Typing a password slows you down, so now you’ll need to enter a 2fa and a password. Fucking brilliant!
Just another reason not to use the app I already don’t use
Wow, look at that whole heap of why modern cars can fuck all the way off.
That seems like an idiot took the copy for two competing internal opinions and pasted them without understanding.
Demanding you to use 2FA? Should be standard in this day and age.
As long as session cookie lasts for, dunno, months. Extended automatically.
Mandating 2FA for every fucking time you use the app, and only using email for 2FA? Special place in Hell. (I’m looking at you McDonald’s)
(Could be worse. Could be SMS 2FA.)
Also, being able to manipulate the operation of the vehicle remotely or it announcing its own location at all times doesn’t exactly scream ‘security’ (or privacy) to me.
Oh boy are you gonna be disappointed with every vehicle manufactured in the last decade
I am :(
My car is only recent enough to have Bluetooth. I’m really dreading the day I have to get something newer. I love being able to just turn a knob to adjust the temperature or volume
I have a 2025 Toyota and it has buttons and knobs for both volume and climate control. They do have an app but it requires a subscription fee to use any of those features and I don’t have any need for it. At most I’ll use remote start but I can do that with my key fob.
If there’s an app that can access that, it means there is a connection between your car and their servers, at least, and an ID tied to you that was set up when you purchased the car.
Most definitely. I was just referring to the car still having physical buttons and knobs. Not everyone has switched to touchscreen control for everything, which is something I cannot stand as well.
Literally why I keep driving only old cars.
Yes, to a degree mere words cannot accurately convey.
Our 2yo Crosstrek has no starlink. No LTE. No wifi. Is it leaking our location via tachyons?
Oh, it still has a cellular module, you just don’t get to benefit from it.
https://www.torquenews.com/1084/subaru-now-involved-vehicle-data-collection-lawsuit-investigation
It likely does have a 4g connection just one you’re not also allowed to piggyback on since you didnt get the higher trim or add-on package which changes a single bit in the firmware from a 0 to 1 allowing you to use it too.
As a rule of thumb, if your car model is approved for sale in the EU after 2017, it most likely has tracking in it. And post-2021, it almost definitely has it.
Sure, it’s possible that they have a different model specifically for the non-EU market, but they still usually have the same modules installed… your data is valuable, especially in countries where they don’t need to care as much about privacy laws.
Amazon sidewalk?
I think it might be a bit overkill to require a login to start your car.
I feel like whoever screenshotted this cropped a following paragraph telling users to use passkeys… That’s the only way this would make sense
Ah yes, the third kind of evil.
Passkeys can be kinda nifty. Restrictions on what is accepted as a valid device for passkeys and that sort of issues suck though.
You’re ridiculous
Im not convinced. Considering my first examples of seeing passkeys were from Microsoft and Meta trying to force feed them to me just like they do with their AI, I’m in the camp of believing there’s a more nefarious purpose behind them until completely proven otherwise. These companies are completely allergic to altruistic motives especially when it’s something being pushed this hard.
i barely see the point of passkeys anyways, you can do 90% the same thing with a password manager which 1) keeps your credentials under your own control, and 2) adds another layer of security by encrypting your list of “passkeys” (i.e. very long passwords).
It is for passkey
That’s the only way this would make sense
Like, as fud to sell the walled garden? Yeah, that’s pretty common recently.
“My tea is cold”
“Have you learned about our Lord and Savior passkeys?”
In exchange for being able to check what the charge is on our car - basically, whether it’s time to leave coffee shop - I get one of the most information-stealing, asks too-many-privileges apps on my phone. And it’s quite hard to do without it with an electric car. Looking at you, Ford, although I understand all manufacturers do the same.
MFAA and a password in exchange for eg. an OAuth token so that you can manage the devices on your account, and then use your phone’s usual security to control access to the app, would be one thing. But this looks more like the security team has made some demands, and the developers have implemented it in the laziest, MVP-compliant, way that they can.
I get one of the most information-stealing, asks too-many-privileges apps on my phone
Ford’s app doesn’t actually require ANY permissions other than network access to do what you said. It doesn’t even require Nearby Devices to lock/unlock the car, nor start climate, set departure times, etc. Their app is actually pretty non-intrusive.
…this is thanks to the fact that the car’s onboard modem is so “cloud connected” instead, so it’s even more difficult to avoid telemetries! So cool, right?
This is also why I will always make sure I have a physical keyfob if I’m ever driving a Ford somewhere. It has happened way too often that when Google Cloud has problems, Ford’s “keyless entry” goes down.
But this looks more like the security team has made some demands
More like the marketing team has made some demands that the information absolutely must never, at all costs, be provided in an open API that third-party apps that don’t steal your private info can use.
We need so much more consumer protection regulation than we have.
To help speed up your log in experience, you’ll now also need to separately log into another app in order to log into this one in addition to the current method.
It’s so smooth
“I can see you’re trying to adjust your headrest. I can help you with that. To assist me, please log in to your Ford account with MFA…”
“Seat adjustment detected a new driver. Please login to add a second driver to your account. Please drink verification can to continue.”
I’ve used this feature once to unlock the car after I forgot the keys inside. It’s nice enough to have, but that’s about the only scenario I’m likely to ever use for.
How does that happen? Does the door not unlock when you open it from the inside? Sounds like a very bad design decision on the manufacturer’s part
I don’t think they were locked in the car, the keys were.
I understand, but what I don’t understand is how the keys end up inside a locked car. Surely you need the keys to be outside to look the door through which you are exiting?
Nope. Lock button on the inside of the door, near the window buttons.
I’ve nearly done it myself a couple of times 😬
That’s why I like that my car just uses a normal key and not an electronic one. I just made a fuck ton of copies of it lol. Keep them everywhere. One’s even hidden on the exterior of the car itself.
Ah shit that makes so much more sense.
You don’t understand the concept of keys getting locked inside a car? This is about the most “touch grass” situation in the history of Internet comments. Locking keys in a car is super common, plenty of locksmiths make a living off the fact that it happens. Not sure how you missed that.
I think the confusion is this was a solved problem 30 years ago. Door automatically unlocks if you open from the inside and can’t be locked until you close it again. You had to work hard to get you keys locked in the car.
Engineers can create guards against mistakes, but if I wanted to find a way to lock my keys in my car that could be believably done by accident, I don’t think it would be hard. My dad recently locked his keys in his new truck. It’s possible to do.
Edit: also, 30 years? 1996 vehicles didn’t commonly protect you very much against this…
Because they unsolved the problem for some reason. Probably cut a deal with major locksmiths.
Every car in the last 30 years will lock keys in the car intentionally. It’s done this way because otherwise the car will be stolen with the keys inside of it.
My car literally won’t lock if I’m outside trying to lock it and the keys are inside. It’s saved me a few times.
Apparently not Fords. I leave the keys in my 2026 Ford Ranger fairly regularly (I live in the middle of nowhere, nobody is going to steal it here) and it has never locked the doors on me. In fact, if I leave the key in the ignition (with the car off) and hit the door lock button and close the door, it beeps twice and unlocks itself. I just tested it. If I leave the key in the cup holder I can lock it in the car, but not if it’s in the ignition.
My 2018 Excape has a keyless ignition. If I leave the key fob in the car, lock the doors with the button, and close it, the car immediately unlocks itself (without a beep). The only way to lock the key in the Escape is with a 2nd fob or with the phone app.
My less-than-30-year-old car has a normal metal key and doesn’t lock automatically.
Nah they often just have settings to automatically lock so many minutes after exiting or lock if you’ve unlocked the vehicle but haven’t opened the door within a certain time frame. I can’t see any manufacturer trying to figure out and program the logic to intentionally lock you out of your car to prevent it from getting stolen.
It’s happened to me in like a dozen cars I don’t know what to tell you
You locking your keys in your car a dozen times doesn’t equate to proof of manufacturers programming cars to intentionally lock keys inside of them.
These systems are typically time-based around entry/exit not the location of the keys. You’re telling me every one of these dozen cars would automatically lock the vehicle if the keys were left inside but never lock if you took the keys with you? That’s supposed to be “more secure” than just locking the car 3-5 minutes after you get out and shut the door? With many vehicles being keyless now allowing you to unlock the door by just grabbing the door handle with they key fob in close proximity, how would that even work?
Furthermore, the only security present with keys 30 years ago was a tiny RFID embedded in the key that could only be “read” by the vehicle when it was in the ignition barrel, so how were these vehicles determining that your keys were still in the car? Always-on proximity sensors for key fobs only became a thing with push-button start in the 2010s.
Your old school key fobs were nothing more than ‘dumb’ garage door openers or TV remotes that only transmit when a button is pressed and only receive if the transmission is close enough to the receiving antenna, meaning neither one knows the position of the other. My TV remote will work the same whether I’m using it in my living room or standing in my front yard pointing it through my living room window. Neither the TV nor remote ‘know’ whether I’m standing inside or outside my house while pressing a button and they certainly don’t know where either is located when I’m not pressing button, so how were cars doing this way back in 1996?
Modern cars suck
30 years?
You heard me
Three decades
A lot of people in here don’t understand security fundamentals.
Passkeys are not bad things. They are good things. 2FA in general is a good thing, and passkeys are a particular type of 2FA.
The principle behind this type of security is, in loose terms, “one thing you have and one thing you know”. Historically this has meant a device and a password.
The idea is that stealing just a physical object is easy (lost item, cloned, or theft), and stealing just a single piece of information is easy (leaked database, phishing, etc). Stealing both is much harder.
Passkeys satisfy both by requiring a piece of information to unlock the passkey (a fingerprint, or your phone’s password, or your hardware key’s unlock code). You need both the physical object where the passkey is stored and the means to unlock that device.
Password managers are not a replacement for passkeys because they are not hardware-bound. A compromised service or server provides full access.
Please use passkeys. They are genuinely more secure than passwords without 2FA.
I’ve seen the argument that passkeys solve a lot of problems with passwords, but I havent heard a good explanation on how you set up on a new device? At some point you need some way to authenticate that is not a passkey and so you end up back to square one passwords/MFA.
So now we’ve created a whole additional layer of security while not solving the initial problem. Not to mention how do you access an account if you lose your phone/don’t have it on you if it’s only accessible via passkey.
A) log in with passkey prior to device replacement, remove passkey temporarily, then re-add with new device
B) Set up multiple valid passkeys using separate devices, so that a single device failure does not prevent access
C) Use a portable passkey store like a Yubikey that is portable to any computing device
Personally I own two yubikeys; one stays on my person at all times, the other stays at my home at all times. I always add both when creating new passkeys for a service
Some password managers, like bitwarden, allow you to save Passkeys in them, and use them on multiple devices. That’s the only practicable way I’ve found of using them. I need to use most services on multiple devices.
Syncable passkeys do make it easier to handle new devices, but break one of the key values of passkeys - device atteststion. Syncable passkeys are effectively just long passwords as they aren’t tied to a device, meaning anyone who gets ahold of the passkey can access your accounts.
At least with syncable passkeys you can’t have a website leak your passkey (as they asymmetric keys), but with password+MFA a leaked password doesn’t give direct access to your accounts.
Passkey’s are good in theory. But the amount of them that have implemented incorrectly and don’t save. Or can’t find the passkey and let you just input a password or email a link is dumb.
I’m sticking with MFA using a different service for my MFA from my password manager.
I’ll maybe use passkey’s for more sensitive information like banks.
I have literally never had this problem. Passkeys are a strictly defined protocol as far as I’m aware.
I’d be really curious to know what services you’ve used that had this problem. Or what hardware you tried to save it on that didn’t work.
And yeah, implementing passkeys but allowing login with a password or email link is just wrong. No defending that.
My issue with passkeys is that they’re tied to devices and ecosystems, and I don’t always use the same devices or browsers. I also want to keep work and personal stuff separate. I deliberately store my passwords and MFA in different services so one breach doesn’t expose both.
I use different systems for different things. I sometimes work from home and pay bills at work, but I absolutely don’t want personal access stored on my work machine.
I’ve also had passkeys fail to register properly and had to remove them and start over. Even Microsoft documents registration issues.
Maybe passkeys will get there, but between setup issues and keeping everything working across devices and browsers, they’re not as simple as they’re made out to be. I prefer having control over where my credentials are stored and backed up. Everyone is different, but this new passkey push is not a good fit for me until things get smoothed out.
For your specific use case I recommend Yubikey for for passkey storage. It works everywhere a local device-stored passkey works but it’s portable.
It’s what I personally use for the exact reasons you describe
Passkeys are the way to go… Best of both worlds imo
I superficially thought so. Then read this article and ended up reconsidering my initial perspective. There’s a reason they’re being pushed currently and for sure it’s not to improve the user experience.
Thanks for the article! Read through it and now I have more questions.
Isnt it a normal thing for the actual standard to shake out once adoption starts spreading? (Similar to what’s happening here with FIDO alliance?)
I’m hoping a legit “real” passkey standard comes out and that it’s open and good for consumers.
Great article, thanks for sharing it
Not needing to do that shit in the first place is the way to go. Two of the functions Ford cites are only dubiously useful for the vehicle owner, and the third is just blatant fucking consumerism!
B b b but for access to my car?? Disclaimer: I must admit, I don’t get, why I would want to have remote access.
So you can lay in bed on a winter day and trigger the remote start. That’s about it. I have used the “feature” exactly once.
Remote start doesn’t need that though - I’ve installed several since the 90’s and none of them needed internet or an account.
The latest ones take about 15 minutes to install - that includes unboxing, reading the instructions, and finding the connectors.
Exactly. They deliberately design these things in such a way to force an account so they have an excuse to data-mine your phone.
Why I have used it exactly once. The key fob is much faster and easier.
The only other reason is to manage the trucks wifi. It was the cheapest way to get a mobile connection for my both my laptop and tablet for the business. $200/year for unlimited data was a hell of a lot better than $60-80/month any other route.
I have my KIA connected to home assistant which knows my calendar. Its nice to just have the car warm/cool without thinking about it. But its not necessary, just nice.
There is exactly 0% chance I would ever accept that sort of thing unless the car was talking directly to my Home Assistant server without Kia’s servers in between.
My wife does love that feature I must say. Although you can also use your keyfob and point it out the window if your car is nearby.
Lol imagine needing to log in to use your car…
