Hacker News Reader

Comment by markus_zhang | Hacker News Reader

That ssh into moving cars is really scary. I guess an engineer can do a lot in that session if he wants.

> That ssh into moving cars is really scary. I guess an engineer can do a lot in that session if he wants.

It all depends exactly what the engineer is SSHing into. A bash shell with root access? BAD. A shell with only monitoring and diagnostic tools that are cleared to use while the car is running? Probably not a problem and actually sounds both useful and the right way to do it. I'd love to be able to SSH into my car and get diagnostics.

According to the engineer who leaked that ssh thing (which was years ago) they were live patching and pushing updates to the cars over ssh. It was essentially full root. That said this was also super early in the company history, so this might have been for the roadsters more than the actual commercial cars.

Either way, that makes me think, maybe the code is still there? Oops I'm not rich enough to afford a Tesla anyway.

They're dropping the price hard. Probably one of the only nice things I'll say about Tesla is they're willing to wade in and compete on price. And that's mostly cuz Toyota or Ford are still charging too much.

With interest like this I almost feel vehicles are a burden, albeit a necessary one. Interesting that rate and price both hike.

At least they're using ssh and not some home rolled garbage. If ssh uses keys and not small passwords, it's one of the most secure methods around to get access to a machine. Unfortunately far too many companies are just rolling their own extremely flimsy and insecure VPN programs these days.

You are missing the point. Their engineers have the ability to ssh into your car. While you arr going 85mph on the freeway. That's by itself is scary af.

I get anxiety updating my bios at the best of times, I can't even imagine at speed.

I think the protocol used to access the moving vehicle is the least of the concerns here.

It definitely a near top concern. If they're doing a flimsy home spun thing then it's much more likely to be compromised. While the company being able to do this is enough to prevent me from buying a car from them, an insecure system that could be compromised means I believe the company should offer a recall on all cars. Being more secure doesn't mitigate the concerns, but it not being secure hightens them.

To be clear, neither is acceptable but it being secure is still a big issue.

I can only speak for German car companies, but their tech is incredibly secure, and multiple teams work on just making sure it is close to impossible to get access to anything digitally controlled in a car.

The thing with cars is that malicious actors usually can get physical access to it, which makes it an order of magnitude more difficult to secure. This is one of the main reasons car computers often seem so clunky.

A lot of this tech seems to consider the legitimate owner of the car doing DIY repairs as "malicious" as well, unfortunately.

I see your point, but modern cars are too complicated to allow tinkering anyway.

Besides, would you dare driving next to the guy that just installed random rom from xda?

I'm talking about simple stuff like authorizing additional keys, enabling remote lock/unlock without a stupid subscription, etc.

The rom on the car is way less of a concern to me than whatever the person had to drink or their road rage fueled tailgating...

Reply on news.ycombinator.com