How to escape Honda's privacy hell | Hacker News Reader

How to escape Honda's privacy hell

sherwood.news

123 pointsdanso149 comments

Hate this. I'm presently torn between the desire to get an EV and dreading the inevitable tech quagmire I'll be wading into as a result. My car is 23 years old but will hopefully last long enough that the pendulum swings back towards simplicity and accessibility, even if that costs more money.

I forgot, I asked for this already, no luck so far: https://techcrunch.com/2022/01/29/please-make-a-dumb-car/

I would LOVE to have an EV that’s a “dumb car”. I have no interest on my car providing me all of the extra bells and whistles that I already get from my phone.

What kills me too is the giant screen with smart features on these cars is extremely unreliable. The GPS/LTE frequently disconnects. The apps randomly crash or are very slow. I’d much rather just use my phone with Bluetooth for any of these features.

I bought an WV eUP! (2014) this winter and it is basically a "regular" car with normal physical buttons + a small Garmin GPS.

It's nothing like new cars, electric or not, with big screens and almost no buttons, and a bunch of privacy violating sensors and telemetry tech built in. It does have a 2G GSM and a GPS antenna, but the 2G network is soon turned off here in Norway.

And it's hacakble! You can buy an open source replacement for the remote control of charging and climate control! I love this car and I'm not tempted at all by Tesla and the like, they are a privacy nightmare.

I have one too, nice little car.

Unfortunately Volkswagen stopped making them, and the new ID line embodies many negatives of new cars.

Any details about the open source replacement for controls?

They stopped production, but due to popular demand, they have started it back up! [1]

The open source remote control system is called OVMS [2]. I have not got around to order and install it yet, but my ambition is to get it done this summer. They have detailed instructions on their site [3].

[1] https://insideevs.com/news/568463/volkswagen-eup-available-o...

[2] https://www.openvehicles.com/

[3] https://docs.openvehicles.com/en/latest/components/vehicle_v...

I'd be happy with a single 3.5mm jack and a volume knob.

For all the fancy aspects of CarPlay or whatever the Android version is, what most people really want is a phone mount that charges and can play music.

CarPlay is miles better than most any in-car "infotainment" crap, but all of it is basically not needed.

I dunno, plugging my phone in and having it automatically pop up a suggested route for getting home, that avoids the traffic jam on the freeway I was unwittingly planning on taking, is pretty sweet.

no, what I want from my car display is Google Maps. Music control is a bonus, but my CD player works fine. My very old OEM maps with no traffic insights are the only thing that pain me when I get into my older car after driving a newer one.

I don't want a phone mount, where my phone can fall off. I don't want the rest of the apps available, either. I don't need a DuoLingo practice reminder while I'm driving, get it?

I just want a “big buttons” mode on my phone with the 4 apps that I might need while driving taking up the whole screen.

There might be something in Accessibility that could work; unfortunately phones are so strongly built around "one user" that it would be hard to turn on and off.

I liked Android Auto for this

Is there a consumer advocacy group or the like that could please formalize and oversee a "Dumb" certification? I would love to buy a certified Dumb TV.

If you like the styling of an older car there are plenty of conversion kits for a variety of torque/kilowatt outputs, sans batteries. Ford already sells factory kits, wiring harness and all. The downside is you're taking care of the fragile minutia of an older car, such as combating shock tower mount rust or the plastic gearing of the window mechanism. I'd still happily put up with 3D printing or machining a small, broken, long out of stock part than put up with all the forced technological integration of modern market EVs, though.

Do you think the retrofit gas-to-EV conversions will help, as options there expand and improve?

>but will hopefully last long enough that the pendulum swings back towards simplicity and accessibility

I'm not at all convinced that the pendulum exists. I think we fell down a greasy slope.

I guess there’s ever a huge market for any sort of aftermarket thing, but a mid 90’s small truck with an electric mod and a raspberry pi powered Linux touchscreen for the entertainment system would be much more interesting to me than any vehicle currently being sold.

There are people making conversions - but the prices are high enough that either you need to do most of it yourself, or you just buy a modern EV - https://www.youtube.com/watch?v=oGyHM_5q31U

They can range from as simple as a Tesla with a different body to as complex as combining batteries and motors from various donors with custom controllers, etc.

it is ironic that while mechanically EVs are much simpler, they are only shipped with all the complexity from electronic side.

i am not an automobile engg, but the core parts required to run an EV (motor control, battery management, etc.) has to be comparable to the ECU that are in decades-old Hondas and Toyotas.

2016 hyundai ioniq here. (subjectively the best car ever.) Hopefully I got it just before "connected cars" were mainstream. Hopefully that changes someday :(

The Chevy Bolt is about as dumb as you're going to find. Manual controls for most HVAC and radio functions. AUX-in jack. Used models are cheap.

Don't buy GM and expect privacy.[1]

[1] https://www.nytimes.com/2024/04/23/technology/general-motors...

Used ones are back down to about $16k. Over 6 years that's around $10/day for wheels.

Disclosure: I work for an automaker, not on this kind of thing.

===

When I was growing up, one particular political party continuously made hay from the idea of "big government" overreach, and how regulations should be removed and watered down, almost no matter what. Any regulation was seen as a bad thing.

This never made sense to me, as ANY large organization has the potential exercise excessive power. "Competition" is somehow supposed to magically address this, but that doesn't really make any sense either, as if something gives a competitive advantage, then there's no real choice in the matter, as all companies will be pushed in that direction.

It's almost like balancing rights between different people and organizations is actually hard, and there's no single cute slogan that covers every scenario.

Anyway, it seems like concern about privacy is finally coming to everyone's attention.

Didn't we recently see an article talking about how Google was encouraged by the federal government because the federal government saw an opportunity for surveillance? The federal government is not interested in protecting privacy. We shouldn't trust them when they say they are.

"The federal government" does not do these things in a vacuum - they are influenced by voters. Re-aligning incentives can be a pretty intense activity (it is also a euphemism used by intelligence agencies).

From a very high level view, "the federal government" is concerned about type 2 errors - not having enough information to prevent 'bad things' from happening.

If enough people become concerned enough about the type 1 errors that come from this overreach, then political pressure will be exerted to re-align incentives.

===

https://en.wikipedia.org/wiki/Type_I_and_type_II_errors

> A type II error, or a false negative, is the failure to reject a null hypothesis that is actually false. For example: a guilty person may be not convicted.

That assumes the issues matter more to them than any of the hot-button political stuff they actually campaign around. Abortion, Gun control, etc.

Governments uses corporations to get around their constitution. These private entities in turn use the government to get around regulation. They work very closely together to achieve their goals.

FYI: The telemetry radio is branded as HondaLink[1]. Most vehicles of recent years have it. Here's how to tell if your model has it:

https://mygarage.honda.com/s/hondalink-product-compatibility

HondaLink may be nerfed for some 2018 - 2022 models, due to the decommissioning of 3G in the US, if you never update the firmware:

https://mygarage.honda.com/s/article/HondaLink-Over-the-Air-...

1. https://mygarage.honda.com/s/hondalink-marketing

Last year I bought the cheapest model Honda Civic, and as far as I can tell it doesn't have any wireless connectivity. Am I wrong about that?

I've read through the manual, and it doesn't seem to have the data sharing setting as shown in the article.

[Edit:] I checked https://mygarage.honda.com/s/hondalink-product-compatibility per another commenter https://news.ycombinator.com/item?id=40277402 and it says that "Link" is not available for my model. (It's available for the higher priced Touring model.)

I wonder if there is enough market demand for dumb and basic products that follow the Unix philosophy of doing one thing well. This may just be nostalgia talking, but I miss pre-iPhone technology.

A TV with no connectivity features, a car UI with actual buttons and knobs, a phone with one-handed usability, laptops with ethernet ports, home appliances without Wi-Fi.

Yes, I'm in the minority or maybe I'm just getting old.

All of these things exist, but they're designed for the commercial market and are usually MUCH more expensive than the consumer products.

For the car, check out any commercial rental truck, even today those will have very basic setups. Why? Because the people buying it aren't the people driving it, so they ONLY care about the legal minimums and what they need for the workers to get their jobs done.

There is a market but not enough profit in serving it, unfortunately. Maybe if more people were aware/cared there could be. There are car companies now bragging about retaining physical controls so there might be hope longer term. Sadly most people seem perfectly OK giving up their privacy. Maybe if more people get affected by things like higher or dropped insurance the word will get out and more importantly, start sinking in to people.

> There is a market but not enough profit in serving it, unfortunately.

There would be if they tried, perhaps?

> a phone with one-handed usability

How about a Pinephone with SXMo?

The irony of the Unix philosophy is that it's the antithesis of a computer. The entire point of a computer is to be a machine that can do anything if it's connected to the right hardware.

As computers are cheap and reliable now it's not surprising to me that we can make products that do more than one thing, and it's desirable to consumers.

The problem is when manufacturers start making these computers do things customers don't want and hiding it from them. And that's what regulation should support, since the market can't pick and choose which useful bits of an arbitrary machine are allowed to be used in a product when the manufacturer can reprogram it at will and never tells you what it does.

Unix philosophy: connect simple programs together to create more complex programs.

This reminds me of my oven, which apparently has no setting to turn off its broadcasting its own wifi ssid. So, forevermore, all our computer wifi menus will have [LG_Oven]xyz as an option, and our spectrum will be slightly more congested. At least their customer support didn’t know how to turn it off. I wouldn’t have considered it possible that an appliance maker would ship an appliance with no ability to turn off its wifi broadcast.

Don’t buy LG appliances.

I was able to get my LG oven to stop broadcasting it's network by downloading LG's app, temporarily connecting the oven to my phone's hotspot, then just renaming the hotspot SSID.

Now, my oven does not broadcast it's own WiFi, and instead will forever be trying to connect to a non-existent network.

lol nice, thanks for the tip! I had been reluctant to soil my phone with the app, but now I guess I have to.

Thanks for the heads up! We are in a market for a cook top and it has never occurred to me it was this bad. Are there people who want this "feature" and pay extra for it?

I'm convinced almost nobody actually wants most of the connectivity, internet of shit things they're stuffing in appliances. But these companies shove this shit in because it makes them more money, then they brand it a "feature" that salespeople can use to differentiate the more expensive and newer models to unsuspecting customers. Basically that its more about there being a "new age connectivity extensibility productivity luxury feature" than exactly what that feature _is_.

Then, the manufacturers who have switched to building mostly iot crammed models trick themselves by attributing the change in sales to the specific feature they added (that nobody asked for, wants, or cares about) rather than the fact that that's all they make anymore and thus the only thing people can buy. And some VP makes a sideshow with graphs, gets applause, a nice Bonus and shot at the big wigs job. Some middle manager gets to take credit for "spearheading the development of market fit innovations in productivity and life balance synergy". People keep patting themselves on the back for making up useless bullshit and shoving it down our throats, then interpret their back pats as a signal to continue.

That's my theory anyway

Sounds about right, only a couple of their most basic models were available without it, and we really wanted induction with physical knobs, which is apparently a rare combination. So we had to give in on our no-wifi constraint.

There's no way to disable the wifi on my LG smart TV either (any guides I've seen seem to point to a setting I don't have) although I've been meaning to pop the back panel and just yank the module which is on a card. The oven probably is more likely to have separate wifi card than my TV.

Good to know. I bought a new dishwasher recently and all the mid-high end ones have WiFi and I wondered if it would do this. Fortunately not (it's a Bosch).

Also I was initially like "pff who needs WiFi in a dishwasher" but one neat feature is that there's a customisable button and you can program it with new programmes. (Yes I'm writing that.)

I mean, it already has plenty so I haven't bothered to actually use that feature, but it is something I didn't initially think of at least. Better diagnostics would also be a good use but I'm not putting money on them having implemented that (I guess we'll find out if/when it goes wrong).

This isn't a neat enough feature to justify ramming it down the throat of consumers.

We want RELIABLE, FUNCTIONAL, DURABLE appliances. Any additional SMART integrations are overkill and there should be a base model without them. Let the people who want them pay for them.

What would turn this on its head? Requiring manufacturers to pay a subscription fee to people they collect data from, for the lifetime of the data feed.

What else would(do) you program into a dishwasher?

Mine has like 6 buttons. Hot/Cold, Air Dry or heat dry, longer wash or shorter wash, and I think a start timer function that I can click a few times to add number of hours until it goes.

There was an interesting article at the Mozilla Foundation 9 months ago on this very topic.

https://foundation.mozilla.org/en/privacynotincluded/honda/

We need to stop trying to “fix industries” and put the privacy protection into a human rights framework with a privacy bill of rights.

Like the GDPR. I wonder what the car does in Europe.

Indeed like the GDPR but I think less like what the GDPR has become and more like what it was based on.

The original idea was the quote, “Everyone has the right to respect for his private and family life, his home and his correspondence.” It came from the European Human Rights commission, and that’s what we need.

I grow concerned that the GDPR has become too focused on implementation details these days and isn’t as effective as it should be.

But it’s incredibly important that we have a piece of legislation like this in a post-AGI world, or everything we love about Western Civilization will be measurable and therefore modifiable by AI.

Until there's adequate regulation to prevent this, someone really needs to setup a database with technical info about the telematics units in different cars, with instructions about how to physically disable them (and maybe products to make doing so easier).

Some ideas:

* Some kind of wiring harness or device that allows the telematics unit to be disconnected completely without affecting other car functions (e.g. I've read sometimes the in-car microphone routes through them, so disabling it can cause hands-free calling to not work).

* A fake CANbus that lies to the telematics unit, which it will then pass on fake data to the data brokers (e.g. you are driving 25mph all the time, every time, and gently coming to a stop every 5 minutes).

* A mod to replace the cell-network antenna with a dummy load (https://en.wikipedia.org/wiki/Dummy_load).

Not only Honda. All new cars to this and sell you data to insurance companies. All new KIA and Hyundais have no option to turn off telemetry. I asked the dealer, they said it can't be done. Don't like it?

Is that mostly an American thing? Did the EU somehow manage to protect it's citizens?

Well, the EU even went a step further! [0]

Quote from there:

>Also, the occupants of the car have no control over the remote activation of the microphone, making a car susceptible to eavesdropping.

[0] https://en.wikipedia.org/wiki/ECall

That's fair though that seems to be an implementation detail and not the intended use.

E.g. if the system would actually only activate and transmit when let's say the airbag inflated that'd seem like a good thing in general.

Would there still be ways to exploit it, maybe but it's not the same as what was described in the article

Asian car makers are a bit special. Both privacy and cybesercurity is at 1995 levels. KIA, Toyota, Honda and Hyundai are worst in class in every aspect.

With that said, I'm pretty sure this thing is not allowed in EU or at the very least will be too expensive to operate in Europe.

Good news! Cars with telemetry are already mandatory in the EU since 2018! :)

[0] https://en.wikipedia.org/wiki/ECall

Of course it can be done. Somewhere there is an LTE modem that can be physically disabled.

I'd half expect the infotainment system to just refuse to work at all if this was done in a simple way (like damaging or removing the modem). Then no stereo at all or Apple CarPlay or Android Auto. I suspect the "right" way to do this would be to ground the LTE antenna or faraday cage it or something like that.

I'd expect cars to still work in remote areas or underground parking garages where there isn't any cell service, and this would simulate that.

Since I don't see the normal reply to this completely predictable "you can just disable the hardware," I'll drop a TL;DR version of it:

No you can't, not without voiding your warranty.

And since I don't see the normal reply to this completely predictable "that'll void your warranty," I'll drop a TL;DR version of it:

IANAL, but I'm pretty sure the https://en.wikipedia.org/wiki/Magnuson%E2%80%93Moss_Warranty... says you can only void a warranty if the modification caused the problem. So no.

Some Honda models have cellular modems but many don't. I have a 2019 Ridgeline that does not. My data uplinks to Honda only via a bluetooth connection to my phone or WiFi (both of which I disabled).

As of 2020, the Insight Touring, Accord Touring, Pilot Touring and up, Passport Touring and up, and Odyssey Touring and up were the only Honda models that come with a cellular modem. Newer models do have cellular modems, but it may be possible to disable these simply by unplugging the modem from the ODB-II port. (Or by wrapping the modem in a RF-blocking material).

This is not only in the car, but also in the 'Smart' TV market (I am also starting to see it it large appliances, washers, dryers, refrigerators, air conditioners, swimming pool systems). It is is hard to find non-smart TV and they are at premium. 'Smart' TVs, if connected will collect large amount of data. I hear some will piggyback on open connectivity without permission, but I still need to verify this.

(I ran across a pool system that could not be managed without an mobile app, from the pool. That is, the default configuration to turn on jets, lights, and such, a mobile phone had to be nearby to control the functions which required internet connection.)

> “Pretty much everything,” said Misha Rykov, a research associate at the Mozilla Foundation, who worked on the car-privacy report. “Sex-life data, biometric data, demographic, race, sexual orientation, gender — everything.”

How are they collecting this data?

There's a dark mirror industry in the US that curates this info and sells it widely.

I stumbled across a rare sign of it when pulling up the history of a house I sold more than 20 years ago. It listed all prior owners WITH current residential address AND current cell phone numbers. In this case, the source of the info is a company called _Nuwber_.

https://internetprivacy.com/what-is-nuwber-information/

Understood, but the article is saying that the car can tell these things. Of course someone can tell - presumably Visa could do it. I'm wondering why cars in particular, and how they could do it.

In the context of that sentence, the article says car companies collect that information. Here's the sentence in context:

> Companies are quick to flaunt their privacy policies, but those amount to pages upon pages of legalese that leave even professionals stumped about what exactly car companies collect and where that information might go.

> So what can they collect?

Agreed, but "collect" implies "from the user", rather than "buy user data from aggregators".

It's probably used that way in a lot of software privacy policies, because a lot of software directly collects information, but the word 'collect' itself doesn't imply any origin.

I think it does imply an origin in this context. If I said "Apple collects your location data" and it turns out they were buying it from a data broker, and not, well, collecting it from their devices, I would feel misled.

That might be a presumption in your head, based on the mechanisms you presume are in place, but that meaning is not actually contained in the words of that sentence. The word "collect" alone is ambiguous as to whether it is direct or indirect.

And if you read other privacy policies, outside of the tech industry, it is normal to use the word 'collect' for information gathered from various sources. (e.g. insurance privacy policies)

Some of that is in Nissan's privacy policy

> https://foundation.mozilla.org/en/privacynotincluded/nissan/

The privacy policy reads like it is inclusive of all of their services, so I'm going to presume it's from ad tech or data broker type services that try to determine this information from correlated patterns. It might not be derived entirely from their cars.

> It might not be derived entirely from their cars

I'm struggling to see how any of it could be derived from cars.

One could derive a lot of it from GPS or message data alone. But the list sounds a lot like what you might get from a data broker, so I'm presuming that's where its actually coming from.

But to directly answer your question, imagine you're data mining a car's infotainment and come across the following queries... you may be able to infer some things from these entries:

"fertility clinic", "gay bar", "gentleman's club", "synagogue", "bankruptcy lawyer", "mobile home sales", etc.

Sensors in the car + normal traffic pattern analysis based on where you go. The sensors in the car have been capable of identifying a person by their fingerprint for a long time, and I have to imagine that has only improved.

I remember a discussion about using these identity fingerprints to automatically adjust settings to the person sitting in a seat, but it was deemed too creepy at the time.

> The sensors in the car have been capable of identifying a person by their fingerprint ...

That sounds creepy as all hell, but it seems like it's definitely real. :(

• https://www.hyundai.news/eu/articles/press-releases/hyundai-...

• https://www.electronicdesign.com/markets/automotive/article/...

> Sensors in the car + normal traffic pattern analysis based on where you go

That seems quite different to what they're claiming in the article, though? Presumably many services (e.g. Google Maps) could have the same accusation levelled at them, and far more, because people don't use cars to go everywhere.

> The sensors in the car have been capable of identifying a person by their fingerprint for a long time, and I have to imagine that has only improved

Do you mean if I get in a random car it can tell who I am, or if I get in the car it knows it's seen those fingerprints before and they're allowed to drive the car?

> Do you mean if I get in a random car it can tell who I am, or if I get in the car it knows it's seen those fingerprints before and they're allowed to drive the car?

Personalization for the driver(s). Other cars do it by having the settings tied to the key fob, or just by putting numbered buttons on the door.

Business idea: independent auto shop that specializes in knocking out telemetry

Until that's up an running, even an iFixit guide on how to disable that crap (physically) would probably do. :)

Tesla's policy is pretty solid.

We’ll Never Share Tesla never sells or rents your data to third-party companies. This includes your personal data and driving history. We only share information about you, your products or how you use them with your approval.

While we periodically review anonymous data from our global fleet, this data is not linked to you or your vehicle. VIN-associated data is only collected for remote diagnostics, for service or during a critical safety event.

https://www.tesla.com/privacy

I like tesla, but tesla is not your friend in this respect.

Just look back to the data tesla disclosed about its customers when they disagreed with them.

In the model x accident on 101 in mountain view caliornia, they disclosed in a vague way that the customer had ignored the car's warnings before the accident.

so... the critical safety event... they disclosed publicly through the press.

Plus them watching people through their cameras.

https://news.ycombinator.com/item?id=39067178

"Pretty solid" would be "we only collect data from those who have opted in". They sell super expensive cars but pay zero for collecting the data.

Who is paying for all that cellular traffic? The car company? The customer?

Car company. On lowspeed, low priority connections (basically idle airtime) that are very cheap. Car companies also by airtime in bulk.

If I'm ever (god forbid!) forced to buy a new car the first thing I will be doing is ripping out or physically destroying the built in cellular modem.

>If I'm ever (god forbid!) forced to buy a new car the first thing I will be doing is ripping out or physically destroying the built in cellular modem.

Which would be illegal in the EU if that car is made after 2018. [0]

[0] https://en.wikipedia.org/wiki/ECall

Laws are only as good as their enforcement. Are EU mechanics a bunch of snitches?

It depends on if they have a "tampering with safety equipment" style law that applies - many times safety features must be equipped when sold but there's not actually a law against disabling or removing.

But then you don't get over the air "updates". That would probably void your warranty.

Has anyone ever figured out exactly what Tesla sends when it phones home?

Data brokers and the customer, ultimately.

Okay I have a 2024 crv and have gone through this process. Ultimately landed on how is data getting back to Honda?

I don't have the app / never have had the app. Android auto only.

Is there an onboard modem with lte?

Yes, it is required by regulation established many years ago. There is dedicated spectrum for it, so that it doesn't overlap with existing networks. Both the automotive company and the government are entitled to that data. Many cars also use normal mobile spectrum because that is actually available everywhere and works. The explicit scope of use, beyond collecting operational data, is law enforcement and traffic control. Cars can take commands over-the-air via this data link.

This has been pushed by governments for 20+ years. Now that the technology has caught up, automotive OEMs are finding their own revenue-generating uses for this data.

Can you provide citation for a US federal requirement? I'm skeptical and not finding anything in a search.

Umm... I'm pretty sure cellular modems have not been _standard_ in all Hondas until about 2018, if in fact they are standard now. My 2019 Honda Ridgeline has only WiFi and bluetooth, not cellular, according to my Hondalink app.

The exceptions seem to be the "Elite" and "Touring" models of Hondas, which started using the Qualcomm Snapdragon 4G LTE cellular modem in 2018 as part of user-accessible telecom services that resemble Ford's OnStar.

https://www.prnewswire.com/news-releases/qualcomm-powers-adv...

It looks like the modem is part of the Telematics Control Unit ($500 to replace). The real question is, when did TCUs start sending personal driving data to Honda? And when did Honda start selling that and other personal data to other companies?

Yes

Surely, it's legal to remove the modem?

In the US, absolutely. The list of parts that are illegal to remove from a car is rather short here.

It may or may not cause the vehicle to stop functioning.

Better is to find the modem and isolate it.

I guess I'm safe from this invasion of privacy in my pre-2015 vehicle. The eff article[1] mentions that 18 car manufactures have a way to opt-out. Which auto makers are not on this list?

[1] https://www.eff.org/deeplinks/2024/03/how-figure-out-what-yo...

We have the new Honda CR-V. I switched off data sharing right away. Yes, there's this orange notification but to me it's not intrusive. I think it's good that turning this off is pretty easy.

All in all, it looks like the main issue is that there's this dark pattern afterwards. I can actually live with that. I just ignore that notification. Honda could do better though.

Volvo seems to allow turning data collection off completely, judging by their explanation on the topic [0]. The process seems easy enough.

[0] https://www.volvocars.com/en-ca/support/topic/d410111b3dffde...

Is "Volvo On Call services" everything, or just one of many components that track you?

Don't buy a Honda.

It's not just Honda. It's pretty much everyone.

https://foundation.mozilla.org/en/privacynotincluded/article...

It's pretty bad out there, for sure, but you gotta speak with your dollars to be heard.

How exactly does one speak with their dollars in this case? Per that report, there are zero good options. There's nothing to spend my dollars on.

Possibly Volvo.[1]

[1] https://news.ycombinator.com/item?id=40277797

Possibly. It's unfortunate that Mozilla didn't look at them.

Unfortunately, I can't commute by [analog] bicycle, but oh how I'd love to!

A pity, because they had some genuinely amazing vehicles that ran forever on basically no fuel. They've really fallen down a deep well -- behind on EV migration, ahead on telemetry collection. Enshittification, I think. Hopefully they'll pull figure it out

You can turn telemetry off. It's pretty easy. It's the first thing that pops on a screen.

You'll find other manufacturers worse in this respect.

Honda's current privacy policy is here:

https://www.honda.com/privacy/connected-product-privacy-noti...

This seems so easy, pull the 4g modem or its fuse? Or is it tied into the ECU so that our foreign adversaries now have the ability to brick our vehicles too?

If someone would publish such a guide for each make/model/year of car, that would be a HUGE public service. Even if it's not pulling fuses or removing cables/parts, just something like "set these settings to these values to disable sharing".

Strong agree. Or where to wrap in foil/faraday fabric: https://slnt.com/collections/d-i-y/products/multishield-fara...

This disables useful features like "call 911 if a collision occurs". If given a choice between safety and privacy, a lot of people will choose safety. We shouldn't have to make the trade off.

Thankfully this feature will increasingly ship with our phones/wearables. Both of which are capable of getting updates to how they talk to 911 (whatever your car does is how it'll talk to 911 the rest of its life, nobody is ever gonna update that). The most specific thing the car will know your phone/watch won't is airbag deployment status.

"call 911 if emergency occurs" is exactly how they justified getting all the data collection and transmission equipment in the first place.

You can call 911 without a SIM (I guess), so should the solution be to remove the SIM card?

On some cars they purposely tie this fuse to multiple things like the radio or Bluetooth so that you’re giving up useful features along with the bad ones.

Cars are so expensive that people have to take loans and pay interest to buy them - and on top of that, they also have to give up their data. This is a capitalistic dream coming true - squeeze everything you can from a consumer.

Cars are so cheap almost everyone has one.

This is foolish. Cars are not cheap. The reason everyone has one is because of how necessary they are for modern life if you don't live in a "walkable city." Having to take out a loan and make 5+ years of payments isn't "cheap."

They are cheap. 100 years ago it was cheaper to have a full time cleaner than have a car. Now it's the other way round, and with cars a million times better than the ones back then.

I'm not saying they're cheap compared to free. I'm saying they're cheap compared to what you get. 100 years of competition has made cars exceptional.

full time cleaners aren't cheap either

Buy a European car then. The GDPR exists to protect people from this.

Also, I think the article leaves out why companies want your data. Which is because they really want to find out what people are doing with their cars. The car industry is highly competitive and cars are expensive to develop and you actually want to make the car people want. In the EU this requires things like anonymizing user data and needing opt in consent for data transfer (companies will honor the GDPR if at all possible to avoid major legal problems).

I'd like to believe that, but US branches of car Non-US companies don't necessary adopt the same policy as the parent company. If Honda USA believes there's money to be made in abusing its customers, I'm confident they'll do it.

We saw this clear as day when Nissan USA denied all responsibility for installing unsafe steering wheel air bag igniters after NTSA demanded their recall. Nissan USA continued to stall for months, first saying that the igniters were NOT faulty, then claiming the responsibility lay only with the subcontractor who made the igniter -- and refusing to announce a recall.

These acts of unresponsibility were likely decided by lawyers only in the US branch of Nissan, since NTSA regulates Nissan only in the US. (This is largely why I bought a Honda rather than a Nissan afterward, since Honda's response to the airbag igniter fiasco was exemplary in contrast.)

Which European car? Nearly every one sold in the US has a "US Version" that has to go through DOT rules to be sold here, or even imported if under 25 years old. Otherwise I'd be rolling around in a new VW California.

> Buy a European car then ...

Someone mentioned recently that in the EU all new cars are mandated (or will soon be?) to have this data connection present for emergency purposes. :(

Sure, basically any new car made will phone home. The GDPR demands of companies very restrictive things on what can be done with that data, among them you have the right to see all of it.

If the companies want to know what people are doing, they should pay for it.

And now I know what car I'm not getting next time around.

When I buy a thing, I demand that it work for me. Honda certainly isn't giving discounts to people in exchange for their data.

You may be buying an older used car, then. I always look for this stuff in rentals and it is always there.

I'm fortunate to live in a state with a decent privacy law. I think my strategy will look more like:

- Find a car with the least bad policies, then

- File a CCPA demand that they show me all the information they collect about me, that they delete it all, that I refuse to allow them to share it with anyone else, and that they limit how they use my data.

If you live in California, here's what the law requires basically all car companies (i.e. all with more than $25M gross revenue) to do up on your request: https://oag.ca.gov/privacy/ccpa

I wish all people living in jurisdictions with laws like this would file individual requests, making it more expensive to process opt-out requests than they profit from the rest.

With Honda it's easy. You can turn the telemetry off. There will be no need for CCPA demand.

If I’m going to have to fix their system so that it doesn’t spy on me, I’d rather pass the hassle back to them and make them deal with it. If I fix it myself there’s no downside for them in turning it on in the first place.

There's nothing to fix. The option is the first thing you see when you turn the car on. It asks you. Telemetry on or off. I pressed off and drove away. Never bothered me again. I'm glad Honda gives me this easy option unlike pretty much everything else I encounter these days.

This article was from someone who had a harder time of it than that.

The main pain point they seem to have is the orange circle in notifications bar at the top. I have the same but it doesn't really bother me. It is a little bit of a dark pattern but I can live with it. Like I said, others make it much much harder than Honda, but I agree, Honda could do better still!

Or buy one of the lower trims without connectivity. The statements about it will still be in the privacy policy but they won't be sending the data.

TL;DR: Download an app, then click a button on the car, and hope they're honoring your request. Live in CA and you can ask for your profile under CCPA. Otherwise... too bad.

Or find the cell modem and hack that thing out of there.

> Or find the cell modem and hack that thing out of there.

I think we need more of this. Yank out the connectivity and be sure it's actually not sending anything.

Gigabytes of storage costs pennies, so manufacturers can (and probably already do) just save the logs locally and download everything when it comes to the dealership for service. The data is slightly less valuable because it's not available in real-time, but they get the data regardless.

This is how Tesla currently handles diagnostic logs if a vehicle's network access is shut off. Based on their history so far, I expect the other automakers will be worse on data privacy, not better.

I doubt anyone other than Tesla is doing that. Other automakers probably just aren't bothering, and they also don't have the vertically integrated service model that Tesla does.

Possible, if there would be proof could probably just go to a trusted 3P service - well not for Tesla I guess

Another option might be pulling the GPS antenna. It can't give away data it can't collect.

What can you pull to stop acceleration and brake tracking?

The throttle cable duh! JK good point

Reply on news.ycombinator.com