Hacker News Reader

Comment by tsatsawayy | Hacker News Reader

Most cars do not do this. Teslas are famous for their DRM, restrictive connectivity, and shady upsells. Those will show up in the "cons" column of any honest review.

A normal car in 2022 will not constantly surveil you. No critical functionality is tied to an online account in any non-Tesla mass-produced car that I am aware of.

View on HN

Neither of these points are true. Other manufacturers like Toyota are getting into the "features as a service" game with things like keyless entry.

On the surveillance point, I worked for an auto software company that partnered with a big auto manufacturer on a feature. We were granted access to an API that could geolocate any vehicle made by this company in real-time given its VIN. I volunteered my car's VIN to test with (I drove the same make as the company we partnered with) and confirmed that the API returned real-time location data on my 2019 vehicle. If you own a car that was built in the last 10 years, you are more than likely emitting your location to an internal service maintained by the manufacturer.

That is amazing since VIN's are often visible from the outside. This is just so open to abuse, especially if it was a casual to lookup as you make it seem (no verification that you were the owner and for just a lark). We as engineers need to establish a code of ethics. Seriously, every profession needs to have a "do no harm" clause because clearly companies have zero ethics.

To be clear, we signed a contract that explicitly prevented this API to be used for anything other than our particular commercial use case and access to production creds to this service was heavily restricted. I never once saw the service being abused, but you're absolutely right. The question I kept asking myself was: who is out there using this service against the vendor's TOS for whatever reason? This industry was largely built and shaped by people that didn't care at all about the rules, and the longer I work in this field, the more cynical I become about the effectiveness of just adding more rules. It feels like a pinky promise at this point.

This is true, for example:

https://www.toyota.com/privacyvts/

You do have the ability to opt-out, but it's not usually a simple process.

The supposed ability to opt out. How do you know Toyota truly removes that capability?

Reply on news.ycombinator.com