Mozilla flunks 25 major car brands for data privacy fails
Mozilla flunks 25 major car brands for data privacy fails
Does your vehicle really need to know about your bedroom antics?
...and the related Mozilla report
Nissan apparently collects "Sensitive personal information, including driver's license number, national or state identification number, citizenship status, immigration status, race, national origin, religious or philosophical beliefs, sexual orientation, sexual activity, precise geolocation, health diagnosis data, and genetic information."
I guess Subaru don't need telemetry to guess your sexual orientation.
Lesbian Hardcoded.
Lol
Seats moving up and down on bumpy road.
Car sensor : sexual activity in progress.
If a car is advertised as smart or connected, there's a good chance it collects too much personal information.
That's too bad because most new cars are, and it may cause some people to keep their old polluting but privacy-friendly car longer.
Really goes for almost everything. I don't want my machines and appliances to be 'smart' and 'connected'. I just want them to do the thing I use them for, that's it.
All new cars - Bruce Schneier wrote in cryptogram that he tried to buy a new car without a permanent internet connection to the manufacturer and it wasn't possible.
I'm probably never buying a car newer than the one I have. Everything is so ridiculous now. Though if I can just physically disable the WAN communication it uses I guess that's fine too, though it would likely be expensive to get working again for resale.
It bothers me enough that my car is even capable of doing any kind of steering input I didn't give it myself, brakes are by wire too, but fully depressing the pedal still connects you to the hydraulics directly so kind of a non issue, it allows for AEB which is a good safety feature though I'll likely never trip it.
My current car I think can do some kind of connection but I disabled it in the firmware when I flashed the BCM. Not missed, did nothing of benefit to me afaik.
Physically disabling WAN can be a workaround, assuming is can be done and reverse without damage. But it's not a good solution.
Manufacturers have ways to degrade experience/features when the owner physically disable WAN: deny features and security updates (by doing OTA updates only), drag their feet or void warranty if WAN is disabled, design some features to be unnecessarily dependant on some cloud/online services (eg navigation, media features, ...).
Thanks a lot for your post ! The future of cars looks grim.
Serious and naive question: how could I get rid of the tracking at the hardware level when I will have no choice other than to buy a connected car?
Is there an antenna or a SIM card somewhere that I could disconnect/remove? Would the car continue to work if the connection to the manufacturer's server is lost?No idea, but for starters say goodbye to navigation, it likely uses an internet connection
Built-in nav is trash, anyway. I’ve always used my phone.
For recent cars I am afraid you are right. My current and "old" car has a built in navigation system with the map on an SD-card. No need for a connection to a smartphone - which I do not own. Therefore I suppose it is not communicating with the manufacturer.
Then, someone in my family with a more recent car got several "firmware updates" out of the blue, hinting to a 'permanent' connection to the manufacturer.
I have the feeling we need to start organizing and claim a "right to disconnection". Having the car dial for help after a crash is one thing but what Mozilla's report describes is at another, much higher level.
I can't speak for the more modern cars, but my 2019 corolla had a cell phone connection which could be cut by pulling a single fuse. Idunno if it's a universal name, but it was called the DCM module. The emergency button in the roof was wired through it, and so was one of the right speakers and the built-in microphone. None of them work with the fuse removed. I'll route the speaker and mic wires around it at some point by going through the glove box, but it hasn't been a priority for me.
I'm happy i did that too. Apparently toyota is still leaking the location history of a bunch of their cars and i'd hate to see that get abused.
Cars are built in modules, so there is definitely something you could disconnect to prevent it phoning home. You might need to take the dashboard apart though.
There is nothing preventing the car from starting and running without it. As long as you have a key fob it will attempt to start.
Thanks! Knowing that what I might be searching for would be somewhere under the dashboard is a good first step.
Then I am not an engineer nor have any experience in electronics BUT I know from my dad that taking the dashboard apart is not an easy task. If I would succeed I do not know what I would be looking for… Would tan antenna look like a piece of wire? Or could it be embedded in the 'copper' circuitry of a PCB? Do cars use regular SIM cards like the ones found in phones or would they look different?
The maintenance manual would probably be a good place to start before trying to put anything apart.
+1, I’d really like to know the answer to this too.
Tangentially related: I have a 2022 Subaru, I used to have a 2021 Subaru. Subaru has a mobile app where I can start the car, locate it, unlock the doors, etc. When I traded in the 2021, it never removed it from my app. I’m able to see where the car is parked, and presumably start it, open the doors, whatever.
I tried contacting Subaru, I looked for a bug reporting or bug bounty but couldn’t find one anywhere. All I could find was instructions to remove the car off of my app. I view this as a huge privacy breach, it shouldn’t be my responsibility to remove the previous owners info from the app.
maybe its just me, but as useful and nice to know as this is, I really want Mozilla to focus their efforts on making a good browser, not to spend money doing everything but that.
There are a lot of anti-features (studies, pocket, telemetry, "sponsored suggestions", etc..) that are justified in "we have to make money somehow" but then they spend it on this stuff.
[edited for clarity]
This particular issue is important enough that I'm glad they did it. We needed somebody to do it, and if that means a tiny bit of funding was diverted from browser work, I think it was more than worth it.
(Also, the Mozilla Foundation is not the same as the Mozilla Corporation.)
asking you to do things no reasonable person would ever do -- like reciting a 9,461-word privacy policy to everyone who opens your car’s doors.
If this is what they say we agree by tapping that license button, how about they put this on their TV ads?
We desperately need laws to regulate these kinds of privacy policies/user agreements. The VAST majority are way too long and complicated for a normal person to actually understand, let alone read. We need to limit what companies can/can't do with them instead of letting them do whatever they want to.
We also need a law that prevents them from changing the terms of service on a product someone has been using, then locking them out of it if they don't agree to the new terms.
We also need a law that prevents them from changing the terms of service on a product someone has been using, then locking them out of it if they don't agree to the new terms.
This. So, so much.
With mandatory jail time for the managers of companies who break this law, and/or fines that are guaranteed to send the stockholders howling and demanding the executives's heads on spikes. The current fines clearly aren't enough of a deterrent and just considered the normal cost of doing business.
I skimmed the article. Some manufacturers are not listed. Mazda for one.
Edit: I am unclear. Should I presume Mazda and others that are not listed are doinga good job?
In Mozilla's "Privacy not included" report, Mazda isn't listed as one of the 25 car brands they tested.
Their related article goes on to state, that all of the 25 brands they tested earned the Label, which I take to mean, that by extension probably most if not every car brand has privacy flaws.
I skimmed through their privacy policy and I'm not confident Mozilla would approve. They can share the telemetry that comes from your car, including it's physical location.
I too came looking for Mazda in the report and was disappointed.
Should I presume Mazda and others that are not listed are doinga good job?
Doubtful. Absence from a list like this usually just means that the people investigating had limited resources, and therefore chose a representative sample instead of doing an exhaustive survey.
If this report gets much attention, it would be a good opportunity for any car makers that do well on privacy (if they exist) to start boldly advertising it.
I wonder if this is part of the reason Chevy dropped Android Auto and Carplay. Can't lose out on data collection.
It is, I think it's been discussed to hell and back that it was the reason.
Make sure to sign the petition at the bottom of the mozilla report.
Done
As expected, Tesla has the worst privacy rating
Second worst were these ones:
Nissan earned its second-to-last spot for collecting some of the creepiest categories of data we have ever seen. It’s worth reading the review in full, but you should know it includes your “sexual activity.” Not to be out done, Kia also mentions they can collect information about your “sex life” in their privacy policy. Oh, and six car companies say they can collect your “genetic information” or “genetic characteristics.” Yes, reading car privacy policies is a scary endeavor.
While they're all bad, Nissan is a no for me. Also between this, the dangerous recalls, and the theft issue, Kia is falling even further down my list
Kia has the whole “getting stolen really easily” thing right now, as well…
Why does it not surprise me to see a certain elongated muskrat razing privacy policies to the floor, again