meta and other advertisers directly via APIs so they can better track their marketing conversion rates. You can browse their APIs [1][2] to see what kind of data they like to get, but it tends to be every piece of identification they have on you. Rewards programs make this a much richer data set. You don't need to be a user of Google/Meta for them to build a marketing profile based on this. Google links your physical conversion from ads based on your maps data. Facebook does the same if you give them your location data. Many retailers attempt to use the bluetooth/wifi signals from your phone to track the same data even if you pay in cash [3].
There's no legal framework preventing this outside of the EU and California.
1: https://developers.facebook.com/documentation/ads-commerce/c... 2: https://developers.google.com/google-ads/api/docs/conversion... 3: https://www.nytimes.com/interactive/2019/06/14/opinion/bluet...
Yeah I think the big thing to push or talk about is that there is no such thing as "anonymized".
There's only such as a thing as "can only be identified as X many people". Like for a given dataset you can make any data point correlated to 1 of say 50 people. If somebody is anonymizing data and they don't provide a k-anonmizity [1] you should just assume it's 1:1 and effectively not anonmized.
[1]: https://en.wikipedia.org/wiki/K-anonymity
But now it's so convenient and discreet and common, we think nothing of it. Plus, Google and Apple and Facebook and their partners and everyone they sell data to are our friends, not enemies :)
An agent will be shortly with you to assist in that endeavor.
In some parts of the world that's a death sentence for the target. In other parts, it's one for the agent.
Maybe, but what happens without the mod described is that Google and Apple track you in addition to the telecom company. That, of course, assumes that you carry a cell phone tied to your identity. Some people refuse to carry cell phones altogether because of the privacy implications, or use them mostly in airplane mode with an anonymous SIM for backup.
You can also buy an older car that doesn't come with a SIM card installed.
Did you know ... in many countries government tracks car number plates and the data is stored for many years.
And if the competitor doesn't? Ouch.
I think there should be a "digital equivalency act" or something to hamper full digital capture, but my feelings aside, there's a few powers that dislike cash:
Free people like cash, but businesses with low-skill/low-trust workers dislike cash because despite the CC fees, there is less theft, less overhead with cash reconciliation, cameras to watch cash with, less safes to manage, less cash pickup services.
The IRS hates it because there is a cash industry (as there should be, imo, but I'm injecting too much opinion already) that doesn't report earnings. I personally know barbers, housecleaners, handymen that admit to reporting no or few earnings, and synthesize a living off cash and benefits. If you stop paying taxes, this actually works pretty well compared to a low-end tax-paying job. My housecleaner takes overseas vacations (like, thrifty ones in hostels) 2-3 times a year this way.
Banks (arguably the IRS again, deputizing them with KYC) squint at you when you deposit or withdraw significant cash - ask any weed industry participants. Untrackable currency is a natural catch-all for people they don't want to bank with, so it's just friction and headache naturally.
If there was a posted notice that no cash is accepted it's unlikely you'll get a criminal charge, but you can get civilly sued. Most places will just accept the cash then put up a picture saying "If this asshole shows up again, trespass him"
I worked at the gym in college and we sold like one item a day and it was still a whole bunch of work and pain to keep up on the cash counts correct.
I definitely believe that all businesses should take cash as much as is reasonable, but logistically it is understandable why some choose not to
If your operating costs are some percentage higher for accepting cash versus the coffee shop across the street that doesn't, you're more likely to fail.
Assuming you’re talking about the US here: there is no such requirement, at least not at the federal level. Individual states may have their own laws, but see for example this notice [0] from a Texas federal court that they will no longer accept cash as of May 21, 2021.
[0] https://www.txnb.uscourts.gov/news/notice-court-will-no-long...
If you wish to make an apple pie shop from scratch, you must first invent an economy that isn't hamstrung by legacy obligations from ventures that people who are long-dead somehow were allowed to finance with your paycheck. (Somewhere, a middle-aged nepo-baby is clutching her pearls at the thought, and I just think we should cherish, rather than shy from, the opportunity to throw her and her siblings under the bus.)
Anecdotally via friends in law enforcement.
I know the laws are far from perfect, but isn't there some legislation compelling them to disclose what they collect?
What specifically would be the most relevant law/regulation? (If it varies by geography, pick any major market, eg. California, that is big enough to impact their engineering design and the content of published material). You mentioned they're cagey, and my aim is to examine if there's a gap between what they're supposed to disclose and what they do, which could be rectified by litigation. Eg. If they just say "vehicle telemetry" that doesn't tell you much, and I'd happily contribute to an EFF effort to get them to elaborate.
Alternatively someone who works close to this code could provide some examples of what a "typical" smartphone OS platform collects these days.
The author seems unaware that in iOS you can uncheck nearly every single location usage the OS and Apple Apps themselves collect.
On iOS not only can you shut off things like traffic reporting while using Maps and cellular/WiFI/Bluetooth data collection...unlike Google, Apple will let you use those services without requiring you contribute to them.
The author provides links at the top to credible reporting on relatively well-known privacy concerns.
No, not really - at least not apple. They are very clear on what CarPlay’s privacy stance is, and they’ve got privacy white papers on pretty much everything:
Eg. https://www.apple.com/privacy/docs/Location_Services_White_P...
Again, at least on the apple front this comes off as a ton of “stated without evidence “
Allowing it to connect over Bluetooth requires granting AA plenty of additional permissions which I didn't want to do (but hey, on GOS at least you can muzzle that thing).
Another possibility is to keep an old/cheap, stock Android phone at home with WiFi only for apps like this.
What's more concerning is that it's entirely unclear exactly what information is shared over the Android Auto link, in my case, over Bluetooth.
A lot of this has obvious use within the AA interface; for example, the parking brake position is used to prevent scrolling too far through lists, and the car's GPS is usually much more accurate than the phone's and better on the phone battery.
0: https://github.com/f1xpl/aasdk/tree/development/aasdk_proto (pretty old reverse-engineering effort)
EDIT, previously "does not" above said "doe snot", which explains the reply below
Source? Can bluetooth devices do that without the user's knowledge?
How?
While the car has a sim card already, I can't use it for general purpose apps without a subscription. Only updates, remote control and I suppose telemetry.
I usually opt for choosing a bluetooth tether instead of wifi since I already establish a connection for calls, or music / audio books.
It isn't hard to imagine Android being able to transmit vehicle telemetry via the same means.
You can also "firewall" AA via something like TrackerControl, this would let you block connections to eg. Google Analytics servers without denying network access altogether (which would likely cause AA to stop working). I've only used AA with short-term rentals so I didn't spend too much time exploring these options.
I guess it's fine in an emergency, but I wouldn't want to use it day-by-day, the live traffic/road closure information in my case ends up saving us tons of time over the year.
So I bought an Android auto / Car play module that integrates with the car touch screen. Now I have up to date maps and navigation for ever. :)
https://support.apple.com/en-us/108756
This option is also disabled in the UK - an intentionally preserved backdoor for government access.
https://support.apple.com/en-gb/122234
Do you have evidence or a citation for this? Or is it just the sort of statement that’s made in the pretty certain expectation of upvotes on HN?
I would be concerned that a passenger connecting their phone to it while I was driving.
In other cars I've been successful picking up the relevant modules for peanuts from surplus/scrap then just desoldering the RF-active components (like bt radios, etc) and swapping them in. YMMV but if it doesn't work you're just out the cost of a junk part.
Even if some radio feature is benign its existence means that its hard to be confident that there isn't some other telemetry feature you missed. With no connectivity at all you don't need to worry that you missed something because you can monitor the car with a spectrum analyzer and observe its never transmitting.
Unfortunately in some newer cars you can't swap any modules without a dealer tool to pair the module to the car, presumably in a bid to prevent third parties from fixing the car (presumably preventing people from lobotomizing their surveillance isn't on their radar yet).
https://www.toyota.com/configurator/build/step/summary/year/...
...maybe there is a lot of dealer markup in your area?
I think the inital point was that car manufacturers/dealers are double dipping through initial cost/interest AND data harvesting.
A free 55 inch tv supported by ads would be subsidized. A big ticket item price likely does not change even if it intrudes on your privacy and the manufacturer makes additional income on your data. In that sense it’s not subsidized it’s just greedy business practices.
Most (all?) ordinary TVs, plus things like Roku streaming devices, are sold essentially at-cost. The profit comes from ads and information-brokering stuff. This makes it basically impossible to break into the market without doing the same thing.
Different products exist at different price points to cater to different customers.
If you want to sell a subsidized product with the implication that there will be ads, that’s one business strategy, but to say that it’s not viable to have a higher end product that will not sell the user data because it’s not commercially viable is something I’ll have disagree with.
Computer monitors with no smart features wouldn’t viable if that was the case.
Following the thread linked to, the only thing I can find is very unsubstantiated; https://www.rav4world.com/threads/2019-rav4-dcm-deactivate-p... :
This sounds like pure speculation, and I would love to hear if there is any information that can substantiate what they are claiming.Bluetooth tethering is a thing, actually predates wifi tethering. Though it's not enabled unless you enable Personal Hotspot in your phone settings (and Android requires it to be enabled separately).
CarPlay complicates things, as it only uses bluetooth to pair, then it switches to using a wifi network (as bluetooth doesn't have anywhere near enough bandwidth). Maybe Apple automatically shares internet over that carplay connection?
I have no doubt that the car will use the internet connection if one is exposed, I just doubt it will be exposed automatically.
For me on Android 16, the setting is in Network & internet > Hotspot & tethering > Bluetooth tethering
I have reported this to Toyota multiple times with videos detailing the problem and they have denied the problem and ultimately when faced with the evidence simply refused to fix it.
I've been a big fan of Toyota's Production System and their management culture, but this experience has really diminished the brand for me. I realize these problems exist with all cars today. The pattern seems to be to foist low-quality hardware and software on their customers and take no responsibility for the results. Software bugs aren't what they consider a "typical car problem" so they simply don't fix them.
The only fix I've found is to disconnect the phone and use its map standalone, just sending audio over Bluetooth. Maybe it's possible to get Android Auto or Carplay to reject GPS data from the car? I don't know...
I use Apple CarPlay and one thing that consistently worked was starting the navigation on the phone before it connected to the car.
Otherwise, the fix is relatively simple and cheap: the ECU has to be replaced, it doesn't cost too much, but it's pretty labour intensive.
This is exactly why the civil legal system exists.
I promise you a consumer rights attorney will be interested in going after Toyota if you have clear evidence of it.
Or you could take it to an independent mechanic. It's likely just a bad connection to the "sharkfin".
> I realize these problems exist with all cars today.
Nah. It really doesn't, not to the same degree. Consumer Reports has demonstrated this handily for many, many years.
My experience is pretty small; I've owned the same Tesla Model 3 LR for the last 6.5 years, and the software has been pretty much solid the entire time. There was briefly a problem with echos when I called land lines using the bluetooth and my iPhone, but that problem eventually went away - not clear if it was because the iPhone changed, the software was updated, or perhaps the particular landline I was calling got an upgraded CO, but for a car that's a pretty good track record. There were some sensor glitches but they got fixed.
I've test driven other cars. Lucid Air - tons of weird glitches. Rivian - almost as good as the Tesla, but laggy UI on a brand new car. My Tesla is almost seven years old and still smooth as the day it was new! How do they do it?
Compass heading specifically does seem to be unusually challenging. Does anyone else recall the bizarre "Google Maps on iPhone is 90 deg off" problem? Totally strange.
Aside from that, it was always pretty solid and IMO better than the typical legacy manufacturer offering.
I've done many USA cross-country trips in a Tesla. Chargers are a non-issue if you stick to interstate highways. I often don't, which means I have to do some advance planning. I find that fun. Others might not.
But if I were in the market for an EV today I wouldn't buy a Tesla. It's a great car but until the Musk family is no longer part of the company I won't buy another one or recommend them to others.
and amplified racially bigoted conspiracy theories
and likes eugenics
and runs companies which have set a record for the highest number of complaints about racial discrimination and bigotry in its workplaces
and bought an entire social media platform solely so he and people with his ideologies could spew bigotry without having their accounts deleted
and, uh, came from a very wealthy white family that lived in one of the most racially oppressive countries on the planet during his youth
This does not change the fact that Tesla is shamelessly spying on you. In fact, Tesla takes the software so seriously that it can probably fully remotely control your car. This is not something that I would want, and, if I were to be gifted a Tesla, the first thing that I would do is unplugging the cellular modem. If the car becomes unusable because of this, I would get rid of it.
> Tesla
It's really hard to take this claim seriously about a car company that programs its self-driving system to disengage if it detects what it thinks is a likely crash, so said company can then tell investigators, regulators, juries, and the public that "the car wasn't in self-driving mode when it crashed." "I'm not touching her, Mom. THE STICK is touching her!"
...and touts itself as having the most advanced driver assistance and self-driving capabilities, yet has the highest crash rate of any brand? Beating out Mustang and Imprezza WRX STi owners is truly an accomplishment, though.
...and (still?) hasn't fixed its issues with "phantom braking" that have caused multi-car pileups
...and has self-driving software documented as being so bad it will randomly swerve at cyclists, steer at light poles while turning, and swerve at crowds of pedestrians on a street corner waiting for the light? Which after years of refinement drives about as well as a highly distracted teenager who just got their learner's permit?
Yeah, taking software "very seriously."
My personal experience of the FSD function is that it works as its supposed to; it handles the mundane tasks of driving while I look around, and it's easy for me to interject when I feel I need to, which is almost never. That's what I wanted and that's what they delivered. It was not so good earlier, yes including phantom braking, but it's very good now.
I don't work for Toyota, but I do wonder, who exactly within Toyota have you contacted? Maybe you're reaching people who have no idea how to reach out to a real engineer within Toyota?
https://www.mavericktruckclub.com/forum/threads/telematics-f...
I don’t think there’s convincing my dealer to get into the service menu and disabling it.
I would presume that other manufacturers might have this as well.
It let me disable telematics, and Kia support confirmed that my car was flagged as a "Massachusetts variant" even though it wasn't purchased in MA.
How far do you live from Massachusetts, and how do your feel about driving vacations?
On newer vdubs there’s both a “location services” and a “offline mode” toggle in the infotainment, though this only turns the infotainment SIM off. Obviously this also disables remotely controlling the car using the app.
And the secondary eCall SIM cannot be disabled - not without triggering a fault code and a tell-tale. Since eCall is considered a safety-critical system it has self-monitoring and must work for the vehicle to pass inspection. It even has its own separate power supply. This is true for any vehicle (type) newer than ~2018 in the EU. This probably makes tracking the rough location of any eCall-equipped vehicle quite easy, if you have signaling-level access to the cell network – exactly like in all those SS7 exploits.
edit: turns out they thought about that and eCall modules aren’t supposed to constantly stay connected to a cellular network (dormant mode). Instead they only log onto the cellular network when needed. Difficult to verify as a consumer though.
I would be very concerned that the flag just continues to submit your data but with a "telematics disabled" bit set on it. This is absolutely how location privacy is implemented in some devices. Moreover, even if it is effective it could be remotely reset including accidentally as part of an update.
Better than not setting it, I suppose! :)
- It has an internal battery and will keep running for quite a while after pulling the fuse. This is a safety feature in case you get in a crash that disconnects the 12V battery
- It will break your in-car microphone as discussed. Repairing that requires opening up the dash
- That won't do anything for disconnecting the GPS antenna
The reliability is way better than GitHub's uptime.
Better even than my car's uptime.
You must work in telco.
99.9999% or it's unusable :P
As I own two Toyota's I have read through these carefully and consistently the theme is that the owner was opted into this program without knowing it (likely by the sales person clicking through setup steps to enable every feature). If you are not opted in, I have seen no evidence they share driving data.
When I set up my Toyotas, the app clearly walks through the programs they have and you must click either "yes/opt in" or "no/opt out" for each program. It is not opted in by default.
Likely doing it to remove any frustrations from the brand new buyer being unable to figure out how to set it all up. The last thing you need is someone changing their mind about the car they just bought, because well if setting up the app is a PITA, what else is terrible about the car?
That being said, on re-reading the Toyota app does not require location/Bluetooth/Contacts to set up.
Before 2018-2019, the opt-in process for data sharing was hidden on a website somewhere. Around that time, the form became part of the vehicle purchasing process.
Guaranteed
How is this the case? I thought bluetooth was just sharing my phone's audio. Why would it allow requests over the internet? Surely there's a way to tell the phone not to give its internet connection to any connected bluetooth device?
If your Android is rooted, it's pretty easy to get tethering working. There's magisk modules that can fix the TTL problem and/or disable the hidden carrier-installed software that Android will ask for permission before enabling tethering.
Aah, you mean ‘snitches’. :P
Going on a bit of a tangent, but deep packet inspection can identify packets routed using NAT, so if the phone is operating as a typical hotspot it would be identifiable by your carrier. Carriers in the USA used to block / denylist / charge extra for tethering using this exact approach.
Anyway, one way to detect NAT is to observe different TTLs originating from one device. Is that deep inspection? Probably depends on who you ask. The fact that you have to track information across multiple packets counts for something, though.
Off the top of my head I wouldn't really expect there to be much value in a MITM inspection of the contents of HTTP traffic for the purposes of NAT detection. You could probably come up with some scenarios in which it might be possible, but I'd content those scenarios aren't very practical. Easier to compare TTLs between packets, say, or track connections to known OS "phone home" destinations. While these just use information from the IP layer, they're stateful observations requiring comparisons across multiple packets, and that might count for something.
One way to detect a shitty carrier service, though, is that they're inspecting your traffic for "good" or "bad" uses of their service, because that is a good indicator that they're not just a carrier. I call it Dickish Practices Identification, or DPI.
The delineation here is between "shallow" packet inspection (which basically nobody refers to because it's just a normal part of networking), where network devices look at just the bits of the packets they need to route / NAT / etc them appropriately.
DPI can tell a ton of things without needing to MITM encrypted layer 7 traffic.
A boring example is that you can tell TLS from OpenSSH traffic just by seeing the initial handshake. sslh ( https://github.com/yrutschle/sslh ) takes advantage of this on the server side to let you run both on the same port.
A less boring example is identifying OpenVPN, Wireguard, etc traffic regardless of what port they're run on, to enable blocking VPN traffic on a network.
You could spoof it by finding out your mobile's TTL, overriding the TTL in the connecting device to be one higher than the mobile.
Does the phone add a proxy header? Can it be configured to not add the header?
Android and Linux use 64 by default - the block could be circumvented by setting the laptop to use 65 TTL.
The fix for this is a phone that doesn't implement that protocol, i.e. not Android or iOS.
(There is the ability to set up a Bluetooth hotspot on a phone and allow Internet sharing over Bluetooth, but that’s a different thing entirely and you have to explicitly set it up and use it. It’s also slow compared to a modern WiFi hotspot).
Older versions of bluetooth may have other networking capabilities.
Modern Kias with the CCNC cockpit have a data connectivity unit that exclusively handles cellular. If you can get this unit unplugged, which only requires two Phillips head screws to remove, your set. It took me nearly 2 years to figure this out. Thanks OP
The active driver assistance features are criminally dangerous.
Sadly, the current administration is more interested in illegally locking Kia’s engineers in cages than actually enforcing consumer protection or safety regulations.
Anyway, avoid them and Hyundai. If you don’t believe me, drive in rush hour for 30 minutes and frequently change lanes. Be sure to be on the road at dusk and dawn to get the full experience, where glare confuses the onboard cameras, so regen braking flaps on and off, and it repeatedly overrides steering and sets of spurious cabin alarms.
I’d suggest parking a few times at a costco during peak hours, but I don’t want to get anyone killed.
Driving mountainous switchbacks with very tight corners it was so strict about not wanting to cross the central line that it frequently tried to dump me into either the mountain or over the cliff.
Similarly on straight 2 lane roads where only really the centre was clear of snow and ice it was adamant that I should be driving with 2 wheels in deep snow instead of daring to drive in the middle.
What's your year model and engine? I'll look it up.
yes. there ought to be a right to reasonable expectation of behavioral privacy where if it's not obvious and intrinsic to function that behavior is being recorded then it must be consented with functional opt-out.
gps tracking to the manufacturer of a car seems egregious. i wonder if it runs afoul of anti-stalking laws.
If you then charge only at home you’re even more private than gas cars, which must stop at gas stations with cameras.
But both types of vehicles are easily spotted with Flock cameras. And if you keep your phone on that tracks you, too.
I’m not that paranoid so I won’t do it, I just wanted to know.
Ideally I'd like to keep my cake and eat it: keep navigation (preferably offline), spotify, etc. working but disable the telemetry, remote control, etc. From what I could gather, Teslas can use Wifi (your phone's hotspot) as a backup uplink. So depending on how they've implemented the cloud features, after disconnecting the antennae, you might be able to set up a tiny router and whitelist certain DNS queries, HTTPs connections, etc. But it might also be that they just use a big ol' VPN tunnel to the mothership and pipe all the cloud features through it.
Slightly less ambitious: does the navigation in Teslas work offline? Offline maps and route calculation have been around since the 00's in standalone GPS navigators, so it's not impossible.
Everything has cameras these days. On my street almost every house has a cloud connected camera. Every major road has cameras, every store and business. Now I’m not suggesting we give up the fight for privacy but avoiding gas stations does nothing
Most of these are cloud connected, how do you know they aren't storing license plate information, or face data, or audio data for extended periods of time in the cloud?
Because I am instead annoyed at all three.
Not necessarily my neighbours, but the companies selling this spyware.
You can store an ungodly amount of data if you convert everything to metadata, e.g store a face picture for a short period of time, create a hash to match against other faces in the database. Same with license plates.
Using the metadata alone could effectively completely track your whereabouts.
They can't brick cars with bad antennas. They have to allow for cars that drive into tunnels or that are used in areas with no cell service.
They could choose to throw up increasingly annoying messages if the car hasn't phoned home for some time. Tesla does this if you haven't updated your software in a while but the screens are pretty easy to close and ignore.
BTW I don’t own a Tesla. My car is like yours, a pre-2010 gas minivan with zero tracking.
Afaik phones do not share their internet blindly to Bluetooth devices.
What is the basis for this claim? I've never heard of this capability.
A random post on a forum is not evidence that Toyota has found a magic way to exfiltrate data over a bluetooth connection without turning on hotspot/etc.
But they could also do this over USB, so something doesn't add up.
It takes two seconds to turn off in my car (though by law it has to reset on every drive), but I never bother. In situations where it's "ok" to drive a little over the limit, it's a small price to pay and a gentle reminder.
No. They beep when they think I go above the speed limit.
Technically it is wrong 100% of time because the car underreports the speed. But even if we agree to ignore that fact, it is still wrong constantly because the car doesn't have nearly enough sensors and compute power to actually figure out what's the limit at the moment.
Thus this feature is as useful as cookie banners.
Dataset is readily available for most places. Pull local on entry to jurisdiction on every drive…
Internet connected options here in Australia generally have good speed limit data but there are generally very few variable speed limits that allow you to travel faster than usual.
Transition is never perfect but surely regulation would account for that?
I genuinely don’t know but to me it’s an interesting problem.
If you can't drive into a tree at 200mph and kill yourself in a car, then I do not what it.
When you get in a car, you have to spend 20 seconds disabling all those systems. Lane keep assist is downright dangerous as it keeps you in your lane if you do an emergency avoidance manoeuvre.
I don’t hate safety system like emergency brake assist or ABS but I don’t need a nanny keeping me in my lane. I also don’t need a coffee symbol for taking a break.
(Which makes me wonder, is there a flag set to make it not beep on cars sold here? Cuz otherwise people would be returning them en masse)
A completely empty straight country road with just a cyclist ahead of me. I pull out to pass the cyclist with plenty of room, and the lane assist tries to swerve me into the poor bugger. Very alarming considering I had no idea the car had such a "safety" feature.
(https://news.ycombinator.com/item?id=47967786)
Jokes aside, I am seriously pissed at Nissan because it was one of reasons I bought it in the first place: to pre-heat or pre-cool the car remotely before going to work, while it is still plugged to the wall charger. And they just decided to take it down. Funny thing, they even mentioned in the email that "not to worry, I can still use my AC when I am in the car". Wow.
Sorry, rant. Anyway, my point being - buy Nissan Leaf, no connectivity guaranteed by the manufacturer, LOL.
Modern aftermarket remote start systems work with both ICE and EVs alike. Take a look at Compustar. You can remote start your Leaf with a key fob from 1/2 mile away, no telemetry, connectivity, or silly app needed.
https://www.openvehicles.com
https://rabbit-labs.com/product/cancommander/
Crazy commenter, tell us a little about this. Can I use it on any Can bus?
Interestingly, Subaru itself used to make a DCM bypass kit for its cars. When AT&T shut down its 3G network, Subaru was stuck replacing all the DCMs, because they would search and search forever for a connection to a network that no longer existed, and slowly drain the battery. But there initially wasn't enough inventory to replace them all, so they offered these bypass kits if you weren't an active Starlink (cloud svcs) subscriber.
Dangerous, but hilarious (Dubai raver has set up a 303 and 606 to make acid house while he drives): https://www.youtube.com/watch?v=mwYtjQk0QaU
As a result, analytics endpoints generally have some authentication and verification built into them. Obviously, with enough time it's possible to reverse engineer these components. But that's a lot of time and effort vs just blocking the request.
Personally, I just plop it into a "dead letter office" table, then verify it's not malicious. But it's possible other companies would handle this differently.
But you do all that for privacy... and then you use CarPlay?
> eCall was made mandatory in all new cars approved for manufacture within the European Union as of April 2018.
https://en.wikipedia.org/wiki/ECall
What's this?
For this kind of thing to succeed as a general lifestyle, you would need to invest an enormous amount of time making potentially irreversible modifications to all kinds of electronic equipment - only to be virtually guaranteed to miss something.
Do this kind of thing if you want, but don't be fooled into thinking you're actually solving the problem for real.
Every HN thread is accompanied by comments saying it's all hopeless.
Tuned it off and used our phones from there to the hotel. That was the last time we used a rental cars navigation.
So yeah, its already happening.
[1] https://www.drivencarguide.co.nz/news/new-zealand-startup-le...
[2] https://thespinoff.co.nz/partner/17-09-2017/the-airbnb-for-c...
https://en.wikipedia.org/wiki/Turo_(company)
I always though ...just need to remove the ... the antenna .. modem would always get no signal and transmissons would always fail....
Same for the GPS.
To verify- no other hiddwen transmitters could use some RF( Radio Frequency) analyzers
[RF analyzer (ie spectrum analyzer) is a tool for measuring the power, frequency, and signal strength of radio frequency signals.]
To me it's a little bit like, "I love these new cellphones but I'm keeping it in airplane mode all the time because I don't want it online"
I mean what's the point of buying a new car if you're going to cripple features that are so much better because it's connected? Sure, use CarPlay or such, but to say forever end things like over the air software updates? Anything to prevent Kia from theoretically detecting sexual activity I suppose [1].
Just buy an old car. Or convert a classic into an EV [2].
There are A LOT of things in our lives that can be completely torn apart if one wants to. Glass is a vastly inferior window covering. Do you know how easy it breaks, and people can just look into it.
1 If you ask me, there's a whole whitepaper to be written about how to detect sexual activity in a Kia.
2 https://www.bugeyeguys.com/category/electric-bugeye/
On the other hand, as mentioned by others: Why bother if you use CarPlay?
I'd like to think failure to apply an OTA safety update would trigger a mail-out notification requesting you bring the vehicle into the dealer. But that's probably optimistic...
If the car has a recall or safety issue with the suspension part failing prematurely, what possibly could some software nonsense do?
Ford https://www.caranddriver.com/news/a70513450/ford-4-million-v...
GM https://www.themanual.com/auto/gm-brake-fluid-warning-recall...
I think Chrysler does it too, but I only find mention of the time they bricked a bunch of Wranglers with a bad OTA update.
Broadly I don't think it's hard to imagine a software update being safety critical if the software is used in a safety critical system.
You can download and store Open Street Map for individual states. Map data doesn't have to come in over the air. That's not the problem. It's enhancing GPS with cell phone tower data that's the problem. That requires a cell connection.
What problem are we trying to solve here? At this point in time, guided navigation with completely offline maps and GPS has already been a no-brainer off-the-shelf thing for decades.
AFAIK it's almost always enhanced by things cell tower data, wifi network data, and external data sources (besides the satellites). Look up GPS/GNSS enhancement and augmentation for the latter.
Not GPS and WAAS. Not GPS and RTK. Not GPS + wifi + BT + cellular. I didn't mean any of those things, so I did not write any of those things.
If the thing is more than GPS -- by itself -- then that's outside the scope of what I was referring to with the juxtaposition of the words "GPS" and "itself".
(If a thing -- by itself -- can be better specified to be that way using concise phrasing, then I'm all ears.)
You could get more accurate fix with RTK data, but I'm not sure if that's actually widely used. And in any case that doesn't require active communications either, you could get correction data from satellite broadcasts too.
Technically it only requires an antenna that can listen on the LTE band (or even GSM). Trilaterating based on cell towers with a hackRF or other SDR is a fun exercise.
If your device has zero GPS signal then you can get ~100m accuracy from the cellular signals alone. If your device doesn't have "enhanced GPS" then you can get ~1m accuracy from the GPS signals alone.
Note that this changed with 5G beamforming. The new towers have a much better idea of where you are. (My understanding (thanks to other HN commenters) is that technically it's possible to do beamforming without deriving precise 3D coordinates but that this isn't how it's done in practice.)
I hate how this is a trade off. It’s totally possible for cars to broadcast their location only if the SOS is pressed or the crash sensor is triggered, but it feels like there’s no way to have that without also having everything else.
Amen.
Peppers article with Amazon affiliate links
Perfect summation of 2026
All these car manufacturers pushing this horrorshow deserve to go under. Tbh it looks like most will soon....
They can deny any claim for any reason, the onus gets flipped on you because if you want to fight back, you have to take a multi-billion dollar company to court .
Removing seems hard/complicated but foil seems within most ppls reach.
(I dread the day my 2007 Civic is no longer usable.)
When I was a younger man, audio visual forums used to have an unfortunately sexist, but fairly good conceptual measure they called “wife acceptance factor”. It should really just be partner acceptance factor. Regardless of whom you are with, I hope they would physically intervene before letting you do this. What is the point? All of these posts feel like they miss the forest for the trees. Don’t like This Modern World? Fair enough, start by leaving your phone at home. Pay cash. And so forth. The author’s problems would be better solved by taking the bus. If you’re going to get into messing with cars, the wiring harness is not the place to start. Every trip to the dealer or any other mechanic is going to be painful right up until you finally give up and try to private sale the vehicle. At some point in that process, after you have dropped the price by over half the Kelley Blue Book value (or whatever Palantir shit replaces that) you may actually hear yourself explaining to the pleasantly smiling with a certain look in their eye non buyer about how you had to do this.
I will admit my bias. Fair play to the author for putting this all together but it reads like a very intricate aluminum foil hat.
His solution: disconnect the cell modem
Your solution: Be single, never drive a car ever, and leave your phone at home.
?????
1) My auto insurance is already too expensive. I have zero interest in "oh yeah we had to add to your driver factor because telematics says you exceeded the speed limit 11 times last year :^)". Less tracking is just a bonus.
2) He made no irreversible changes to the vehicle. Just keep the part and plug it back in when you need it for service/inspection or whatever.
3) "Telematics disabled" probably adds to the resale value of the car.
Also my spouse is just as paranoid as this guy is and when I told her what new vehicles collect she was happy she had an older model car. So this is not really a thing.
It's a shortcoming each of us will have, if we're so lucky as to live that long.
Generally speaking, it's more efficient to power a car using a series-parallel hybrid system than an electric drivetrain with generator (series hybrid) while not really being any more complicated.
In a series hybrid (electric with generator), you're losing energy converting the rotational energy into electric energy. It's better to use the engine's output to power the wheels while it's in an efficient range. It's why Toyota's series-parallel hybrid design offered better mileage than vehicles that (primarily or fully) operated as series hybrids like the Chevy Volt.
> No screens
You can't really sell a car without a screen due to government regulations which require backup cameras (since 2018 in North America, since 2022 in the EU and Japan).
> no assists
Automatic Emergency Braking is going to be required in the US in 2029 (detecting frontal crashes about to happen and automatically braking, including pedestrian detection).
The EU requires even more including blind spot detection and lane-keeping assist.
I certainly agree that cars need knobs and buttons for controls like AC/heat, music, etc. However, it'd be hard to make a car where you aren't putting in a screen and assistive technology. I think a better argument would be to make a car where the screen was simply Apple CarPlay/Android Auto and a backup camera - rather than shoving a lot of garbage UX into it.
I'm never going to want to drive a car that has that.
A couple of years ago, I was involved in a stupid car crash that probably would have been prevented by this kind of system. Everyone was pretty much OK (yay), but both vehicles were ruined. And for me, at least, it was a complete and utter pain in the ass to find something else to drive that fit my intended use.
0/10. Would rather be annoyed by false positives.
However, you now have a chance to buy one of the rare prototypes!
https://finance.yahoo.com/sectors/technology/articles/bollin...
Maybe a simpler way is to to slap a Faraday cage on all antennas.
DCM Bypass kit. https://www.autoharnesshouse.com/store/AHH-DCM77
I would be the target customer, but I keep making convenience concessions and buying the nice car / appliance with smart stuff.
I appreciate this guide from a technical perspective, but despite a lot of the stated preferences, I’m not seeing a huge market for it.
Convenience is paramount.
I used to keep my work phone in a Faraday bag sometimes. (I had my reasons[1]). It usually worked. Occasionally, it didn't work and the phone would demonstrate this by doing phone-stuff like ringing even while it was snug inside of that conductive bag.
So sometimes, the radiation was radiating well-enough despite my efforts.
Not so long ago, I was chatting with someone here on HN about blocking RF at GHz frequencies using aluminum foil. I was sure that it would be trivial, and they were sure that it would be difficult. So I tested that.
I started pinging my phone on its LAN IP, and wrapped it in foil. I found that I could increase latency some and also institute some packet loss.
But I couldn't stop it altogether -- not with a sheet of aluminum foil, anyway. No matter how carefully I made the creases, pings simply kept happening. (Having satisfactorily demonstrated to myself that were right and that it would be difficult, I stopped testing at that point.)
---
So here in reality, suppose the [car's] cellular connection finds that it has a connection occasionally. What's to stop it from buffering data and sending it in batches during times when it works? A few dozen lines of code that's geared to that purpose, perhaps? Or maybe a few hundred lines, instead?
Not that the difficulty matters much; the software is all closed up and inscrutable.
If the value of batching data to deal with intermittent connections is greater than the cost of producing the code to do this, then it can be assumed that such code has been or will be written.
---
[1]: An abusive manager I had liked to turn on the tracking system that the phone had. I didn't mind being tracked while I was on the clock, but I placed a higher value on my privacy than on her ability to be a snoopy bitch when I was not on the clock. My Faraday bag solution was adequate for that phone, at that time, with that particular tracking system, and for my particular desires, and I had access to the system with which to validate the adequacy of this success, but it was by no means perfect.
I use to disconnect batteries all the time when fixing vehicles, but the last decade ive been avoiding it unless I have to because of how poorly new cars run afterwards. And people get really angry when you fix something on their vehicle and then go to drive it later and it hard starts and feels and performs worse than ever. Telling them to "just drive for 30 minutes and then restart your car again and hopefully it goes away" doesn't make people happy or confident in your fix, nor does it make diagnosing issues after replacing a suspected faulty module or sensor easier when it sounds and performs like trash for a long while afterwards.
Can't do the design bits, but there's full service manuals for any 1990s to early 2000s Landrover. Only NAS models, unfortunately, so for some things in UK/EU you need to interpolate a little.
Notice the complete absence of phone-home GSM modems or other tracking stuff?
You have the full right to view and ask for deletion.
Can you skirt the GDPR by making it hard to discover who you need to ask?