back to article Connected car data handover headache: There's no quick fix... and it's NOT just Land Rovers

The perils of previous owners retaining unfettered access to the data and controls of connected cars after resale is a wider problem across the industry, The Register has discovered. We have confirmed that BMW, Mercedes-Benz and Nissan may all have much the same issue as Jaguar Land Rover, the focus of our recent article on …

  1. Neil Barnes Silver badge

    This needs some input from the DVLR

    When a car is sold, scrapped, or disposed of to a dealer, (in the UK) the DVLA must be informed.

    Dealers have access to the DVLA database.

    Some way of linking the DLVA owner change event to a scrub it clean event ought not to be beyond the bounds of possibility...

    1. macjules

      Re: This needs some input from the DVLR

      DVLA is still living in an age where the latest technology is, "hey look, you press a button and the front windows go up and down".

      Asking them to come up with coherent guidelines for electronic user registration and de-registration would be like asking Capita to organise a single sign-on system for the NHS.

      1. Tom 38

        Re: This needs some input from the DVLR

        I find the DVLA driver license verification tool* effective and modern, and when I renewed my driving license, it was literally 5 minutes of point n click, with a photo from my smartphone; it couldn't have been simpler.

        * When you rent a car; you go on the DVLA website, enter a few details from your license and get a 6 digit code to give to the rental agency to verify your license.

        1. ACZ
          Thumb Up

          Re: This needs some input from the DVLR

          Yes... there are some convenient online systems from uk.gov (fx: dons protective headgear... ;)

          When a car is purchased with all this internet connected stuff, is the data controller identified to the buyer? Is there a way for the new registered keeper to notify the data controller to revoke all third party access (including previous owner/registered keeper access)? Is there a way for the registered keeper to verify who has access to data associated with their vehicle?

          Surely we just need a system where (a) the DVLA issues the registered keeper with a time-limited single use code specific to the vehicle, (b) they can then go onto the data controller's website and use it to associate the vehicle with them, and then (c) they can access the full list of connected devices/accounts and modify as appropriate.

          Place a statutory obligation on anybody who sells a vehicle to notify the buyer of all data controllers and you're sorted.

          Simples :)

          1. Lee D Silver badge

            Re: This needs some input from the DVLR

            I imagine Ford et al have to access that information for any serious recall.

            The facility therefore already exists for them to poll such data, and spot ownership changes. If DVLA provided a "trigger" for such events automatically (rather than continuous polling) they could easily provide such to the manufacturers. And there would be any number of good reasons to.

            The DVLA are actually quite modern nowadays. Insurance, MOT, driving licence, etc. data are all available online via APIs (maybe only to closed companies like AskMID and hire companies but they are there!). And, as people point out, you can even cross your passport and driving licence photos and data for renewing them.

            It wouldn't be a big stretch for DVLA to offer an API to the major motor manufacturers (who presumably don't send CSVs of all the new car registrations / serials etc. to the DVLA as they build them but have some kind of API!) to allow them to query all such ownership changes and archive their data making the car available to register again. They don't even need to "notify" anyone who hasn't asked to be notified (e.g. the new owner, no, the old owner who had an account, maybe so!). They just wait for someone to try to register their "new" car again.

            To be honest, the tech to register these cars should at least be matching the level of tech in them in the first place, or there's something incredibly awry.

            1. Peter Gathercole Silver badge

              Re: This needs some input from the DVLR @Lee D

              The ability to use your passport photo as part of the driving license application has been there since about 2006.I was part of the project that implemented it.

              I don't think that it is that radical to tack a bit of function to the already existing process of registering a change of ownership of a vehicle. All of the generation of the V5C is already there, and it would be relatively trivial to add something like a code generation step and notification of change of ownership to the manufacturer (although it would have to not include either the previous owner or the new owner information for data protection reasons).

          2. Anonymous Coward
            Anonymous Coward

            Re: This needs some input from the DVLR

            Place a statutory obligation on anybody who sells a vehicle to notify the buyer of all data controllers and you're sorted.

            ------------------------------------------------------------------------------------------------------------

            There are people (like me) who aren't sure what a data controller is, and has no clue how to figure out which data controllers are associated with an arbitrary make and model of vehicle.

            For that matter, this article was my first inkling that a 'data controller' was associated with the vehicle.

            And, of course, any solution that only works in the UK is quite useless to the majority of vehicle owners.

        2. The Original Steve

          Re: This needs some input from the DVLR

          "I find the DVLA driver license verification tool* effective and modern..."

          Only if you know your "Government Gateway" ID and passwords. My brother tried to change the address on his driving licence last week

          He gave up after countless attempts so came to his sibling with two decade of professional IT experience to do it for him. Involved a reset of his password, then we didn't know the randomly generated username which the government send him via the post 5 years ago, so had to then "re-register" countless times, before giving up and creating a new ID from scratch.

          Took us over an hour.

          1. Ozumo

            Re: This needs some input from the DVLR

            Driver verification needs your licence number, postcode and NI number. Shouldn't take someone with two decades of IT experience an hour to come up with that...

        3. Anonymous Coward
          Anonymous Coward

          Re: This needs some input from the DVLR

          Ah yes the wonderful DVLA. We had an issue with transferring a reg number onto retention while assigning a number already on retention to the vehcle. As instructed we sent in all the documentation and a cheque, After a couple of weeks we had the paperwork back for the retained number to be assigned, but no sign of the new retention certificate. after a few weeks we called them only to be told they hadnt received the application to retain the removed number , despite the fact that all the document was stapled together, in one envelope sealed with sellotape and posted via the Signed for Royal mail service.

          It took weeks of calls and 2 further identical forms to sort it out, oh and 2 more cheques - it seems they destroy those they dont immediately bank.

          So is it really likely that the DVLA can cope with a new function - when it cant even master a process that predates even its prior incarnation as the Government run DVLC?

          1. Anonymous Coward
            Anonymous Coward

            Re: This needs some input from the DVLR

            The DVLA dropped my wife's car into a data black hole : it did not officially exist when the peelers ran a random roadside check on the plates.

            We were driving an iCar (mathematically imaginary)...

            That was a fun day, but luckily we found two coppers with a sense of ironic humour.

            So,, trust the DVLA to get some more data right?

            Lol.

      2. J. Cook Silver badge
        Joke

        Re: This needs some input from the DVLR

        "hey look, you press a button and the front windows go up and down".

        Now I have the guys from Bad Obsession (Youtube "Project Binky") doing the "windows go up! Windows go down!" gag. :)

    2. The Man Who Fell To Earth Silver badge

      BIG FAT RESET BUTTON

      At the top level menu on the car itself should be a selection that cleans the car computer completely including deauthorizing any remote access or control. Yes, have a barrage of "Are you sure?" screens for idiot filtering, but deauthorizing should be easy to do AT THE CAR.

      1. Charles 9

        Re: BIG FAT RESET BUTTON

        But that enables Evil Valet attacks. It MUST be trickier than just doing something in the car or it CAN AND WILL be abused.

        1. whitepines

          Re: BIG FAT RESET BUTTON

          How about a passcode / PIN to reset? When you buy the car from someone else, either they put in the PIN and reset it in front of you, or the reset the PIN back to 0000 (default) when they want to sell the car and then you can go reset it (again) for verification.

          Simple.

          1. ChrisC Silver badge

            Re: BIG FAT RESET BUTTON

            And when, as they will do, forget to enter/reset the PIN prior to sale?

            1. Anonymous Coward
              Anonymous Coward

              Re: BIG FAT RESET BUTTON

              And when, as they will do, forget to enter/reset the PIN prior to sale?

              ====================================================================

              Easy.

              A vehicle specific master wipe password that will only trigger a wipe, and is only available to the registered owner of the car tied to the VIN and only from the manufacturer, at a dealership or other location that can verify identity.

              1. TG2.2

                Re: BIG FAT RESET BUTTON

                First of all ... this issue isn't new. When was the last time you rented a car, that's bluetooth enabled? Ever tried to connect your phone.. and find others still in there?

                So first and foremost, its the lazy people getting in these situations, that don't go through those apps and clear out their own data .. the last three cars I rented, I could have downloaded someone else's Phonebook data .. but being more of a white hat .. I simply deleted the other data from the system. They all have options to do so.

                Second .. while I get Anon's idea.. it again imposes issues.. just like all of the other technological fixes for a horribly broken human existence.. Sure.. limit the reset to being at the dealer .. or manufacturer .. which means.. you *WILL* most likely have to PAY THEM to perform the service, even if its just to give you the code to do it yourself, while you are in *THEIR* parking lot, etc..

                You think they won't? Look at all the american greed mongers that charge 75 dollars or more just to attach their Diag Tool to the modern car, to read what the car is saying is wrong .. and if you DONT pay it .. they hand it back to junior who sits there and futz around trying to figure out what's wrong, without using the Diag Data that should immediately move the technician to the troubled issue.

                The simple fact, is 1st world problems, and educating people that this is an issue they must ensure for themselves doesn't happen for *THEIR* car, their sale of, or purchase ... that they make sure their first or last actions (depending on if you're the new owner, or the former) are to delete / wipe / reset via the option ALREADY PRESENT in the car and apps to do so.

                1. Michael Wojcik Silver badge

                  Re: BIG FAT RESET BUTTON

                  When was the last time you rented a car, that's bluetooth enabled?

                  I have no idea. I rent cars a few times a year, but there is no way in pluperfect hell I would use the Bluetooth in one.

                  Ever tried to connect your phone.. and find others still in there?

                  Good lord, no. What an astoundingly bad idea.

            2. whitepines

              Re: BIG FAT RESET BUTTON

              Handle it in the same way as "forgetting" to sign title transfer paperwork or "forgetting" to give you all the keys? I.e. don't pay for the car until the previous owner is actually willing to transfer you all rights to the car?

        2. Anonymous Coward
          Anonymous Coward

          Re: BIG FAT RESET BUTTON

          Citizen, you have failed in your duty to keep focus on the approved order of existential threats, from which your leaders will protect you.

          -peace is breaking out in Eastern Europe

          -this must be prevented

          -we assume your patriotic approval for the required cafe mortaring and outrage-generation program, and will be initialising the direct-debits for your part of the required material support presently. As a citizen of good standing, you automatically approve.

          -please stand by

          -remember to print out and mail your eulogy to the joy of Things Being Put Right, the proper wording provided in the attachment. This will be affixed to the mortar tubes in the approved fashion. 100gsm or better, no cheap stuff.

          -Note, the part about "cursing their childrens' bones" has been updated and revised to remove Biblical refences, and replaced with excerpts from our new culture- the works contained in Lord Of The Rings, Game of Thrones and the writings of Ol' Dirty Bastard and Gwen Stefani, in her spiritual sequence of catechisms "Hollaback Girl".

          We trust you are familiar with the wording, and that Gothic font will be acceptable.

      2. Anonymous Coward
        Anonymous Coward

        Re: BIG FAT RESET BUTTON

        At the top level menu on the car itself should be a selection that cleans the car computer completely including deauthorizing any remote access or control. Yes, have a barrage of "Are you sure?" screens for idiot filtering, but deauthorizing should be easy to do AT THE CAR.

        ===================================================================

        Better than not having it, but it really needs a 'wipe password'.

    3. Rackspanner

      Re: This needs some input from the DVLR

      The DVLA are not going to get involved - they deal with licenses and vehicle registration. Asking them to deal with registration and deregistration of user accounts is a long way outside their job description. It would be like asking them to manage your photos of the car on Facebook.

      The GDPR is the way to go here. The car industry GREATLY prefers self-regulation (see, for example, the industry's initiative to introduce speed limiters which kick-in at a "sensible" 250kmh). So the best bet is to make them feel like some authority is going to get involved and let them sort it themselves in a hurry.

    4. Michael Wojcik Silver badge

      Re: This needs some input from the DVLR

      This is an excellent solution for car manufacturers who only sell cars in the UK.

      Those who have to deal with multiple jurisdictions may find it difficult to build a system that accommodates automated interactions with all of them.

  2. Locky

    Good news!

    The software on my Fiat is so diabolical even I can't connect. The chance of someone else being able to is minimal

    1. Chronos
      Coat

      Re: Good news!

      Re: the title, I thought you were going to tell us about a new Dacia Sandero.

      Anyway... :-)

      1. dankell

        Re: Good news!

        The Dacia Sandero I just had as a courtesy car had quite a few previous bluetooth devices in it's history.

        I didn't check whether the previous users synced their Contacts.

        It was nice and easy to unpair when I returned the car.

  3. Anonymous Coward
    Anonymous Coward

    "When I buy a car, I want to be able to make sure MYSELF it is no longer accessible to previous owners"

    When I buy a car, I want one that doesn't have any connection to the bloody Internet.

    1. Laura Kerr
      Thumb Up

      "When I buy a car, I want one that doesn't have any connection to the bloody Internet."

      I agree with you - I can see no benefit at all in having my car spew data all over tinterwebz.

      You might end up having to go retro in a few years, though. I have a Land Rover, but it's a Defender. Apart from the ECU, the only electronic gubbins it has are the immobiliser and tracker. A nice big chunky metal steering wheel cover and a Rat Trap transmission lock help keep it safe. Low-tech, analogue and effective. And that's how I like it.

      1. Chris G

        '92 Disco here, the only way it can be 'connected' is with a chain or a welding kit.

        I already have two laptops, a phone and a tablet trying to track me so who needs the car in on it as well ? Want to use GPS? I have a suckery thing to stick my phone to the screen, although so far I have managed to drive over most of Europe, bitsof the US and a chunk of India without any connection to anything more than asking the occasional pedestrian where something local is.

        As I have said before I like Gps for sailing with an auto steer but no need for it on the roads.

        Pretty soon they will be connecting your children at birth because paedophiles etc.

    2. Anonymous Coward
      Anonymous Coward

      'When I buy a car, I want one that doesn't have any connection to the bloody Internet'

      Was asking the same thing. Then I read this and it was clear. The car makers want in on the slurp game. This is just phase-1, like when Smart TV's phoned-home file names of stuff watched:

      -----

      The Car of the Future Will Sell Your Data - Bloomberg

      https://www.bloomberg.com/news/articles/2018-02-20/the-car-of-the-future-will-sell-your-data

      -----

      Crunching Car Data for Cash: An Israeli Startup Takes on Google

      https://www.bloomberg.com/news/articles/2018-02-20/crunching-car-data-for-cash-an-israeli-startup-takes-on-google

      -----

      Peak Car - and the End of an Industry

      https://www.bloomberg.com/news/articles/2018-08-17/-peak-car-and-the-end-of-an-industry

      -----

      The glitch that stole Christmas: How to handle smart tech gifts

      http://www.bbc.co.uk/news/technology-42361279

      -----

    3. Anonymous Coward
      Anonymous Coward

      "When I buy a car, I want one that doesn't have any connection to the bloody Internet."

      ==========================================

      Wire cutters, I tell you, or a pre-blown fuse.

    4. Mark 65

      Do these cars use a soft SIM or is it one that could be removed?

  4. Pete 2 Silver badge

    Do you own your car?

    > "This is an unreasonable demand to make of JLR because any such automatic bullet-proof method would be dependent upon a similarly bullet-proof system/process whereby JLR is informed of the sale of any of their vehicles, including private sales."

    It is not unreasonable. When car makers offer "connected car" services, they take on a duty of care regarding the data they collect. A part of that care is to prevent it being used by any party that does not have a right to it. That includes previous owners of the vehicle.

    This is a break from the old supplier-customer relationship of a single sell-buy transaction (with warranty obligations). Since the car-makers have elected to create this feature and to make it open-ended, time-wise, the onus is on them to make it work. And not just for the original owner.

    1. wolfetone Silver badge

      Re: Do you own your car?

      I think Vauxhall were criticised heavily in the wake of the Zafira recall that they hadn't notified all of the owners of the cars affected. Eventually they did or are nearly there, and that's before we even get to Vauxhall actually fixing the cars.

      If my memory is correct, in times of a recall the manufacturer will ask the DVLA for the details of the registered keepers of the cars needed, and in turn they'll be sent letters notifying the customer of the issue and what to do. Honda did this to me when the CR-V needed a recall on the drivers side window switch.

      It's not at all unreasonable, or complicated, to notify the manufacturer of a change of keeper at least via the DVLA, especially as everything is becoming increasingly electronic. The data is there, a mechanism already sort of exists one way that could be facilitated to work in this context.

  5. Doctor Syntax Silver badge

    "we consider the previous owner to be responsible for the removal of the vehicle from the account, this is also agreed upon in our terms of use"

    So a Merc is subject to terms of use. In that case, who actually owns the vehicle, the person who thinks they bought it or the manufacturer?

    1. Anonymous Coward
      Anonymous Coward

      Same applies when I buy a multipack of ice creams, each one labelled "NOT TO BE SOLD SEPARATELY".

      Do I actually own them? Or am I only licensed* to eat them, in accordance with the manufacturer's terms and conditions?

      *Licence is not transferrable

      1. MJB7
        Headmaster

        Re: NOT TO BE SOLD SEPARATELY

        This doesn't mean "we will object if you sell them separately", it means "you will be breaking the law if they are sold separately, because they aren't individually labelled with the ingredients etc"

        1. Anonymous Coward
          Anonymous Coward

          Re: NOT TO BE SOLD SEPARATELY

          I have beside me a can of Diet Coke from a six-pack. The can has the full list of ingredients and nutrition information; the manufacturer's contact details; and expiry date on the base.

          Underneath the nutrition information is a panel which says "Multipack can. Not to be sold separately".

          If they've omitted something legally-required, it must be very subtle.

          1. Aladdin Sane

            Re: NOT TO BE SOLD SEPARATELY

            Who hasn't bought a can like that from a fête or tuck shop at any point in their lives? It's more about stopping your local corner shop shops buying multipacks and then selling them separately, reducing the profit of Coca Cola etc.

            1. Charles 9

              Re: NOT TO BE SOLD SEPARATELY

              So why hasn't the labeling been challenged on exhaustion grounds?

              1. Doctor Syntax Silver badge

                Re: NOT TO BE SOLD SEPARATELY

                "So why hasn't the labeling been challenged on exhaustion grounds?"

                Has a manufacturer of fizzy sugar solutions actually tried to enforce that term? In absence of that it's probably not worth anyone's while to launch their own challenge.

                1. Kibble 2

                  Re: NOT TO BE SOLD SEPARATELY

                  "So why hasn't the labeling been challenged..."

                  IANAL, however big selling items in some, generally, smaller private shops are purchased at a slightly higher price directly from the manufacturer. The shop owner, not having an agreement with the manufacturer, is therefore not subject to the rules set in the contracts larger food stores or certain family chain stores have to abide by. The labeling is still the same to save money by the manufacturer. The store's employees are responsible for restocking and rotation in the independent shops.

            2. Peter Gathercole Silver badge

              Re: NOT TO BE SOLD SEPARATELY @Aladdin Sane

              Check the size of the product from the multipack.

              If it's crisps, snacks or chocolate, especially if bought from Poundland or Iceland, the individual pack size from the multipack is probably smaller than the packs bought individually. This is the reason they're not supposed to be sold separately, so that the manufacturer does not get blamed for reducing the pack size.

              The manufacturers do this to try to make the multipacks appear better value than they actually are!

          2. Kibble 2

            Re: NOT TO BE SOLD SEPARATELY

            If they've omitted something legally-required, it must be very subtle.

            I'm not sure if the system in food stores is the same everywhere, but here in the states some items are stocked and locations of the items being sold are maintained by manufacturers representatives, including rotation of expired items: in essence, the manufacturers signed a rental space for various food items with the food stores. The packaging of the items are subject to the specifics agreed to in the agreements. It's much the same where a vending machine company places their machines.

            1. Kibble 2

              Re: NOT TO BE SOLD SEPARATELY

              Sorry I didn't add that a vending machine could be either privately owned or subject to a contract with the property owner. The many vending machines where I work, a multipurpose sports arena, are subject to a contract with several companies. The vending company is required, by their contract, to check and maintain both the stock and functionality of their machines on a set number of days each week. (I suspect they come more often when needed of course.)

        2. The Nazz

          Re: NOT TO BE SOLD SEPARATELY

          Educated guess : You don't shop much around West Yorkshire, do you?

      2. JohnFen

        Are you a retail outfit buying the stuff from an authorized distributer? That's who those messages are meant for. Those are not legally binding notices. It's a bit like in the old days when record companies would send music to radio stations at no charge, and the media would be stamped "Not for Resale". That only applies to people they have a contract with, and you are not in that group of people, so you can legally ignore the wording entirely.

        1. Anonymous Coward
          Anonymous Coward

          So the contract of sale between Coca Cola's distributor and the retailer, specifies that the retailer may not split a multipack?

          Therefore the retailer doesn't own the product they've bought?

          Or they own it, but if they refuse to comply with terms as to what they do with it, the distributor will refuse to supply again in future?

          1. Kibble 2

            RE: Ownership

            "Therefore the retailer doesn't own the product they've bought?"

            I did give you a thumbs up, on the condition of your original thought: you haven't considered that contract law has many levels. If you go to a specific food store, you might want to purchase a certain soft drink. You might find it in a certain aisle, and you pay the food store for the item. The larger stores limit the number of employees to keep costs down. At times you might see a uniformed soft drink representative stocking the the shelves however. They are paid to deliver and maintain the level of stock by the manufacturer of that sweet fizzy soft drink. The food store you are shopping in does not necessarily own the product, but, by contract, shares in the profit and/or simply rents the space to that brand of sweet goodness. There are agreements with many other product suppliers. The specifics of the contracts differ, but are essentially the same where the store does not own the products: it just makes things convenient.

            If you think about it, it makes good fiscal sense for the food store since you won't have to roam about looking for the product if you know exactly where to find it every time you visit and in the size of packaging needed. You're in briefly and dropping cash. There is a lot of science in how food stores are run. And don't get me started on the self check-out lanes. LOL!

        2. Charles 9

          "That only applies to people they have a contract with, and you are not in that group of people, so you can legally ignore the wording entirely."

          I'd STILL call that false or misleading wording and legally subject to intervention. Unless there's a legally-binding contract or an actual criminal act involved, there shouldn't be anything that implies such.

          1. JohnFen

            "Unless there's a legally-binding contract or an actual criminal act involved, there shouldn't be anything that implies such."

            In the US, anyway, that horse has been out of the barn for longer than I've been alive. All sorts of things have use restrictions printed on them even though those restrictions are not legally binding. The best thing to do is ignored the printed stuff and, if you're truly concerned, check out what the law actually says.

            1. jake Silver badge

              Those "use restrictions" are often there ...

              ... as a form of liability shifting. If someone uses it in a manor not consistent with the labeling, the manufacturer can say "we told you so". It's a kind of get out of jail free card. For example, the "not for human consumption" label on cans of dog chow and bags of bird seed. I've even seen a can of motor oil with the same disclaimer.

              1. Anonymous Coward
                Anonymous Coward

                Re: Those "use restrictions" are often there ...

                > If someone uses it in a manor not consistent with the labeling

                "NOT FOR CONSUMPTION ON ANY ESTATE OF LESS THAN 200 ACRES"

                (Sorry, couldn't resist)

              2. Michael Wojcik Silver badge

                Re: Those "use restrictions" are often there ...

                If someone uses it in a manor not consistent with the labeling

                Stately Wayne Manor, for example, since those labels usually say something about not for use by costumed crime-fighters.

                1. Ozumo

                  Re: Those "use restrictions" are often there ...

                  Surely using it in the wrong manor will result in a visit from some geezahs wiv shootahs?

      3. Kerbside Gruntfuttock

        My first post and it's completely off topic

        That "Not for resale" really p*ss*s me off. We used to run a cafe as part of another business. If we bought cans of coke or bars of chocolate from the cash-and-carry (there's only one left, they bought up all the others and closed them down) we paid about 30% more than we could buy the same stuff for in the local supermarket in multipacks marked "not for resale". In the end we just sold the supermarket multipack stuff. I don't think the customers even noticed, nobody ever said anything.

    2. jake Silver badge

      "who actually owns the vehicle"

      Here in the US, Volvo is running adverts for "the car you can subscribe to".

      I weep for humanity. The marketards from Planet Wherever have clearly won.

  6. Anonymous South African Coward Bronze badge

    "When I buy a car, I want to be able to make sure MYSELF it is no longer accessible to previous owners, not rely on their goodwill or attention to detail," IT worker Mike Walters‏ told El Reg, summarising the feelings of many drivers we've spoken to about the issue.

    This. Well said.

  7. Anonymous Coward
    Anonymous Coward

    The auto manufacturers won't care

    Until GDPR regulators come a calling on them too.

  8. Chronos
    Facepalm

    Why?

    Give me one good reason why cars need to be Internet of Shite on wheels. Good reasons do not include unlocking the car without use of the key or being able to start it because you have (ooh, matron!) a dongle in your pocket.

    Trackers should be separate devices and, ideally, under the control of the owner alone. Whoever thought connecting the infotainment system to the ECU was a good idea needs shooting. Likewise, OTA firmware upgrades need to die in a fire (but not in the car). The ECU has one job: To keep the engine running as efficiently and reliably as possible.

    All of this crap began with remote central locking. Being able to open the car without using a manual lock which is oh, so difficult was seen as essential, never mind the 433MHz receiver with a front end as wide as a barn door which dies at the mere whiff of a rent-a-cop's transceiver at a shopping centre, 24 bit codes which were vulnerable to replay attacks or just plain shoddy technology which didn't work such as Rover's "windows up" crap which got itself confused more times than not thinking the windows were still down and refusing to lock.

    Lazy bastards are causing more security headaches than all the script kiddies who ever slimed their way onto the Internet. Worse, the eventual beneficiary of all this will be Big Data Fetishist types who want every single piece of technology you "own" to spy on and betray you. Eric Blair thought it would be kids and neighbours dobbing you in for wanting freedom. Turns out it was the only thing he got wrong.

    1. hammarbtyp

      Re: Why?

      Give me one good reason why cars need to be Internet of Shite on wheels.

      So manufacturers can monitor your car and bombard you with high cost service requests from their dealers

      Oh sorry, you were asking what is in it for the owners? Not a lot

      1. annodomini2

        Re: Why?

        [i]Give me one good reason why cars need to be Internet of Shite on wheels.[/i]

        So they can flog all your location data to advertisers, then show you adverts in the car.

        Extra revenue, for them.

        1. JohnFen

          Re: Why?

          I think he said a good reason.

    2. MJB7

      Re: Why?

      Connecting the infotainment system to the ECU means that the radio can automatically turn up the volume as the speed increases (to compensate for increased engine and road noise). It is also dead useful for the navigation system to have access to the road speed from the ECU - it allows it to dead reckon inside tunnels (where the GPS signal tends to be somewhat limited).

      Of course, in a properly secure system, the infotainment system would be connected to a secure module that can *read* the CAN bus, but refuses to write to it. The problem there is that another module costs dollars, and car manufacturers care about saving cents.

      You may feel that remote central locking gets the balance between usability and security wrong; I don't. I value being able to remotely unlock the car - it's not a *huge* benefit, but the risk seems to be pretty low too

      1. heyrick Silver badge

        Re: Why?

        "Connecting the infotainment system to the ECU means that the radio can automatically turn up the volume as the speed increases"

        What's wrong with a microphone, some sampling software, and clever use of heuristics to turn up the volume when the road surface is actually noisy, rather than just "when the engine is going faster".

        Some of these non slip road are pretty rumbly even at slower speeds.

        1. annodomini2

          Re: Why?

          Cost, cost, cost

        2. Sherrie Ludwig

          Re: Why?

          "What's wrong with a microphone, some sampling software, and clever use of heuristics to turn up the volume when the road surface is actually noisy, rather than just "when the engine is going faster".

          Some of these non slip road are pretty rumbly even at slower speeds."

          How about the nice rocker switch on the steering wheel of my Toyota, a volume control I reach with my thumb if necessary? I am of the "I hate data slurping" crowd. Although, as a person who travels less-used country roads often, a "The car crashed, send help here" function might be reassuring. You all have reminded me to check, I just got a new-to-me two year old car, so will bring this up at next service date. This is why I read The Reg, even though I am as tech-knowledgeable as a hunter-gatherer.

      2. Primus Secundus Tertius

        Re: Why?

        Remote unlocking is very useful in a dark garage. It also switches on a few lights, so you can see things.

        1. hammarbtyp

          Re: Why?

          Remote unlocking is very useful in a dark garage. It also switches on a few lights, so you can see things.

          errr, that's what my remote key fob does

      3. JohnFen

        Re: Why?

        None of those "benefits" require the car to be connected to the internet, though.

      4. Chronos

        Re: Why?

        Connecting the infotainment system to the ECU means that the radio can automatically turn up the volume as the speed increases

        Oh, for pity's sake! What a feeble excuse for introducing more complexity into a system that is, when you get right down to the basics, safety of life. Lose the engine, you lose the servo vacuum. Lose the servo vacuum you lose the brake assist. You also lose the power steering assist on older vehicles. Besides, I could do that by just feeding the road speed and RPM pulses into a dedicated port, which means the bloody radio can't piss about with the ECU as it's a one-way flow. Or, you know, set the volume manually like a normal human being?

        the CAN bus

        This is yet another bugbear. CAN monitoring of ancillaries is making drivers forget their responsibilities. When was the last time you did a tyre check, including the inside sidewall for flaws?

        All this automatic monitoring down to and including the bloody brake light bulbs is breeding complacency.

      5. Anomalous Cowturd
        Holmes

        Re: Why?

        @MJB7

        My 1998 Volvo does precisely that, with no need for a connection to either the ECU or the internet.

        The only digital device in the car is an LCD thermometer / clock.

        K.I.S.S.

    3. Velv
      Boffin

      Re: Why?

      Traffic avoidance. Routing round accidents, roadworks and events.

      There are some systems available now, they aren’t very good, but it will develop. Google maps shows congestion.

      Ultimately as cars start to talk to each other you end up with a system like TCAS (Traffic Collision Avoidance System) in aircraft, or the vision of the future in the Zurich insurance advert a few years ago. You might not like it, but it’s coming.

      1. JohnFen

        Re: Why?

        "Traffic avoidance. Routing round accidents, roadworks and events."

        None of which require the car to be connected in a world where you're very likely to have a smartphone on you.

        As to TCAS-like systems, those don't require an internet connection at all -- they only require cars to be able to talk to other cars in their immediate vicinity.

        1. jake Silver badge

          Re: Why?

          "Traffic avoidance. Routing round accidents, roadworks and events."

          Funny thing about this. What it does is re-route all the through traffic (freeways, etc.) onto surface streets, which aren't designed to handle the volume of the freeway. And every single piece of software doing the re-routing uses the same basic algorithm, thus all the freeway traffic winds up on the same surface streets, leading to even more congestion. I see it all the time on the Hwy 101 corridor between the Golden Gate Bridge and roughly Sonoma County Airport.

          Adding to the problem is locals taking the freeway one or two exits to get across town. Seems to be faster, but try timing it sometime. (I'm squining at you, Marinites and Santa Rosans). This has been quite obviously getting progressively worse as more people "trust the car" to tell them where to go.

          Computers are supposed to be a tool to enhance human thought, not a replacement for it!

  9. Anonymous Coward
    Anonymous Coward

    "It's like selling your phone"

    It's nothing like selling your phone

    When you sell your phone you have an incentive to wipe it because you are the one at risk, of data theft, etc etc,

    But when you sell your car you have no incentive to wipe the connection as the new owner is the one at risk of having it swiped

    1. Anonymous Coward
      Anonymous Coward

      Re: "It's like selling your phone"

      Left or right?

  10. Anonymous Coward
    Anonymous Coward

    For Sale: Faraday cage, car sized.

    Edit: Further thought, can't you just take the sim out?

    1. eldakka

      Edit: Further thought, can't you just take the sim out?

      Sidecutters; find the antenna, *snip* the attaching wires.

  11. Frank N. Stein

    This is why the most recent car I bought Isn't connected to Satellite Radio, Internet, or anything else. I don't need that "connected car" nonsense. I COULD activate that or built in WiFi, but I have no need for that, as my Phone has service and Google Maps, so I'll pass on activating any connected services. It's off, I know it's off, and I won't be activating or using any of it, especially after reading this article.

  12. Herring`

    Car? That's nothing

    I recently sold a house and I can still get to the (Nest) smoke alarm. Granted, it can't give me the current position of the house.

    Half surprised that the buyers haven't torched it for the insurance.

    1. JohnFen

      Re: Car? That's nothing

      "Half surprised that the buyers haven't torched it for the insurance."

      I'm half surprised the buyers haven't ripped that shit out of the house. That would be the very first thing I'd do. Although the odds are high that they don't know or understand what the thing really is, so they wouldn't be alerted to the security issues.

  13. Tim 11

    let's go back to the good old days... oh wait!

    in the olden days (and probably still today for 90% of car owners) you can make a copy of the key before you sell your car (or house for that matter, or anything with a key in it) and still get access even after the ownership has been transferred. is this really any worse than that?

    1. Chris G

      Re: let's go back to the good old days... oh wait!

      You haven't thought this through very much have you Tim?

      Or for that matter, have been paying much attention to the article or comments.

    2. ChrisC Silver badge

      Re: let's go back to the good old days... oh wait!

      It certainly is worse than that if the persistent online tether between the car and the previous owner allows them to do stuff they wouldn't be able to do purely by retaining a set of physical keys, and by the sounds if it that's exactly what these online tethers do allow them to do. If I sold my car to you but quietly retained a set of keys for myself, what could I do once you'd driven off? Unless I knew where you lived, worked, shopped etc. and therefore could gain physical access to the car at some point in the future, having a set of physical keys for the car is useless.

      OTOH, if I sold my car to you and retained access to the online app, then it wouldn't matter where on the planet you or I were. I obviously wouldn't be able to steal the car myself unless I was still in the same physical location (which, thanks to the tracking capabilities that might be present in the app, could be easy enough for me to arrange), but if I were to regularly exercise the remote unlocking feature of the app, then sooner or later there's a reasonable chance that the local pondlife would take advantage of your car being unsecured, and you'd be left wondering WTF had happened, so certain were you that you had locked the car before walking away from it...

      Or if the remote app allowed me to start the engine, how much fuel could I waste by doing that at regular intervals? What if you lived somewhere that penalised people for leaving their engine running unecessarily - how many fines could I clock up on your behalf? Could even be a bit nasty for you if you happened to live in a townhouse above your garage, and it wasn't sealed/ventilated well enough to prevent exhaust fumes seeping into the living areas above from having the engine start up a few times in the middle of the night...

      And it's certainly not true to say this is a problem for all key-based things such as houses - who in their right mind would buy a house and then NOT be straight down to the nearest DIY barn, locksmith etc to buy a full set of replacement locks?

      1. DavCrav

        Re: let's go back to the good old days... oh wait!

        "who in their right mind would buy a house and then NOT be straight down to the nearest DIY barn, locksmith etc to buy a full set of replacement locks?"

        A recent survey says: most people.

    3. Charles 9

      Re: let's go back to the good old days... oh wait!

      Yes, you don't have to know where th we car is located now. IT BLOODY TELLS YOU!

      I wonder when all new cars MUST have remote telemetry to be deemed road-worthy...

    4. Doctor Syntax Silver badge

      Re: let's go back to the good old days... oh wait!

      you can make a copy of the key before you sell your car (or house for that matter...)

      Car is driven off very unlikely never to be seen again. Unless you have access to a tracker in it (which, in part, is what this is about) your key does nothing for you.

      With a house you can, and should, change the locks when you move in. You never know who the previous owner might have given a key to - and even that owner might have forgotten. A few years ago my daughter bought a house. The owner said she'd handed over all the keys. The day daughter moved in, or maybe the next day, one of the neighbours turned up to hand over their copy of the key the previous owner's forgotten about.

      1. acid andy
        Stop

        Re: let's go back to the good old days... oh wait!

        you can make a copy of the key before you sell your car (or house for that matter...)

        Car is driven off very unlikely never to be seen again. Unless you have access to a tracker in it (which, in part, is what this is about) your key does nothing for you.

        The car is quite likely to often be parked near the new registered keeper's address. In a private sale the previous owner would have ample chance to get that. Unless you change the locks, you rely on a certain amount of trust in the previous owner. Caveat emptor!

    5. jake Silver badge

      Re: let's go back to the good old days... oh wait!

      One of the first things I've always done on purchase of a house is re-key it. I generally re-key the motor vehicles, too, but that's part of the rebuild. Neither is exactly rocket surgery, and the insurance company knocks a few dimes off my bill for my trouble.

  14. Moog42

    If you jump into the world of electric cars (I'm on my 2nd and let's face it, they are coming for all of you) you're kind of forced into the entire connected world - you control the charging and preconditioning via an app, you get charge notifications, and you need the car connected to update not only the car itself, but also the list of available charge points etc... When I sold my Renault Zoe I could do a full reset from the dashboard, not quite so easy on the clunky Renault website where you get updates from - still can't shift my profile off that. My new LEAF tracks my every movement it seems, as well as having the ability to take full telemetry and photographs if it is involved in an accident - not quite sure I gave it permission to do that, and no idea where all that data is being sent...

    1. JohnFen

      "If you jump into the world of electric cars"

      If all electric cars require connection to the internet (or any service provider whatsoever), then I won't be jumping into the world of electric cars. That's a complete dealbreaker.

      1. Moog42

        More electric...

        Well it's not an absolute (think large scalextric, and that's as complex as they really are), but you do then risk driving it beyond it's range and then you'll have to find a charger somehow - yes you can do that with your phone, but it can't calculate your consumption and distance to charger. I am however willing to connect on the basis that I put a total of £0 worth of electricity in every month thanks to the free chargers. But I'm cheap like that.

        1. Pedigree-Pete
          Happy

          Re: More electric...

          @Moog42 I'm cheap like that.

          Oblig. Dolly quote. "It takes a lot of money to look this cheap". PP

      2. Charles 9

        "If all electric cars require connection to the internet (or any service provider whatsoever), then I won't be jumping into the world of electric cars. That's a complete dealbreaker."

        So what happens when ALL cars MUST be connected to be declared road-worthy (so no, used cars are out as well)? Do you walk everywhere from now on even during a downpour?

        1. JohnFen

          "Do you walk everywhere from now on even during a downpour?"

          Well, I mostly bike everywhere right now (even during a downpour), so I'd probably keep doing that. For instances where a car is necessary, like going on a shopping trip, I can just take a cab.

        2. jake Silver badge

          "So what happens when ALL cars MUST be connected to be declared road-worthy (so no, used cars are out as well)?"

          There are, by some estimates, some 50,000,000 vehicles on US roads that are over 40 years old. These aren't all old junkers, these are carefully maintained family heirlooms. They are driven daily, both for utility and for fun. Outlawing all these vehicles would alienate a LOT of voters.

          Manually driven, petrol powered, non-computerized, un-connected over-the-road vehicles will be with us for at least another century, and very probably much longer. I suspect that any politician who tries to change this will be tarred & feathered and run out of town on the rail.

          1. Charles 9

            "There are, by some estimates, some 50,000,000 vehicles on US roads that are over 40 years old. These aren't all old junkers, these are carefully maintained family heirlooms. They are driven daily, both for utility and for fun. Outlawing all these vehicles would alienate a LOT of voters."

            Many of those old cars required retrofitting to qualify for emissions standards and so on, and since inspections are an ongoing thing, grandfathering doesn't apply. So it could just require another retrofit, justified in Congress (who BTW doesn't listen to the people anyway) for environmental (emissions, traffic planning) and criminal reasons.

            1. jake Silver badge

              "Many of those old cars required retrofitting to qualify for emissions standards and so on"

              What state do you live in? None of the above is true for non-commercial vehicles here in California, and last time I checked we were the most restrictive state when it comes to such matters. You can even run without seat belts in pre-1968 vehicles, if they didn't come with them from the factory.

            2. JohnFen

              "Many of those old cars required retrofitting to qualify for emissions standards and so on, and since inspections are an ongoing thing, grandfathering doesn't apply. "

              That's not true in my state. If you have an older car, you must do whatever maintenance is required to keep it running efficiently (in terms of emissions), but you aren't required to retrofit new emission-reduction technologies in it.

              You can even still use leaded gas (although you have to add the lead with a separately purchased additive).

          2. Sherrie Ludwig

            "Outlawing all these vehicles would alienate a LOT of voters.

            Manually driven, petrol powered, non-computerized, un-connected over-the-road vehicles will be with us for at least another century, and very probably much longer. I suspect that any politician who tries to change this will be tarred & feathered and run out of town on the rail."

            You have unfortunately forgotten that it is not the US voter who elects the politician anymore - it is the big-money interests (like car companies) that have enough of the readys to buy them, and write the laws. Remember, we don't have universal single payer healthcare, or sensible gun laws, or a myriad of other desirable things because it would disturb the election money which buys the government.

      3. The Nazz

        When all cars are electric ....

        it'll pretty much be pitch black. You won't be able to connect to the internet, switch the heating on at home, nor make a cup of tea/coffee.

        Years back we had a power cut, log burner, plenty of fuel and for a few hours the kids had a great time. Home made entertainment.

    2. Doctor Syntax Silver badge

      "If you jump into the world of electric cars ...and let's face it, they are coming for all of you"

      Maybe not for this guy and his neighbours: https://www.examiner.co.uk/news/west-yorkshire-news/health-safety-row-electric-car-14552658

      1. The Nazz

        "possibly 30 foot"

        looks to me like its connected to the lamppost several cars away, lets say more like 80 foot.

        Bear in mind that Slaithwaite (pronounced slough it ) is one of the posher parts of Kirklees. Possibly lol.

    3. Anonymous Coward
      Anonymous Coward

      "If you jump into the world of electric cars (I'm on my 2nd and let's face it, they are coming for all of you"

      Sales of petrol cars won't even stop before 2040. That's assuming that number stays fixed post-Brexit. It is unlikely to be accelerated.

      By the time electric cars are unavoidable, I'm going to be dead. And I don't care.

      Despite all the hype the truth is that EVs are currently a very minority interest. People surveyed say they would buy them if they were cheap. They are not cheap. And social engineering (differential parking costs and the like) are in essence a middle class subsidy, which means if there are enough electric cars the subsidy will get unpopular, fast.

      In the current state of security I am happy to have GPS and Mr. Google's helpful add ons to help with navigation so long as it very clearly stops at my phone and there is then an air gap (the air between my ears) between the phone and the car controls. I don't mind voice telephone integration because it's useful. But until the manufacturers get liability sorted out - and it's got to be theirs or the dealers - that's where I want it to stop.

    4. Oengus

      If you jump into the world of electric cars (I'm on my 2nd and let's face it, they are coming for all of you) you're kind of forced into the entire connected world.

      That is only because someone chose to design it that way. There are alternatives but those don't give the manufacturer "valuable" personal information that can be on sold. Devices can connect to the car to control those features without the need for connectivity to the outside world.

  15. Christopher Rogers

    The difference between wiping a car for sell on and wiping a phone is that the phone will contain your personal data that could potentially end up with someone else. The car however when sold on will give you access to someone else's data (location for instance).

    If you were of a vicious mind, you'd be happy to still be connected to the car so you can f**k with the new owner and potentially rob them...

    The dealer should be making sure the car is digitally clean before sell on.

    1. Charles 9

      "The dealer should be making sure the car is digitally clean before sell on."

      But what happens if it's a private sale, and no dealer is involved in the transaction? And it takes place either across jurisdictions or by some other way that there's no automated way to register transfer of ownership? It's very easy for ownership status to get lost in the bureaucracy.

    2. Darren Forster

      You do know that if you have the reg plate of your previous vehicle, you can go on to the Gov website, type the reg plate in and it will tell you all about it's MOT history and also sometimes googling the reg plate you can find out extra information about the location of the car. A while ago I actually found my first car (which was a lease car) on eBay in Manchester using just the reg plate. It was actually a very good Nissan Note and when I saw it for sale I was debating whether or not to buy it back but it had already been sold, instead we got another Nissan Note.

      1. Charles 9

        "You do know that if you have the reg plate of your previous vehicle..."

        Assuming you live in a jurisdiction with such resources available AND the vehicle hasn't CROSSED jurisdictions...

  16. IsJustabloke
    Meh

    Since Mercedes-Benz is not always aware that the vehicle is sold

    I think that's bollocks.

    I've said previously, that FIAT always seem to know when I've bought or sold one of their cars (FIATS and Alfas) the FIAT Security register is always updated with the correct details.

    1. Velv
      Joke

      Re: Since Mercedes-Benz is not always aware that the vehicle is sold

      Yeah, but given their (un)reliability, the chances of a nefarious person being able to make off with your Fiat or Alfa is quite low

  17. Jason Bloomberg Silver badge

    How hard can it be (ooo-er missus)?

    "One solution, such as having a button inside held for 10 seconds to disassociate the old owner from the system, for example, could inadvertently help car thieves".

    It shouldn't be that hard to develop some system which allows both transfer and refusal. Simply send an email to the registered owner asking if they want to allow a transfer or block it. If they transfer to a thief that's their stupidity. If they transfer to a new owner everything is fine. If they block a new owner there's a lawyer and court who can deal with that. They can be informed that if they don't do either then the transfer will be actioned after a certain time. If they aren't getting emails because they didn't keep details up to date that's their problem. If emails are not being sent out there's another lawyer and court who can deal with that.

    It might require some tweaking for edge cases but shouldn't be that hard to handle most cases.

    They can even have the above suggestion free of charge.

    1. eldakka

      Re: How hard can it be (ooo-er missus)?

      Simply send an email to the registered owner asking if they want to allow a transfer or block it. If they transfer to a thief that's their stupidity. If they transfer to a new owner everything is fine.

      Yay, another fishing vector.

  18. JohnFen

    Unacceptable

    "Once a customer connects the car with a new ConnectedDrive account, all previous connections will be deleted."

    So if you buy one of these things, the only way you can be sure that the previous owner doesn't have access to your car is to sign up for that spy program yourself??

    Totally unacceptable.

  19. Mage Silver badge
    Big Brother

    Bigger issue than cars.

    Car problem is a symptom of Corporate carelessness, greed and exploitation!

    The entire IoT & "connected" industry is stuffed full of user data exploitation by big companies, bricked gadgets when a company loses interest and massive security & 3rd party privacy flaws.

  20. Cynic_999

    How does this "feature" work?

    If I buy a car with this feature, what do I need to provide in order to set up an account on their server and so gain remote control capability? What checks are made to ensure that the person setting up an account really does have ownership of the car?

    The article mentions that with BMW the previous owner is locked out of their account as soon as the new owner creates their own account. But how is it verified that the new account really is being created by a new owner rather than a thief wandering around car parks taking note of the reg. numbers and VIN of parked vehicles? Or spots a car parked in the driveway of a house, finds out who lives in that house (not too difficult to do) and registers using the real owner's name and address (assuming that the real owner has never bothered creating such an account).

    1. KBeee

      Re: How does this "feature" work?

      From my experience, you set up an online account connected to the car. If there's someone else already "associated" to that car the dealer can "evict" them. If it was a private sale, you'd need to get the previous owner to dis-associate themselves (might go back 2 or 3 owners of course).

      Then (from outside the car) connect, then you need to get in the car yourself and hold Button B for 15 seconds or whatever, and go through a procedure to set yourself up (resetting PINs etc. from default).

      If after that you connect your Android phone cos you trust Google, then God Help You.

      But I'm quite happy my car knows I've gone to Tescos, then back home, then Waitrose (posh MILFS!!!!)

  21. steelpillow Silver badge
    Mushroom

    YADINAFWUC

    Yet Another Dickhead Industry that Needs A F*cking Wake-Up Call

  22. ecofeco Silver badge
    FAIL

    Hoisted...

    ...by our own petards.

    1. jake Silver badge

      Re: Hoisted...

      What do you mean by "our", Kemosabe?

  23. Steve Jackson

    Is this really any different from the key set you get when you buy a non-Smart motor?

    For years, owners have legitimately been able to get a key cut, chipped and or retain / lose / forget to pass on master keys.

    So when you buy used you potentially have those sets floating around or unavailable. Yes, it can cost you money.

    If we're talking about the data exclusively, you're not going to convince people that don't give a hoot to ever give one.

    It's the manufacturers grasp for the big data that is the problem and they really need to be custodian for their errant subjects, end of.

    1. Charles 9

      Thing is, they CAN'T. They're not clairvoyant and can't be held responsible for things that happen without their knowledge such as private sales.

    2. Cynic_999

      "

      Is this really any different from the key set you get when you buy a non-Smart motor?

      "

      Quite a bit different, yes. Once I have sold my car I usually have no idea where it is. A duplicate key cannot locate where the car is currently parked but this application can. I cannot do anything with my duplicate key unless I physically travel to the location where the car is parked. With the application I can start the engine or drain the battery from a different continent. Few people would want to physically steal a car and risk being caught in the real World, but many people wouldn't see a problem with a few "practical jokes" from the (supposed) anonymity of an Internet connection.

  24. This post has been deleted by its author

  25. Da Weezil

    How about a reset switch controlled in part by the ignition key? in the same way as immobilising passenger seat airbags? Make it only operable with the "Master key" which many cars cars come with and put the switch inside the glovebox or next to the OBD port.

    The key would be used to enable the "reset function" in conjunction with the display function control that pretty much every car has now. so for my VAG car with the switch in the on position the button on the end of the wiper stalk which controls the maxidot display in the instrument panel would have a special menu allowing the reset to take place - make the key barrel retain the key unless in the "off" position. Job done no waiting for a response from a registration authroty involved, nor eye watering dealer charges.

    As for evil valet, My last couple of cars have come with an additional spare key with a spanner printed on it. its designed to be left with the car when being serviced or valeted and has limited function - drivers door/engine start and thats probably about it. I know Honda do them - as do Skoda, and for years both Ford and Fiat had "master" keys - often Red tabbed that were required for certain things.

    Its not hard to figure out, having to go through a registration authority or even a dealership is overkill. Make the physical Key part of the system.

  26. Stig

    DVLA and OverAirUpdates

    We register change of ownership with DVLA, so they could inform manufacturers to issue an OTA reset?

    1. Ozumo

      Re: DVLA and OverAirUpdates

      And who pays for this?

  27. kirk_augustin@yahoo.com

    The lack of awareness this can all easily be hacked, is amazing. People must be incredibly ignorant. No sane person would want a vehicle that can be unlocked or otherwise manipulated by an app. That is crazy because not only will it be hacked, but it can easily be disrupted to lock the actual owner out by denial of service attacks.

    1. Charles 9

      Two words: BLISSFUL IGNORANCE.

  28. Darren Forster

    Of course this issue with being able to open the car, start the car and track the car is an issue, however there is another issue that I discovered that affects quite a few cars, and not just high end cars. During a recent trip to Europe my car broke down and I was lent a Skoda Rapid by the breakdown company to complete my journey. It was a very nice vehicle, it had built in sat nav and bluetooth for my phone and it even was able to use my phone to check for delays on the journey (although I have to admit the sat navs description of minor traffic jams on the German Autobahn might need a bit of work as a warning of "Life threatening condition ahead" is a little more unnerving than just telling me there is about 15 miles of queuing traffic or "Security threat ahead" is also a little bit more unnerving when it's just someone having had their car pulled by the police - maybe Skoda might want to work on their translations, especially as when I was back in the UK Oxford is apparently called Arks Ford according to Skoda!).

    Anyway I've diverted away from the real problem I found - the big problem I found was when I connected my phone to the bluetooth in the vehicle. The minute I connected my phone it started importing the entire contact list from my phone into the car stereo. Not only that it also seemed to import things like call history, and text messages - and even when the phone wasn't connected to the car if I went into the phone section of the stereo I could see all the contacts there. As it was a rental car this wasn't exactly what I wanted because of course when the car goes back and on to someone else all my private data would go with the vehicle! Before returning the car I went into the menu system on the car audio system and told it to do a factory reset, this removed all previous data and unhooked my phone (it also unhooked another phone which was already listed - clearly the previous hirer hadn't done a factory reset and neither had Europcar when they re-hired the car out). So before you return a hire car if you've had your phone connected to it, make sure you do a factory reset on the stereo, and don't rely on the hire company to do so.

  29. Mez68

    This issue applies to Tesla's vehicles as well. The app can remain connected and allow previous owners (and previous drivers, if the vehicle was simply RENTED) to operate various functions in the car.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like