this post was submitted on 23 Jun 2026
520 points (97.6% liked)
Technology
85695 readers
4559 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
The title makes it sound intentional. The reality is because they added a security feature that verifies the integrity of the OS. Only to make it work on other OS they have to manually add it, but the number of users is so small that they don't even think about it. This was Google's intention when adding it.
Why does my car needs to verify the integrity of my phone OS? Why does my car cares? It is not like my car is using my phone to make money transfer between banks or managing third party medical information no? Why do you need a safe OS to start the AC on my car?
Because the app on your phone has the ability to unlock, start, open, etc. the vehicle.
So? What is the problem? It is not unsafe to start a car. Could you blame VW if the car started because of unsafe software on your phone? Is there really a risk of malicious actors targeting car apps to start random cars?
The problem is theft...?
So you have hackers mass compromising rooted android os around the world hoping for an overlap with Volkswagen users with the app, so that they can hack the app to unlock a car hopefully located near them instead of just opening the first car you find with a suction cup on the glass.
Ok, got it
Not necessary. You only need to compromise one. Any one without some sort of integrity service. And it ain't that hard. Pick one of many with poor security practices.
You cannot start a car with a suction cup.
I can't start my car with my car's app either.
If you really want to be picky about it, block out the unlock feature and any potential 'phone as key' functionality. Leave starting the air conditioning and information.
...okay? I can. What is that supposed to mean here?
So you want them to break the app, rather than just securing it?
It means that if you are so obsessed with protecting a user from making an informed decision about their own security, then you could gracefully degrade in your 'horribly insecure context' instead of just bombing out completely.
This has absolutely nothing to do with "informed decisions"?
Ok, I am the hacker from France that compromise the golf in Florida. Now what? Do I start the engine to pre-condition the car from across the ocean? You know you cannot even drive with the app, just start the engine… There is no reason at all for going all the way and doing this. None.
It's a question of security risk profiles.
Security ultimately often times comes with a tradeoff for user experience or privacy.
How does device integrity checks materially affect the security posture for theft when considering this system? Presumably the security checks for remotely unlocking a car is based around credentials and authN/authZ for the unlock service call?
Enforcing client side security has entered the picture recently, but a lot of it comes from security checklists from people saying did you add this check? Sure adding a device integrity check may stop at least one malicious actor, but is it worth the cost? To most companies, they're going to say they don't understand or care about the impact.
They could just go back to key fobs since those can't run arbitrary code.
No one cares about privacy.