Readit News logoReadit News
dantillberg · a year ago
Last year, I submitted a "right to know" request to Subaru, and they sent the following back. I've reformatted it for legibility. Basically asserts they'll do and sell whatever they want (except another car to me).

> Subaru may collect the following personal information about a consumer:

> Categories of personal information:

> Identifiers: Consumer records, Commercial information, Internet or Other Electronic Network Activity, Audio recordings, Vehicle geolocation, Professional or employee-related information, Inferences, Sensitive personal information

> Categories of sources from which the personal information is collected: Retailers, i.e. authorized Subaru dealerships , Provided by consumer or vehicle, Third parties

> Business or commercial purpose for which Subaru collects or sells personal information: To provide services to the consumer, To market goods and services to consumers, To provide marketing by third parties for third party goods and/or services, To comply with legal obligation

> Categories of third parties with whom the personal information is shared: Business service providers, Contractors, Retailers, Corporate parent and affiliates, Third party providers of goods and/or services, Entities required to comply with the law

> Categories of personal information sold: Identifiers for third party marketing of goods or services., Consumer records for third party marketing of goods or services

> Categories of personal information disclosed for business purpose: Identifiers are disclosed to service providers, contractors, and third parties., Consumer records are disclosed to service providers, contractors, and third parties., Commercial information is disclosed to service providers, contractors, and third parties., Internet or other electronic information is disclosed to service providers, contractors, and third parties., Vehicle geolocation is disclosed to service providers., Inferences are disclosed to service providers and contractors., Sensitive personal information is disclosed to service providers and contractors.

Propelloni · a year ago
This is pretty well known and true for almost all car manufacturers. A few years ago there was a small upset about this [1]. My Opel (a Stellantis brand) happily shows me a message that it is now sharing my location data and that I can change that by pressing the message now -- while I drive. It never shows the message when the car is not moving. I lavishly spread a blanket of Hanlon's Razor over this.

[1] https://foundation.mozilla.org/en/privacynotincluded/article...

Melatonic · a year ago
Good to know

Seems pretty blanket wide legalese. The part about audio recordings seems a bit troublesome however

cmgbhm · a year ago
The non troublesome use-case is clicking the starlink button and taking to their support.

Having bought a Subaru, I really tried to see where the consent is in the process. In my case, I think it’s the account establishment process that the dealer did.

GJim · a year ago
But not in the UK or EU.

Need I say which law protects us..... the one a significant number of HN readers (a technical news site!) appear to remain in shocking ignorance of?

robertlagrant · a year ago
You can do this in the UK or EU if you like; you just need to have permission to do so from the data subject.
mavdi · a year ago
Not surprised. I've had a few interactions with Subaru connected services dev team as an external contractor from another car company, everyone was everyone else's cousin, friend, homeboy from India. Nepotism was rampant, no one wanted to listen to advice, a strong culture of corporate antibodies had formed. I'm surprised they even got it to work at this level.
duxup · a year ago
I love my Subaru as far as reliability, all wheel drive performance in snow and ice, and such.

But OMG it's consumer tech was dated when I bough it, and it's just full of inexplicable issues and caveats and such. Even just the limitations and the UX issues are so obvious that it sends a message that if they tried to fix them they would introduce just as many new issues. I'm at the point where despite the car being good, I'm not interested in a new one from Subaru.

I just want carplay or android auto whatever similar services a given mobile OS provides to do similar things. That's it, every time it's something else (even when offering car play) from a car maker it is so bad and so naively built that it makes me less confidant in that company.

I know, they want my data and all and that's the motivation, but man it's just such a downer with every system.... and here I am with a good car in most respects and I'm not planning on buying from them again.

numpad0 · a year ago
I suspect it has to do with slow adoption of CarPlay/Android Auto in Japan - everyone still options aftermarket infotainment at dealerships and happier about it than with phone-based experiences. From a random Google search result[1]:

  > More than three-fourths (79%) cite the built-in navigation system. However, this percentage has decreased from 81% in 2022 and 82% in 2021. Use of Android Auto/Apple CarPlay apps is increasingly the preferred system, with 7% of users citing this in 2023, compared with 5% in 2022 and 3% in 2021. 
That's like 80% CP/AA adoption by 2060.

UI/UX and especially overall experience polish had always been a major challenge for Japanese engineering. Everything is committee designed in perpetual intra-company tug of war, and it shows as a "family sized mega pack" UI consists of bunch of snippet codes each with an attention grab dialog to prove its worth. That was clearly one of major causes that led to total collapse of domestic phone industry and iPhone dominance, but I suppose it hasn't affected car infotainment, or mass market cars in general.

1: https://japan.jdpower.com/sites/japan/files/file/2023-11/202...

scottbez1 · a year ago
Hmm this is really different than my experience with a 2018 Crosstrek, so maybe things have changed? When I bought it, Subaru was among the earlier CarPlay/Android Auto adopters (we specifically ruled out a new model year Prius because it lacked it and we couldn't wait a year to replace our totaled car just for CarPlay/AA), and other than a very rare issue where the head unit screen doesn't turn on, it's been pretty rock solid with both phone OSes.

Environmental controls are all physical hardware, CarPlay/AA is integrated well, etc; I can't really complain about any UX in the car.

The only UX gripe I can think of is that Apple doesn't let you use natural touch inputs to pan/zoom a map (instead forcing you to tap to bring up on-screen d-pad, then keep tapping the tiny button targets while trying to keep an eye on the road), but that's entirely on Apple; Android Auto allows normal 2 finger pan/zoom, so it's not a Subaru problem.

ajsnigrutin · a year ago
yep...

there was a tv ad for subaru vehicles a couple of years ago (not that long!), and during the ad, they showed the infotainment system, where the user pans the map on the navigation touchscreen, and the map moves at maybe 1fps! in an ad!

I kinda wish they standardized the car interface for tablets (like android auto, but more features), where you could just buy a tablet and insert it in (like din slots for radio, but tablet-sized), and the car would expose some non-critical interfaces to the tablet (AC,...), and you could just buy a replacement tablet if needed. Cars are made to last 10, 15, even more years, while the computers/entertainment devices move a lot faster, and that includes the connectivity (many cars on the streets today were made before 4g, and 3g is mostly dead).

blackeyeblitzar · a year ago
Subaru infotainment is also very controlling. Want to use the keypad while you’re taking a phone call on the go? No, it won’t let you if the car is moving. You’ll need to use your phone’s UI. Other CarPlay cars don’t do this.
Melatonic · a year ago
I purposesly bought the last Subaru without Carplay/Android Auto for this reason - I could upgrade my head unit but I like the slightly more oldschool one.

The touchscreen is slow to respond and has few options and the only way to really connect a phone is bluetooth or 3.5mm . It really just does music and calls. However long term I was a lot more confident in phones supporting backwards compatiblity for bluetooth vs Subaru keeping carplay/android auto up to date - and I plan to keep this thing for a very long time

yesiamyourdad · a year ago
I loved mine until the transmission blew out at 96,000 miles. Could be a one-off, but then a friend bought a used one with 108,000 miles, and the dealer proudly noted that it had a new transmission just installed. I think that vaunted reliability is gone.

That aside, the one thing I haven't liked is the electronics. Many times it gets out of sync with the phone and simply can't connect, the only fix is to shut the car off, open the door so the stereo shuts off, then restart the car. The FM radio also quit working at one point, which I didn't really care about, but the dealer applied a software update and it started working again. That's just the visible stuff though, so much of the car is software controlled now, I think you have to start taking any software issues as a warning about the overall car.

ellisd · a year ago
Subaru's in-vehicle entertainment technology has long been criticized, even before features like CarPlay became standard. Take my 2012 WRX, for example—its Bluetooth reception was the worst I've ever experienced in a Bluetooth-equipped vehicle. Audio feeds would randomly pop and drop out during podcasts, even when the phone was within a two-foot radius of the deck.

Over the years, I tried multiple iOS and Android phones, but nothing improved the situation. Ultimately, the only solution was a complete deck replacement. Now, I’m using a "Joying" Android head unit with a rip-off version of CarPlay, which has finally resolved these issues.

spelunker · a year ago
I have a car from another Japanese manufacturer (Mazda) - their connected services app is weird and clunky and was down twice this month. And I'm expected to pay $10/month for this thing after the first year! Cmon.

Dead Comment

netsharc · a year ago
Hah, them being able to bypass the 2FA by commenting-out the line:

$('#securityQuestionModal').modal('show');

is... mind-boggingly stupid of whoever got the job to write that Starlink web-app.

OTOH, the hacker hijacked a Starlink employee's account to get in, isn't that over the line in terms of "ethical hacking"/legality standpoint?

Mountain_Skies · a year ago
Back when I used to do AppSec, these types of issues were extremely common. Software developers and their managers would argue endlessly about them not being real vulnerabilities, which meant I had to put together a proof of exploitability. And since these were interdepartmental fights, office politics get involved. Just one of the dozen or so reasons why I stopped doing AppSec and went back to development.
_joel · a year ago
That seems like a culture issue rather than an appsec issue?
amatecha · a year ago
I was about to say exactly this. This is like REALLY BASIC stuff in designing web services. The fact you can reset the password with a single HTTP POST is mind-boggling, bypassing the 2FA by hiding a <div> is mind-boggling. Like, completely negligent. (btw they took over a Subaru employee account, not Starlink)
preisschild · a year ago
Or not requiring ANYTHING to authenticate in your forgetPassword endpoint, but being able to set a new password directly instead of sending a randomly generated per email / send a one time token to reset the password yourself via email
xp84 · a year ago
To me that sounds exactly like what I would expect from some of the junior developers I’ve met in recent years. Most of the business logic in JavaScript. Poor modeling of a client-server relationship, and no consideration of which parts of the system can be trusted. The design was based on the non-technical requirements doc or the mockups, and an inexperienced front-end developer asked the inexperienced backend guy (or maybe they’re the same person) for an endpoint, and for the inputs, he mapped directly the fields in the form.

Thankfully, even AI writes better code than this, so as this type of developer quickly becomes unemployable over the next few years, I think we’ll see a temporary increase in code quality.

Deleted Comment

insane_dreamer · a year ago
This one was especially egregious.
bean-weevil · a year ago
It may well be over the line, but it sounds like subaru is grateful for the report, so nothing will come of it. Definitely not a risk I would take.
anentropic · a year ago
It's like they had no idea of how 2FA is supposed to work apart from what it looks like as a user

Deleted Comment

mattsimpson · a year ago
This is exactly what I came here to say as well. Whoever wrote this fundamentally just doesn't get it.

This whole thing is honestly what I've suspected/expected owning this car, but it's somehow still surprising to see. My guess is no car company does this really well right now, and makes me want to drive a 1998 Acura Integra instead.

_joel · a year ago
Glad they had unit and integration tests to make sure that an unauthenticated user couldn't reset passwo... oh, wait...
wil421 · a year ago
I used my chrome inspector to edit a read only field in Jira. Surprisingly I was able to edit it and submit the change. It complete fucked up whatever protect we were about to use and we had to start over. The JIRA admins were scratching their heads.
joking · a year ago
Thats by design, you can’t trust the client, everything has to be checked server side.
bilekas · a year ago
> I didn’t realize this data was being collected, but it seemed that we had agreed to the STARLINK enrollment when we purchased it.

This is mind blowing to me.. Number 1 why you need a car connected to the internet all the time ? And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.

dv_dt · a year ago
There was a recent HN posting on the US banning Chinese car brands from being connected to the internet. https://news.ycombinator.com/item?id=42706212

If Chinese companies comply with the ban by providing car models without internet connectivity, it's hilarious to me that that the nationalist regulation could make Chinese branded vehicles more desirable from a security & privacy standpoint.

reaperman · a year ago
The current 100% tariff on Chinese EV’s will negate that advantage for American consumers.
jeroenhd · a year ago
> Number 1 why you need a car connected to the internet all the time

To open the car with an app (programming against Bluetooth is harder than calling a web API), or honk the horn if you lost it in a large parking lot.

> And how you're not required to sign at least 10 forms to confirm you understand that ALL of your travel data will be recorded and distributed at will.

Legally speaking, I believe that depends on your local privacy laws. Practically speaking, car makers (and government agencies) love these features for troubleshooting and tech support, or for flagging crashes before any authorities or local press have time to arrive (think Tesla).

Don't ask them about finding your stolen car, though. Then the data may suddenly not be available.

bilekas · a year ago
> To open the car with an app (programming against Bluetooth is harder than calling a web API), or honk the horn if you lost it in a large parking lot

I really hope this was sarcastic. How did we ever manage to find our cars before IoT cars …

beezle · a year ago
Just as an aside - a friend had their car nicked in NYC this winter. He was able to tell the cops the car location from some Toyota find my car type thing. The cops said they saw nothing on the street so unless he could come and make the horn beep infront of a garage - and then get a warrant - there was nothing more to do.

He now has a new vehicle.

reaperducer · a year ago
honk the horn if you lost it in a large parking lot.

Solved problem since at least the late 1980's. No internet required.

afh1 · a year ago
All cars in Europe must be connected to the internet at all times by law, to determine their location, in case of an accident the law states.

https://europa.eu/youreurope/citizens/travel/security-and-em...

In the US a bill was passed requiring driver impairment equipment on all vehicles and automatic deactivation of the vehicle if the driver is determined to be impaired. Current impairment technology monitors head and eye movement and/or blood or breath.

https://apnews.com/article/fact-checking-402773429497

hulium · a year ago
> All cars in Europe must be connected to the internet at all times by law, to determine their location

The source you link very explicitly contradicts that:

> Your eCall system is only activated if your vehicle is involved in a serious accident. The rest of the time the system remains inactive. This means that when you are simply driving your vehicle, no tracking (registering your car's position or monitoring your driving) or transmission of data takes place.

bilekas · a year ago
> All cars in Europe must be connected to the internet at all times by law, to determine their location, in case of an accident the law states.

It isn't connected to 'the internet' either, its an emergency call activation service. IE you can actuvate it to call 112 (Emergency services) when needed without a charge, infact it uses a SIM card to do so.

Infact on your link it doesn't mention 'online' or 'internet' anywhere/

Angostura · a year ago
That's a bizarre interpretation of 'cars in Europe must have a system to automnatically call emergency services when they crash/their airbags deploy'
iforgot22 · a year ago
In general, a lot of things in cars are for the law rather than the owner. I'm not saying it's a bad thing, just is what it is. Emissions is the biggest one.
insane_dreamer · a year ago
Remote start, climate etc from the app all require and always on connection (how else?). Tesla has the same thing.

I use the remote app often - quite useful.

dylan604 · a year ago
Remote start does not require an app nor an always on connection. I was able to do this with a key fob in the early 00s
n_plus_1_acc · a year ago
European eCall directive requires a sim card
devinegan · a year ago
Because it has an SOS feature.
ben7799 · a year ago
I have a 2013 Outback Limited that is basically right before all this stuff got really stupid and weird. It's a great car other than it's not very fast and it gets really bad gas mileage. Amazing in the snow. I have had it since December 2012, so I've had plenty of service visits where I got newer loaners. (I special ordered my car to basically load it but not have Starlink, not have the Sunroof, but have the leather seats and the HK upgraded stereo.)

Every time I have gotten a newer Subaru as a loaner it strikes me that they are worse cars for all this new stuff. The user interface is horrible in the new ones. In a lot of cases they have a skeumorphic interface up on the touch screen that mimics the physical controls in my car! The actual physical controls are about 100x faster to operate and you quickly learn where the buttons are without looking.

I had an Ascent Onyx loaner last summer.. the entire touch screen UI looked like it was barely operating above 10fps. Just gross. Lots of the UI is black and white as well, not even tasteful grayscale. The Onyx I had also had the upgraded HK stereo and that is not as good as the one in my car as well, it sounded noticeably worse.

The electric steering on the new Subarus is terrible as well. My old Outback is not exactly a sports car but getting out of new one back into mine it feels like you're getting into a Porsche or something when you feel the hydraulic steering. Engine/Turbo lag on a lot of the new ones is gross as well.

This is of course even worse! My car only has 120k miles on it, I plan to keep it for another 4 years and then maybe give it to my kid when he gets his license. Somehow I doubt Subaru will have a competitive vehicle by then. For me to consider another one they'd really need to have an EV Outback/Forester/Ascent or a Hybrid version that gets at least 40mpg. And they need to fix all this horrible infotainment stuff in a way that the car operates better than a kids toy and actually drives well like an older Subaru. Also they need to get off the whole stupid thing with giant rims. It's supposed to be a Subaru, it needs to have tires appropriate to going relatively fast on dirt roads.

01100011 · a year ago
I have been stranded twice because of Subaru firmware bugs which they knew about and failed to notify me. First one was the battery charging bug(which still happens even with the firmware fix, just more slowly). The second was the fuel gauge bug. This is a 2017 Outback, my second and last Subaru I'll ever own.

Regarding Starlink, there's actually a battery drain issue on older systems because the 3G modem fails to find a base station (because 3G is deprecated) and drains your battery doing retries. You can remove the Starlink module, but since the Bluetooth microphone and front speakers are routed through it, you'll lose that functionality unless you spend $80 for a dongle to restore them.

reginald78 · a year ago
We actually own two Outbacks, a 2011 and a 2019. Both my wife and I hate the touchscreen system in the 2019, it is full of irritating bugs and even the physical climate controls (which IIRC were going away for the 2020 model year) have horrible indicators of their status compared to the older one.

I'd say the backup camera is a welcome addition for the newer one but if the roads are even remotely dirty the camera almost immediately becomes totally obscured rendering it useless, which around here occurs at least half the year.

Combined with the battery drain issue I will probably not buy another one. At the most I'll give them a test drive to see if the control system has been returned to some semblance of sanity. Unfortunately all new cars seem to be privacy nightmares so I'm not sure how I'll avoid that.

ben7799 · a year ago
The 2024/2025 Ascent is what I had as a loaner that had the skeumorphic UI on the screen that looked exactly like an older Subaru's physical climate control layout.

It was a major WTF when I first saw it.

DwnVoteHoneyPot · a year ago
In addition to your comments, I think Subaru's all-wheel drive system has been switched to electrical instead of mechanical, making it worse. There are roller tests on youtube which show Subaru AWD being outperformed by Ford AWD systems.
ben7799 · a year ago
They have different AWD systems in different vehicles and for some vehicles there is more than one system depending on which transmission you purchased. (At least when there was a choice)

Mine is electrically controlled (and many Subarus are) but it's still connected full time. IME driving other electrically controlled non-full time systems what you feel in those are the electrically controlled clutch packs completely disconnect the rear wheels and the AWD is 100% disabled until the traction control system kicks in. Then you get a brief moment where the car feels out of control until the clutch activates the AWD. The tradeoff is that system that completely disconnects the rear wheels results in those vehicles (E.x. Honda/Toyota) getting much better fuel economy than Subarus as they operate as front-wheel drive almost all the time.

I have never been in any Subaru that behaved that way. And a roller test is not where it matters anyway. Roller tests are contrived. Where you feel the difference between permanent AWD and part-time AWD is medium and high speed situations where the vehicle starts to lose control. Most people will never put any family crossover/SUV into a situation anywhere close to the roller tests or hill ascent tests.

All of this seems to become completely meaningless with EVs being the future.

olyjohn · a year ago
The CVT in combination with the terrible traction control also kills any chance you have of getting out of a stuck situation. Subaru's AWD system is now mostly just marketing. So it's basically on part with most AWD systems, because most of them really are a joke.
lightedman · a year ago
" It's a great car other than it's not very fast and it gets really bad gas mileage."

My 2013 Outback Limited with rally package (wheel paddle shifters etc) gets 32 on the highway with my driving habits and almost 28 offroading. That's with larger tires and a disconnected swaybar for better articulation, everything else is stock. CVTs don't respond well to lead-footing.

winrid · a year ago
The disconnected swaybar won't impact mileage FWIW
_huayra_ · a year ago
FYI for Subaru owners, you can opt out and have your data deleted anywhere in the US (not just California): https://www.subaru.com/support/consumer-privacy.html

It'll take ~6 months or so, but they will send you a confirmation email.

jcomis · a year ago
fwiw I have done this and received no confirmation or anything after more than 6 months. I keep submitting, maybe its working, but it doesnt seem to actually result in a confirmable change.

for sure my retailer, which are 3rd parties according to that page, still has 100% access to the data, as they were able to tell my car was in another state when I called recently. seems pretty troubling

nyokodo · a year ago
> I have done this and received no confirmation or anything after more than 6 months

Sue them, make it a class action.

rozab · a year ago
It would be cool if the researcher could have tested this before reporting
_huayra_ · a year ago
I would guess that opted-out cars like mine are still "in the system", as I can still do all the MySubaru app stuff like un/lock, start, etc.
plagiarist · a year ago
I wish that keeping this much data was a liability. I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner. HIPAA for "just" PII.
neeeeeeal · a year ago
This is the way. What legitimate interest could Subaru have in maintaining this much data about their customers?
genewitch · a year ago
The most charitable guess I can make is that they use it to improve their driver assist, lane keeping, pacing, and that sort of thing.

location and g force and direction when the automated system shuts off and returns control to the driver, that sort of thing. I don't agree with it, but that would be my guess.

I own a Subaru that does this, so I'm not happy about it, but what can I do?

That's rhetorical.

TheCondor · a year ago
Are you new?

That stuff is probably more valuable than many of us want to admit. There is the maybe more noble value: training data for maps, traffic analysis AI, engineering duty cycle data, things like that. Then there are the other uses, for example various surveys and studies are needed for new roads or signal changes, can this kind of data proxy for that? We would be talking about cutting millions of dollars out of some of these projects and months or even years off a timeline. Then the ad-tech, where do you put billboards and signage? Where do you build a shop? Probably other uses we aren’t even thinking about.

ndileas · a year ago
Unfortunately, selling it to repo men is a widely accepted practice.
mschuster91 · a year ago
The same thing all car manufacturers are after... AI. And I'm not joking this time.

Cars have become a commodity, especially since China made their first vehicles that didn't get outright banned in Europe for being too unsafe to be roadworthy, and even some nominally "entry level" cars have more horsepower under the hood than a 1990s 7-series BMW (138 kW). Strict requirements on emissions, fuel consumption and crash safety have all but eliminated differences in optics (the amount of shapes is finite). So the only thing left to differentiate other than build quality (where China is rapidly catching up) is assistance systems... and there, AI is the hot craze, and AI only works when it has insane amounts of data to gobble up.

Shocka1 · a year ago
The well known Japanese manufacturer I used to work for sold the data. Why else?
inetknght · a year ago
> I want companies to be liable for damages in the millions of dollars if they share an entire year's worth of location data without express permission from the vehicle owner.

Moreover, not just millions of dollars in aggregate, but millions of dollars per individual customer whose privacy was violated.

TheJoeMan · a year ago
If I collected this much information about a single individual, I would go to jail for stalking. But with the wonders of technology, I can stalk "at scale"!
coldpie · a year ago
The best case scenario for the next 5-10 years is that there will be no new federal privacy regulations. More likely, privacy regulations will be even further relaxed and customers will have even less recourse for violations.

You might have some luck pursuing this at the state level if you're lucky enough to live in a handful of states such as California or Minnesota.

plagiarist · a year ago
I wish you weren't correct. It is more likely some sort of federal regulation undoes protections such as CCPA.
stuff4ben · a year ago
As a DevSecOps/SRE whatever, I just gotta give props to the Subaru team for getting it patched within 24 hours. While it's just a small internal admin dashboard without real customer usage, the fact they acknowledged and fixed the issue so quickly speaks well of at least that part of Subaru IT.