It's opt-out on my Renault Megane e-Tech.

It was a very clear prompt during initial setup, and it shows me a very unambiguous notification that it's enabled every time I start the car. If I click on that it takes me to the setting.

edit: might even have been opt-in during initial setup, now that I think about it. I do recall it being a very deliberate thing during setup.

Of course I'll have to trust that turning it off actually turns it off, no way for me to verify that.

The reason I keep it on is because my SO is a bit absent minded to where she parks the car, and I value not having to run around in the streets trying to find it when I'm in a hurry over the potential privacy loss.

edit: Renault was found[1][2] to be the "least problematic" with respect to privacy by Mozilla last year.

[1]: https://foundation.mozilla.org/en/blog/privacy-nightmare-on-...

[2]: https://news.ycombinator.com/item?id=37443644

Apple knows how to allow one to find one’s devices without Apple knowing where they are. It’s not that hard.

Ackhually, it is that hard, unless your method relies on millions of your devices out in the wild acting as sensors in a mesh network, as Apple does.

That’s a much harder problem than VW would need to solve. Also, Find My substantially predates the Find My network and AirTags.

There are very straightforward solutions, depending on the threat model. For example, the app could send VW a private key every day, and VW would send that key to the car. Then the car sends periodic location reports, encrypted to that key. VW can, upon request, send the report to the app, which decrypts it. But VW can’t decrypt the report itself, so they don’t know the location of the car. Also, it’s forward secure in the sense that a leak of VW’s database is entirely useless after a day.

You cannot establish a private channel between app and car if you don’t already have either a pre-shared secret, or pre-shared trusted certification authority keys (such as to allow TLS-like tamper-resistant encrypted communication between app and car) that VW can’t replace.

Otherwise, if there is no pre-existing private channel, the key (which by the way would have to be the public key, not the private key) could be switched out by VW acting as a man-in-the-middle, allowing it to access all encrypted content going through it.

The same is true for Apple. There are parts of the protocol or the pairing where you have to trust Apple, either their servers, or if the establishment happens locally via bluetooth or similar, their software that runs on the local devices.

This argument seems like a fairly extreme example of the perfect being the enemy of the good. Sure, it would require a more advanced system for VW to prevent themselves from silently compromising their own system to learn everyone’s location. But the design I outlined will prevent a passive compromise of VW, and even possibly a court order, from learned everyone’s location, and it prevents even an active and highly malicious compromise from learning past locations.

I was triggered by the argument “Apple knows how to allow one to find one’s devices without Apple knowing where they are. It’s not that hard.” People misunderstand this as Apple having no possibility to learn the location if they wanted to. And that’s just not the case.

Of course Apple could do this. But Apple is the one major company that actually goes out of its way not to.

"Shipping the private key" does not meet the bar for "good". You still need a way to establish trust in your key distribution and also implement the system correctly. The proper way to secure access to a physical thing you own is to only communicate directly with that thing.

This is ridiculous. It would take heroic effort for VW to prevent themselves from silently uploading malicious firmware to VW cars. There are ways to do this, but it’s also a separate problem from the problem that should actually be solved here.

Uh, if the only communication with the car is direct and physical then how does VW upload anything?

If the only communication is direct and physical, then this entire discussion is moot.

Exactly.

This would require a key per app installation, my SO has the app installed too for example.

It would also introduce a lot of additional failure modes.

Doable but not exactly trivial.

It would work exactly like how you can send an encrypted email to multiple recipients and each of them can decrypt it despite having different private keys. That part isn’t rocket science.

Indeed, it's making it work reliably and with zero friction given both apps and car will have variable internet access.

This is not hard. App login sets up a session with VW (which is surely already does), except the session needs a database entry and not just a JWT-like token. (Many auth frameworks do this anyway.) The database row needs to add a public key, and the server needs to send all the key changes to the car. And that’s about it.

Again, that's the easy part. The hard part is making it work reliably in the real world.

What, exactly, makes it hard to get this to work reliably in the real world? The app already won’t work without a valid login session. The car is already sending a little blob of data to the mothership containing a location. If the communication to the mothership changes to having the mothership send a list of keys and the car encrypt its blob, that’s basically it. The total increase in communication needed is one round trip to revalidate keys.

I realize that modern development has layers and layers of documents and teams and overcomplicated interfaces, but this is the kind of thing that could be done by one developer, using two servers and a load balancer (or a more creative HA scheme with client assistance that can easily survive complete loss of a datacenter or two), that can handle the entire fleet.

The app and car will have intermittent connection to the internet.

My car for example doesn't have reliable connection when it's parked in the garage, which is where I charge it.

Your solution would add a lot of extra edge cases that needs to be considered.

You have to ensure the updated key is reliably transferred to the mothership in a timely fashion, and subsequently that the key is reliably transferred to the car in a timely fashion.

That's the back-end stuff. There's also the front-end stuff, like will my SO understand why her app isn't showing the car's location but mine is?

Not saying it's impossible, but it adds a lot of complexity beyond simply encrypting the location with multiple keys.

If the car has enough signal to report, it has enough signal to get the key update. I don't see the problem.

Losing connection for extended periods of time can get in the way of "timely" key updates but they won't cause the encryption to fail.

> That's the back-end stuff. There's also the front-end stuff, like will my SO understand why her app isn't showing the car's location but mine is?

Well the reasons I can think of are either things like the server being broken, which can happen without any encryption, or she didn't finish setting up her app and waiting for it to sync which can also happen without encryption. Or she was removed from the list because she didn't open the app for a year... which can also happen without encryption.

> Losing connection for extended periods of time can get in the way of "timely" key updates but they won't cause the encryption to fail.

To be fair, if the car is offline while a newly installed app logs in, then the app won’t be able to locate the car until the car checks in. Which is not actually the end of the world, and there are ways to mitigate this. (See iMessage and Keybase for a couple of different approaches to this. See Signal for a shockingly poor group of bizarrely mutually incompatible solutions that barely work. I think that Matrix tries, too. MLS should be able to handle it, and piggybacking off an existing standard like MLS might be entirely reasonable albeit dramatically more complex than the simple solution I outlined.)

What edge cases? The app already can’t locate the car if the car hasn’t checked in recently enough.

> I realize that modern development has layers and layers of documents

Where do you work and are you hiring?

The opt-out should be pulling the telematics fuse. Unless you can audit the source code, you can't, and shouldn't, trust the software.

That might be impossible with mandatory eCall: https://en.wikipedia.org/wiki/ECall

VW do use opt-in. In fact it is so annoying that you get asked every time when you start your car. So basically every time your car start it says „do you want to use the profile connected with the vw service“ if you do not accept it than the car will be in a dumb mode. One of my coworkers was annoyed by it and „reset“ the car to use a non connected profile which does not do that.

I’m a owner of a id.4 (or rather a user of it, since my company owns it)

Reminds me of cookie banners. Annoy you into submission

(I know the EU doesn't mandate annoying cookie banners but unintended consequences etc)

actually in that case its more the other way around. its easier to drive with a profile that is not connected, you only loose the app functions like heating and knowing how much you still can drive and other things that are not 100% needed. with a not connected profile the car starts and you dont need to press an additional button to access your media stuff. so far only vw does that in the german market. everbody else uses agb's/eulas and stuff to tell you about the connection. vw is just bad when it comes to software.

The reason for all that telemetry is the legislation. How do you think they are going to implement the full “intelligent” speed assistant in 2027?

More like automated ticketing for speeding.

I’d love to see that implemented, yes, but it would be even better if all cars' speed were automatically limited to the speed limit of each road.

Dangerous as hell. Imagine there’s a runaway truck behind you and you can’t speed up to avoid or at least soften the collision because of some government enforced handicap.

It would also give local governments a power they never had before: To directly control your behavior in the moment, with no judicial control or oversight.

No, thank you.

There will always be contrived bogeyman edge cases to scare us from doing something.

The only question that matters is would it result in fewer road deaths? I bet the answer is yes.

In the US every single day 100 families are torn apart by a death on the road. I’m sure you don’t want it to be yours.

> The only question that matters is would it result in fewer road deaths?

Speed doesn’t kill, it’s the sudden stopping that does.

That’s a “think of the children” type of an argument. Remind me: how many people die because of guns every day in the US? On a serious note, how many of those road accidents are caused by exceeding the speed by less than 10%? You see, there is a difference between speeding and reckless driving.

Neither you nor me live in the US. They have other options to reduce those deaths. There’s no reason to drive a 4 ton EV truck made out of stainless steel doing 0 to 60 mph in 3 seconds.

I don’t care about this particular edge case. The idea of being remote controlled by buerocrats is appalling to me.

I live in Europe. Regulations here make Teslas slam on the brakes when the road is curved by more than x degrees, and break off a lane change apruptly if they take longer than x seconds. The intentions behind these rules written by some buerocrat in Brussels surely were as good as those behind the cookie banner.

I’m glad I still get to override those rules with my pedals and steering wheel.

Interval cameras (checking your speed over a length of road, using ANPR) are very effective at slowing traffic in the UK. Although you still get people in expensive cars driving 20mph faster than others; maybe undeterred by fines, or using false plates.

The system can tell you if there was a runaway truck (at your time and location), so an appeal should be easy for that uncommon situation.

I like that solution much better. I find that a driver should always be free to make a cost/benefit calculation. The ideal, in my view, would look something like this:

- Speed of every car on the road is recorded continuously.

- If you stay within the limit, you pay nothing. For each second that you are faster than the limit, you incur some financial penalty, where the amount is calculated based on both the speed difference and the purpose of the limit (pedestrian safety vs. noise pollution, for example). In extreme cases, you can lose your drivers license.

- Speed data is also made available to your insurance. So drivers know they won’t get away with somebody else paying for any damage they may cause.

As a driver, I very much prefer this not to exist. But I think it would be the right thing from a “veil of ignorance” perspective of justice.

That "should" is doing a lot of work, and it is not always easy to convince a bureaucratic system that it has made a mistake.

Knowing exactly which lane you're in and the actual speed limit of that particular lane can be tricky for an automated system, at least in any of the systems I've seen implemented.

I've had cars with both automated speed limit sign readers, GPS+map databases, and more show me two different speed limits and neither one was actually correct for the lane I was in. This is a somewhat common occurrence on the highways around me.

As long as it’s accurate. The current technical implementation is a joke. The car has no idea what the speed limit is.

A few examples:

1) drive past the end of town sign in a particular German town, the car thinks it is 30kph, but only during the day because at night it doesn’t see the sign so it thinks it’s 50 where in reality it’s a 100 until the next speed limit,

2) driving between a couple of roundabouts inside of a town in the Netherlands, the car thinks it’s 30kph even though we stay within city limits and there’s no sign so the speed limit remains 50kph,

3) this is the funniest one so far… driving in Antwerpen along the Turhoutsebaan, there’s a massive 30 sign painted on a red painted road surface, the car insists that the speed limit is 50kph.

Those are just three out of a dozen examples happening consistently within 30 square kilometres I normally remain within. And I drive this car for 2.5 weeks. I have seen the future and I don’t like it. Number 2) happens routinely inside of the city limits after right or left turn. Car drops the speed limit to 30 just to realise a 100m down the road that it is 50.

Apologies for the ad hominem, I normally stay away from such tone. I genuinely hope that such pseudo cops like you get a grip. Because it’s my life you’re talking about and I already use speed limiter routinely. Every idiot around me on the road has exactly the same choice as me: curb the ego down and slow down or behave like a douche.

> but it would be even better if all cars' speed were automatically limited to the speed limit of each road

Yeah, you just described the ISA of 2027. This is going to be a tough year for car manufacturers. I forecast a ton of unsold new cars remaining on parking lots because one has to be really technically illiterate to buy something so dangerous willingly. Either full self driving or give full control. Everything in between is a disaster waiting to happen.

By the way, here’s a funny thought. So what is going to happen when that mythical zero casualties is reached and more people will be dying on bicycles than in car accidents? An implant in the brain? Where does it stop?

> So what is going to happen when that mythical zero casualties is reached and more people will be dying on bicycles than in car accidents?

I don't think anything will need to happen at that point. We wouldn't need to tackle down the top causes of death if the numbers were low, as seems to be the case of bicycle deaths not caused by cars. And when it comes to speeding, it's already against the law, so the technology is only trying to help prevent it. But of course, my enthusiasm is tied to a future where this technology works reliably, so I don't really expect anything like it with all the problems you're describing with current models.

The problem is that it doesn’t matter what you think, or what I think. What matters is what the bureaucrat in Brussels thinks. The bureaucrat doesn’t care. They are driven everywhere and fly on their private jets.

It’s also illegal to participate in the traffic drunk yet I routinely see drunk people riding bicycles and scooters in regular traffic, often ignoring traffic lights, often with their face glued to a phone. That’s half a problem, the other problem is those same people with those same things on the sidewalk. I bet you, a ton of those people do not even have a driving license and/or understanding of traffic rules. Humans will be humans. First they cry for cycling paths, when they get them, they don’t use them. Cannot win stupid.

As a pedestrian in the city I want scooters and bicycles regulated AND enforced. But nobody cares. I stopped counting how many times I have to do acrobatics to walk around scooters and bicycles left in the middle of the sidewalk.

That would risk unintended consequences. For example, suddenly slowing cars on the highway down to 30 kph because a small road with that speed limit runs right next to the highway.

This becomes a thing and I'll have a 25mph sign hanging off the back of my truck. I eagerly await starting a youtube channel of new cars losing their shit on jammed tailgating attempts.

Or in Germany, if you live in the village, put up a 60 sign by your driveway and when confronted just say someone is having their 60th birthday… Germans for whatever reason like putting up a speed limit signs by their driveway when celebrating birthdays.

Earlier today my car thought I was on a 10mph road, I was in a 60

Earlier it said I was on a 30mph road despite being on a 20mph road

This summer Apple Maps believed I teleported 200m into a corn field for long enough it told me to return to the route. The location kept updating, moving in parallel to my real location.

What is the speed limit in that field?

Would a car suffer from similar problems? Should it continue at the original rate of speed or slam the brakes?

I had that a couple of months ago. Phone was fine when not connected to car play, location bang on. Soon as I plugged it in it moved my location.

Did the same with two other phones. Car play takes the location from the car rather than the phone.

An onboard database and a GPS receiver?

So we can tamper with it? :)

You have physical control so you can tamper with anything.

Plus full name, address, email?

Huge privacy violation. I would just close down this business. Unfortunately it's a state cartel, and even part owner. They'll change the constitution to save those criminals

Huh? Why would a speed limiter need anything other than current position and a database of speed limits?

Your license plate already has your name and address associated with it.

Nah, make it illegal to collect any kind of identifiable data in the first place.

It already is and this will go to EU courts.

Opt in you mean, like the cookie banners?

Oh no that'll never happen because VW are a European company and the money is in fining US tech companies!

European companies get fined the same as any other companies.

Well within the constraints they set out which exclude a hell of a lot of European companies.

(I am in Europe for reference, this is not an external perspective)

What constraints? And which companies are excluded by them?

https://www.enforcementtracker.com/?insights shows breakdown by country, type, industry sector. "Highest fines: individual" top 10 list is all international companies (Meta, Amazon, TikTok, LinkedIn, Uber) and those make the news. Smaller European companies hardly make the news.

VW paid "$14.7 billion to settle civil charges in the United States" and was ordered "to pay a $2.8 billion criminal fine for 'rigging diesel-powered vehicles to cheat on government emissions tests'."

https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal

"Seems low" and "cost of doing business" - paraphrasing any thread about US company. Could also says "VW should be sued out of existence".

Also I genuinely think those fines were low.

The fact that it did not seem to stunt their growth speaks for itself:

https://www.macrotrends.net/stocks/charts/VWAGY/volkswagen-a...