It’s Official: Cars Are the Worst Category We Have Ever Reviewed for Privacy | Hacker News Reader

It’s Official: Cars Are the Worst Category We Have Ever Reviewed for Privacy

foundation.mozilla.org

164 pointsrobin_reala27 comments

Mercedes also had the brilliant idea of sending me updates to their user agreements, around once every 2-3 months. It is 40 pages, and they didn't include a changelog. Yeah, there is nothing I'd like to do more with my expensive car than to read a 40 page legal document every quarter to see if I can, morally, still drive it.

I replied to one, and they actually started stating the changes a few months later. I was probably not the only one thinking "perhaps you should think this one through just a tad more."

That would be one of the uses AI could excel at: reading license agreements, contracts, etc, to find changes and hidden traps in general then report them to the user.

Couldn't a business exist now that just had a lawyer read the agreements? There's no reason why we need to wait for "AI" to do this, so I would assume either the business idea isn't there or there are no incentives to do so.

Those prepaid legal services should suffice. You know, like Rocket Lawyer or Legal Shield, you pay $30 a month to have a lawyer allegedly on hand.

They will review N pages of legal documents included in the base fee. So you should be able to shovel over your most important EULAs and contracts for them to check out. They may not be able to tell you anything useful, though, since the lawyer who fields the call usually has no idea who you are, just has passed the bar in your state.

They likely don't change a lot, so the AI called diff would suffice

And provides a much stronger guarantee of correctness.

We don’t need technology, this is entirely a legal problem.

A few interesting notes:

> Tesla is only the second product we have ever reviewed to receive all of our privacy “dings.” (The first was an AI chatbot we reviewed earlier this year.)

“if you no longer wish for us to collect vehicle data or any other data from your Tesla vehicle, please contact us to deactivate connectivity. Please note, certain advanced features such as over-the-air updates, remote services, and interactivity with mobile applications and in-car features such as location search, Internet radio, voice commands, and web browser functionality rely on such connectivity. If you choose to opt out of vehicle data collection (with the exception of in-car Data Sharing preferences), we will not be able to know or notify you of issues applicable to your vehicle in real time. This may result in your vehicle suffering from reduced functionality, serious damage, or inoperability.

> Nissan earned its second-to-last spot for collecting some of the creepiest categories of data we have ever seen. It’s worth reading the review in full, but you should know it includes your “sexual activity.” Not to be out done, Kia also mentions they can collect information about your “sex life” in their privacy policy. Oh, and six car companies say they can collect your “genetic information” or “genetic characteristics.”

> Hyundai ... says they will comply with “lawful requests, whether formal or informal.” [from government]

Most of those car brands can disable the sim module at special request, it usually costs to do so and is a physical hw disable.

Speaking to a friend who works at a dealership this is usually most seen in cars spec'd for celebs and politicians.

This doesn’t surprise me at all. The whole car infotainment industry is so far behind the curve, and updating to respond to legislation just doesn’t seem to be a thing.

No, car infotainment is pretty much on the curve. At least as far as data collection goes.

> All but two of the 25 car brands we reviewed earned our “ding” for data control, meaning only two car brands, Renault and Dacia (which are owned by the same parent company) say that all drivers have the right to have their personal data deleted. We would like to think this deviation is one car company taking a stand for drivers’ privacy. It’s probably no coincidence though that these cars are only available in Europe -- which is protected by the robust General Data Protection Regulation (GDPR) privacy law.

I think legislations does cover these(at least to some extent), but the industry chose to play ignorant.

No idea if Mozilla checked the US or EU. But even in the EU car makers seem to collect, and use, excesive amounts of data. There is some EU legislation in the works so right now. Which is good.

I do not have issues with collecting data for crash investigation and such. And that your on board gps is collecting GPS data is somewhat normal. What I do not see any justification for is:

- sharing said data with manufacturers, instead of just saving it locally

- collecting data from phones or even passangers

- allowing manufacturers to analyse, use and sell sid data

- allow Apple and Google access to OBD data (that's why I just use bluetooth to stream music, but eho knows...)

- why a car has to be connected to the cloud to begin with

- why the infotainment system has access at all to OBD data (exception: data used for navigation, and that should only be used when needed and then deleted by the GPS)

Well, if I leave my phone at home, my car from 1982 seems to be save so. Now if I could just afford to use it as a daily... Well, no, too uncomfortable. But still. Anyway, time to remove the SIM that came with our latest used car bought directly from an official brand dealership. Assuming it is the only one, which it most likely isn't since the car has an emergency button, the deffinetly needs some for of connection I cannot control.

So, how would one go about checking whether a car can collect information about you or not? I'm not talking about the company policy, but of the actual parts inside the car.

Looks like the answer is yes. Unless it has no data connection.

"The gist is: they can collect super intimate information about you -- from your medical information, your genetic information, to your “sex life” (seriously), to how fast you drive, where you drive, and what songs you play in your car -- in huge quantities. They then use it to invent more data about you through “inferences” about things like your intelligence, abilities, and interests."

Told you... your sex life is corporation-collected data.

And here I am with an old car and my first thought: Car? Privacy? What?

The dealer has our number because they service it. That's it.

IIRC Bruce Schneier, years ago, tried to find a car that respected privacy for personal use, and gave up. It wasn't a report, just an offhand comment.

Why would you expect the car companies to not collect as much as possible? They see everyone else getting away with it.

> Why would you expect the car companies to not collect as much as possible?

Because it is not theirs

I am not clear as to the context. I assume this relates to cars with embedded sims. Or does any of this relate to Android Auto or Carplay? In fact do either of those allow the car to originate "call home" messages?

Worse than smartphones?

The article claims "more than even smart devices in our homes or the cell phones we take wherever we go", but doesn't elaborate on or substantiate the claim.

I think so, yeah. Smartphones have been in the crosshairs of privacy advocates for years. They gather and send information, but successful lobbying has limited what information gets sold. (note that governments hacking phones or requesting data from isp's is a second thing altogether)

Car manufacturers basically just don't give a peep, and just gather every single morsel of info they can get their hands on, and preferably sell that information to anyone interested.

> All 25 car brands we researched earned our *Privacy Not Included warning label -- making cars the official worst category of products for privacy that we have ever reviewed.

So it's "worse than smartphones" in the sense that for smartphones, at least there are options that are privacy-friendly.

Around 1 in 4500 cars newly registered each year in the US are homebuilt or kit cars (which are obviously privacy-preserving).

I tried to find the equivalent market share for privacy-friendly smartphones (and am undoubtedly not up on the latest trends there) to see if it was more or less than 0.02% of the market.

It looks like fairphone sells around 120K devices per year globally (out of around 1.4B total smartphone units). I realize that's not the only brand in the space.

Sorry, I meant "options" as in "among the brands that were reviewed".

(As an aside, the Fairphone by default comes with stock Android. It's primarily more privacy friendly in the sense that it is actively OK with running e.g. /e/OS on it as well.)

It's totally possible to shut down your smartphone, set it in a drawer, and go out somewhere, like a protest or a courthouse or something, where you don't need a smartphone and it isn't tracking you.

You may find it more challenging to leave your car at home while you go someplace like that. Sure, take Uber or public transit; that's all tracked too.

Only solution, drive an old car. But companies are still going to be tracking your license plate at every turn.

Reply on news.ycombinator.com