Submitted via IRC for SoyCow4408
Last December, Ashley Sehatti sold her 2015 Jetta back to a local Volkswagen dealership in California. So when the calendar turned over, she didn't understand why she was still getting sent monthly reports about the car's health. After another one came in April, she finally logged on to VW's online portal for Car-Net, the telematics system that runs in many of the company's modern cars.
To her surprise, Sehatti saw the location of her old Jetta on a map, up-to-date mileage, and the status of the car's locks and lights. It had been resold, and yet she still had access to some of the car's systems. "There was nothing in place to stop me from accessing the full UI," she says over email.
What Sehatti hadn't realized is that Volkswagen puts the burden of disabling access to Car-Net squarely on the customer in its terms of service agreement when they decide to sell or exchange a car — even if the car is going back to a VW dealer.
Source: https://www.theverge.com/2018/5/4/17303644/volkswagen-car-net-security-location-access
(Score: 2, Interesting) by requerdanos on Monday May 07 2018, @05:17PM (5 children)
I anticipated such an objection, but didn't expect to actually see it!
The buyer, whether a dealer or an individual or an alien race, can look and see whether there are missing items. This is fine as far as items that are missing go.
There is a surrepetitious class of things to keep, however, whose absence of transfer is not obvious. They are "keys", whether physical or electronic.
Either a set of keys is passed on along with the vehicle, or the vehicle is sold without them in the knowledge that new keys will need to be cut. Either way, an honest, helpful person will not have secretly kept a means of access to the vehicle--physical or electronic--in order to stalk the buyer and access the vehicle later.
There is not a way to examine the vehicle, as you so carefully did with your roof, seats, radio, and wheels, to see whether you are being stalked.
That's the difference between spare keys (physical or electronic) and unique physical components of the machinery.
The dealer, because of the nature of reality, can't check whether you have made spare physical keys for stalking purposes.
The dealer, because of policies respecting your privacy, can't check whether you kept electronic access to the vehicle via stalk-my-car.com.
Perhaps society will decide that every car dealer should be able to access our online accounts, just to make sure. I sure hope not.
Make sense?
(Score: 1, Touché) by Anonymous Coward on Monday May 07 2018, @05:25PM
No
(Score: 3, Insightful) by bob_super on Monday May 07 2018, @05:46PM (1 child)
It would make sense if you sold the car through Joe Dirt Lot.
An Official Dealer should send a service termination notice to the factory upon buying a car. After all, they typically set up the car to give the next buyer one to three months of free service, hoping to get them hooked into monthly payments.
(Score: 3, Insightful) by requerdanos on Monday May 07 2018, @06:32PM
I see the beginnings of something that would help here--The official dealer sending notice to VW that a VW was bought at the dealership level.
And then VW sending notice to Verizon (who operates the online service in question).
And then Verizon does something useful with the information like cancel the account and refund any unused service period.
This would solve the problem neatly.
Of course, that works towards commonsense ends, not financial ones. Financially, I bet the balance sheet would look quite a bit better if they keep quietly, if maliciously, charging the people--forgetters and stalkers alike--who are paying for a service for a car they don't even own. As seems to have been the case here.
(Score: 2) by Grishnakh on Monday May 07 2018, @06:36PM
I'm sorry, but IMO the blame lies entirely with the manufacturer and the dealer. They should be ensuring that prior owners no longer have access to the vehicle.
For the keys, they should be reprogramming them all, and the car, so that only the keys being given to the new owner actually work with the car, and that old keys do not. I'm pretty sure some modern cars will actually show you on the car's computer which keys are programmed to work with the car, and allow you (or the dealer maybe) to disable certain ones. This should be standard operating procedure.
Same goes for any online access. The dealer should be making sure that old owners can't access the car, and the manufacturer should be designing the vehicle so that this is possible and directing the dealers on how to do it.
This is all basic security here, not rocket science.
It's no different than selling a house, and the new buyer changing the locks. With older cars, the same could be done. We usually leave this to the buyer, but for modern cars this isn't really as feasible (might require special service tools), so this should be something that the dealer is responsible for.
(Score: 0) by Anonymous Coward on Monday May 07 2018, @06:38PM
If a car has electronic keys, which all cars do nowadays, the dealer can reset the codes when they get the car back. So no, if you "accidentally" keep the electronic key to your old car, it won't work unless the dealer is negligent.