Hacker News Reader

Comment by farisjarrah | Hacker News Reader

Let me just say this:

If you need to log into your google account on a weird touch screen device(looking at you, Honda's android auto implementation), do NOT have a super long random string password with a bunch of special characters in it. It will make your life hell whenever you have to type it. Its much easier to type in 8 words separated by dashes on a touch screen.

View on HN

Yeah, no, not doing that unless I get to security audit their code end-to-end. Have you seen the stories of auto APIs being completely unsecured, or just flat broken?

No password, no.

You are paranoid. Do you inspect every plane you board? Every car you ride in? Every room you sleep in?

The planes or cars most people ride in don't ask those details to be fair.

No, but I have read stories of auto APIs that are as broken as "change the user ID at the end of the request string, and you can see the entire account details of any other registered user".

That sort of incompetence makes me pause and think.

"I've read stories that people are able to take things out of cars if they're left unlocked."

Okay, got it...

False equivalency: When the manufacturer fails to secure PII, plus location history, plus control points of the car's internals, etc etc... that's far worse, more obscured, and much more in need of public disclosure than "door's unlocked, free contents!"

It's neither far worse, nor more in need of public disclosure, at all, because it's the exact same, consequentially. Literally, even! In order to take advantage of your "exposed" PII, the adversary needs physical access to your car.

Nothing false, it's actually equivalent.

you can create “app specific” passwords for situations like this

https://support.google.com/accounts/answer/185833?hl=en

It's designed for devices which cannot do Google's 2FA, not for normal use.

Like hell I'd type my Gmail password into some presumably highly insecure software like a car audio system.

Yeah, this would be weird. Doesn't Android Auto just use the account that's already logged in on your phone?

Android Auto is essentially just using your car's screen as a remote display. I don't believe any of the real processing actually happens on your car's head unit. Your data doesn't get shared with the head unit at all.

> Your data doesn't get shared with the head unit at all.

As it should be.

It's not hard to get KeepassXC to generate a medium-length alphanumeric password, which is IMO easier to tap-type than a passphrase, and it also has a passphrase generator.

Needing to link your car to your Google account already sounds like living in hell. ;)

I was actually trying to hack the head unit and it made my life easier by being able to log into google drive on the onboard browser and download some files.

Yes..These Google devices scares shit out of me.. to be honest.

Reply on news.ycombinator.com