Hacker News Reader

Comment by rsynnott | Hacker News Reader

Why are these things uploading videos at all? And, particularly, why are they uploading videos _when not in use_?! And, if they must upload videos, why are employees able to access them without good reason? This whole thing just seems like a tower of terrible choices.

View on HN

> seems like a tower of terrible choices

The first terrible choice is someone choosing to purchase a surveillance device that isn't under their control.

This is the answer. People buy a product that's known to surveil them, then get upset when it's misused.

Of course it's misused, there are humans involved.

That's gonna be anything with self-driving since that by law they have to check if your eyes are on the road.

To be clear, I am also very uncomfortable with the idea of being monitored by my own car, but I think that's how it's gonna become normalized.

It would be a terrible shame if some black tape were to inexplicably find its way over any cameras pointed in the cabin.

So that vehicle owners can see who the hit and runner is. And just in general look how their car is, all from the comfort of their phone in real time.

That makes sense but why should employees have easy access to it?

Yeah there should definitely be a better governance structure preventing employee access without a structural justification like a law enforcement request, customer service request, etc.

As an owner of a model Y, I’m beyond pissed off they’re so lackadaisical with this stuff, to the point where I may just buy a different car.

It should be encrypted and the owner of the vehicle should be in control of the keys.

That works right up until the user loses the key and demand access anyways. Or they sell the car and keep a copy of the key.

Updating a car with a new key would fix both problems. Old recordings would be lost, of course, but customers hearing "I can't unlock that without your old key" may be necessary to re-establish trust.

Absolutely and that is why you can't use an HSM. Thankfully generating keys on device and storing them on the cloud account encrypted by a passcode works. As the keys are a predictable size you can encrypt them multiple times with different passcodes.

You can decouple the encryption and decryption keys such that the private key would never be present in any Tesla system at any point in time[1]. And you can introduce a ratchet such that compromising the Tesla car at time t0 would not enable the attacker to decrypt any encrypted data at t[n < 0].

[1] Asymmetric crypto KEM + ephemeral symmetric key + encrypted block. eg. <https://libsodium.gitbook.io/doc/public-key_cryptography/sea...>

Or just disable the data sharing option in the UI?

If you trust that button is actually wired up to anything, then you put way more faith in people than I believe is warranted.

> to the point where I may just buy a different car.

I love this line of rhetoric. Seriously, I doubt that you will. If you consider all of the shenanigans that Tesla is known to do, you shouldn't have bought the car if you're concerned about privacy. Any car that has cameras on the car that looks at the interior of the car should not have been purchased in the first place. OF COURSE they will be looking at video when they shouldn't be. Has there ever been an example of a company that hasn't? Ring has done it. Roomba has done it. Open it to any data not just camera, and people like Uber have used that data for nefarious purposes.

Any device that sends back data to the home office is just too ripe for misuse. Then, when it comes out in examples like this that it has occured, there is 0 liability for the company involved. Maybe the company makes an example out of the employees in various ways up to dismissal, but the company just shrugs it off.

If it's not one of your core goals from the very start of your design, it's pretty hard to build a system where employees can't access data. Obviously you can do it, but it's not trivial and it's doubly not trivial to add after the fact.

They obviously shouldn’t.

> So that vehicle owners can see who the hit and runner is.

Arguably that benefits their insurance company more than it does them.

For making sure liability is properly ascribed, I solved that problem by installing cameras that write to a MicroSD card that's under my physical control.

You can save it only locally in a Tesla too. You have to opt-in to sharing the video.

Insurance may benefit more, but I’m still quite interested in avoiding paying the deductible.

Yeah, unless the hit and run is performed by an excavator or something, that use case doesn't really require automatic uploading.

A hit and run is detectable by accelerometer, and a half-dozen other sensors on the Tesla. There is no need to upload video unless an event like that is detected, and that scenario should be opt-in.

On the other hand, someone keying your car is a lot harder to detect.

Yeah, not sure what that guy is talking about. Sentry mode (aka cam on while away, and detected using accelerometer and visual cues like you said) doesn't upload footage.

AFAIK, the footage upload was a data sharing toggle, and the videos were supposed to be used as training data for FSD. Why garage videos, or any videos with the car not in motion are being uploaded is a big question.

Wodenokoto has it.

A friend was able to use the video to track a parking lot hit-and-run while his car was parked at his wife’s workplace.

Bit, there really should be an easy switch to turn off recording while the car is parked. Maybe even geo-fenced -record in public, but don’t at your home.

Or only store recordings locally or only store uploaded videos E2E encrypted. There are lots of ways to preserve owner privacy (not necessarily subject privacy) while preventing employee abuse.

> Or only store recordings locally

That's already the case for what he's talking about.

Owners manual for that: https://www.tesla.com/ownersmanual/model3/en_us/GUID-F311BBC...

I tracked down a hit and run versus my Tesla with the videos on the in-cabin USB stick. My phone alerted me that the alarm went off. I went out to my car, saw the damage, grabbed the USB stick, and sent the video to my employer so they could find the coworker that did it and have them reach out to me.

Tesla also does let you do geofencing with Sentry mode, but I opted to have it running at work and off at home.

But none of this addresses the violation of trust that comes with a company having shitty internal controls and shitty auditing on users' data. The US desperately needs a law that makes it clear that user data is owned by users and our rights can't be waived away.

But none of this addresses the violation of trust that comes with a company having shitty internal controls and shitty auditing on users' data.

Absolutely agree.

Probably valuable training data

their useless AI has to be trained on something

Reply on news.ycombinator.com