PSA: Don't use third-party apps and services, period.

[huangm777]

Just want to say thank you for this post. I'm a software developer myself (though security is not my main domain; I do understand the basics of API tokens and authentication basics), and I had been considering using one of these tracking apps once I got my car, but this is a good reminder that Tesla's security leaves much to be desired. I noticed that I couldn't paste my long randomly generated password into my Tesla account when changing passwords, which encourages people to use easy or reused passwords. I know they are also working on 2FA but it's long, long overdue for an account that can control a car.

You'd think for a car that is very popular with software engineers that these issues would have been identified and fixed long ago through posts like yours. I hope Tesla will do better on this front. In the meantime, I'm going to stay away from the stats apps.

 

[huangm777]

My car's been in for service every month since August, next appointment is 11th of December. 4 of these times one of the issues have been that I can't wake the car with the app. They are really struggling to reproduce and debug it, even with dozens of timestamps, pictures and video of the car having no connection. Last time I think they set up a phone with my credentials.
They shouldn't have to, I've had roadside assistance on the phone once, and they couldn't connect either. Don't know if the technicians are able to use the same systems as roadside assistance, though.

This raises HUGE red flags to me. Even as a student sysadmin I knew that we never, ever needed a users password—we had admin/super user access so it was unnecessary. We also always taught people that we’d never ask for their password and if someone did, it was someone fishing for it for no good reason. This is shocking. They need to correct this, pronto. It’s security 101...

 

[camalaio]

While this was not my direct intent, I now realize the impact this thread may have on the revenue stream of these third-party services. Of course, that naturally follows for those who follow my advice, however it wasn't obvious to me at the time and I had not thought of it. I feel a little bad since they are obviously offering valuable services and Tesla's non-ideal system that they need to use is not their fault. I'm going to reach out to some parties and see what can be done, I have an idea that might help everyone. Anyone happen to know who I can contact at TeslaFi, Stats app, etc.?

I still stand by my statements and won't retract them, I just didn't look at the overall impact. Whoops :S

While I am no fan of giving my keys away to a 3rd party, or even giving my keys to a valet, I would like to try to better understand the risks.

When I give my keys to a valet (which I do try to avoid), I can pretty much imagine the variety and severity of risks. None of them particularly good, from minor damage or scratches inside or out to some very low probability but crazy scenarios that on occasion make news.

So for those of you in the software space (which I am not), can you help answer two questions to better understand the risks of third-party?

What would be the worst case scenario?
What are the odds of that happening to an individual user?

"Worst case" depends on what matters to you. The obvious theft case was outlined. Since this is equivalent to handing strangers the virtual key to your vehicle (like a valet), what they do with your vehicle is outside of your control. Unlike a valet, there isn't social pressure of maintaining a job or from coworkers to not do something stupid with your car. Anyone could end up with your key from anywhere in the world when you willingly expose it outside of the environment it was designed to be used in.

"Worst case" could also be harvesting your data for direct or indirect use. Again, insurance was an example (which you were personally OK with) that could be used to raise your rates. Another could be mapping out when you seem to leave home with your vehicle, so one could plan an opportune time for a home robbery without interruption. A sophisticated individual could even set up an alarm to let them know when you're on your way back home so they can get out of there!

As for the odds, I'll separate it.

• Control: The odds of someone maliciously controlling your car are very low. This is because they benefit from keeping it on the down low. If leaked access suddenly becomes widely known because too many people's Tesla's are being maliciously controlled, someone goes "hey wait a minute" and now Tesla needs to do something to lock that down. They then lose control access.
• Data/info: Controversially, I'm going to say the odds of your data being used without your knowledge is guaranteed to happen one day if you share your password/token with third parties. This will happen either by intentional arrangement of the third party service selling the data (they want to make money, this is a good way to do so) or by a leak of passwords/tokens (in which case only Tesla can detect, and would have a very hard time doing so). The first case doesn't even have to involve your password/token being given to a data company: the service/app you gave the keys to can simply get the data and sell it alone instead of giving direct access to the data. This is extremely common. But in the case of a leak, it's all too attractive to siphon up everyone's data because there would be zero backlash for doing so, with potentially great benefit (including selling off the data alone while continuing to acquire more).

I agree that theft would be one of the worst case type scenarios. I'm not so sure I agree that insurance would not cover. I did not give anyone permission to steal my car, much less even drive the car. Someone stealing my credentials does not let the insurance company off the hook.

I suppose this gets into all sorts of legal precedent (which may also vary by place of residence), but if you gave someone your keys... did you not give them permission to access and potentially drive your car? Naturally I would think so, however I have no idea how that holds up in legal reality. The reality is you did indeed give the access and means. Knowing my own provincial insurer, they might be wary of potential insurance fraud if something bad happened to the car (because insurance fraud is indeed a real thing).

Dude, don’t even bother with this thread. I posted a sarcastic joke that went over most people’s heads. You won’t be changing any of the posters mind here and you’ll be downvoted for even trying. The poll for this thread still shows the majority, 37% (10:18am PST 2 Dec) saying they do and will use the 3rd party apps but some members are very upset about this.

I think the title of this thread could be more apt to what the OP is trying to say. It’s a bit much to title your post Public Service Announcement. Maybe “Caution when using 3rd party apps” or “The possible downsides”.

I bet 100 Internetz that some of the members on this forum are using the same password as their email, their Tesla login and possibly their banking info.

/unsubscribed

Others have covered this (my position is not simply paranoia nor mild annoyance, it's concretely factual and advisory and really is meant to be as urgent as I titled it). I do have a few points for others:

• 37% isn't a majority. It's the most popular option, but not a majority.
• Combining current responses at the time of writing, the numbers are actually fairly close.
  • 37.4% plan to keep using or will use a third party service/app in the future
  • 32.1% stopped or won't use one precisely because of the problems outlined in this thread
  • 30.5% just aren't interested in a third party service/app

Of course, the group of forum users vs. the group of all Tesla owners is very different and these stats are not at all representative of the average Tesla owner. In fact, it seems TeslaFi (they're the only one I could find a number for) has about 9000 users, whereas I understand there a few hundred thousand Tesla vehicles out on the roads. These numbers do not jive with the 37.4% portion above, and we should all be aware of that. We should also be aware of the fact that the 8.9% who found value in this thread is shockingly high (in my opinion) and I'm glad we could collectively inform a few people on the risk. Likewise, the 1.6% who read through this and choose to still use the service are at least in a more well informed position now even if I (and others) would prefer if no one gave up the keys to their cars. That's a win in my books, I aim to inform.

Just want to say thank you for this post. I'm a software developer myself (though security is not my main domain; I do understand the basics of API tokens and authentication basics), and I had been considering using one of these tracking apps once I got my car, but this is a good reminder that Tesla's security leaves much to be desired. I noticed that I couldn't paste my long randomly generated password into my Tesla account when changing passwords, which encourages people to use easy or reused passwords. I know they are also working on 2FA but it's long, long overdue for an account that can control a car.

You'd think for a car that is very popular with software engineers that these issues would have been identified and fixed long ago through posts like yours. I hope Tesla will do better on this front. In the meantime, I'm going to stay away from the stats apps.

To you and all others who have chimed in (either in support or otherwise), thank you. I'm glad I (and others!) could provide some more information or even simply reminders for everyone. I'm also glad to hear from those who I initially disagreed with because honestly, I had not thought of your perspectives before. Especially as a non-user of the services/apps, I understand they have significant value but I haven't experienced that value myself, so it's much easier to be on the side I am than if I was gleaning value from one of these services currently. It would be hard for me to switch off of them and I'd be trying to debate many of the same questions and points that have come up!

But back to your points. The password thing, you specifically mean when you change the password and the prompt in the app doesn't let you autofill from a password manage? If so, yeah, just experienced the same myself and that was a bit mildly annoying.

I'm not shocked that little has been done to address this. Tesla's business goes on without it. Whether I like it or not, I've learned that in this industry that you need to put your resources only where the dollars are, not where the features are nice to have. ¯\_(ツ)_/¯

 

[640k]

At the end of the day, I'd like to put a moratorium on "at the end of the day".

Like...really.

Like.

it is what it is.

 

[joebruin77]

Anyone happen to know who I can contact at TeslaFi, Stats app, etc.?

This is the home page for the Stats for Tesla app. If you scroll down to the bottom, you can use the contact us link to contact the developer Ramin. I have reached out to him with questions in the past and he is always super responsive. I am sure you will find it easy to contact him this way.

https://www.maadotaa.com/

 

[smatthew]

But back to your points. The password thing, you specifically mean when you change the password and the prompt in the app doesn't let you autofill from a password manage? If so, yeah, just experienced the same myself and that was a bit mildly annoying.

Must be an Android bug. I've always been able to use the iOS password manager with the Tesla App. Then again, I set my password to a randomly generated 14 character sequence that includes numbers, symbols, and mixed case. And that password has never been re-used. So I don't really need to change it, especially since I never gave TeslaFi my password, just an auth token. There is literally nothing they can do but a)track my location and b)remotely unlock and enable the car to be driven.

TLDR; the effort to hack TeslaFi and not get caught is not worth a joy ride in one car, since any hack will be quickly discovered and cars will be quickly recovered unless they are in a cell dead zone/shipping container, especially when that hacker probably already owns their own Tesla.

If someone wants to track the location of my car, it's easier than hacking TeslaFi. For under a hundred dollars, you can purchase a cellular gps tracker that just gets stuck on the car. Think it never happens? A good friend of mine has a daughter who is quite attractive. Attractive enough that the gym used her picture on one of their fliers. A creep (married, has kids) saw her picture, and joined the gym to be near her. Then he put a tracker on her car. Luckily, she was having her oil changed, and the service guy noticed the tracker and mentioned it to her. She was able to get a restraining order and the DA prosecuted the creep. Who's going to notice the tracker on my Tesla? Certainly not the jiffy lube guys......

But what if TeslaFi gets hacked? Well, we would know fairly rapidly once cars started being stolen in mass and could change passwords. At that point Tesla could even block OTA starting until passwords were changed. Unless you think there's a massive criminal conspiracy to hack TeslaFi and have hundreds of thousands of "agents" all over the world steal every TeslaFi Tesla within say 12 hours and drive them into shipping containers to block the cell service so they can't be tracked - then untraceably move all those containers and arrange for a team of mechanics to strip all the parts off and re-sell them on Ebay...... OMG - I think I just came up with the plot of an action movie. "Oh No. A gang is holding my girlfriend hostage, and the only way I can pay their ransom is to work with another gang to steal 10,000 Teslas by midnight tonight!" Like gone in 60 seconds, but with Teslas?

 

[huangm777]

Just wanted to give a recommendation for those who still want stats but want to take into consideration the concerns outlined in this thread: TeslaMate. This still uses your Tesla credentials, but the entire thing runs on your local webserver, so it never leaves your own internal network. (You won't be able to access it outside your own network, but that's what makes it more secure.) Setup using Docker is pretty simple, and it provides robust stats with nice looking graphs. I've started using it, and I put the webserver on a Raspberry Pi. So you can have your cake and eat it too after all!

 

[webbah]

Just wanted to give a recommendation for those who still want stats but want to take into consideration the concerns outlined in this thread: TeslaMate. This still uses your Tesla credentials, but the entire thing runs on your local webserver, so it never leaves your own internal network. (You won't be able to access it outside your own network, but that's what makes it more secure.) Setup using Docker is pretty simple, and it provides robust stats with nice looking graphs. I've started using it, and I put the webserver on a Raspberry Pi. So you can have your cake and eat it too after all!

Just curious, is the code open source? Has anyone validated it and confirmed it does not send anything to remote servers?

 

[huangm777]

Just curious, is the code open source? Has anyone validated it and confirmed it does not send anything to remote servers?

The code is open source, it's all in the Github link. Unfortunately I'm not familiar with the non-Javascript parts of it, but I did a cursory check of the auth, API access, and other parts of the code. So far it appears that the only connections to the outside are accessing Tesla's API and getting data back, and there are no other outbound connections. The databases and the processing of stats all take place in localhost. I don't see any remote addresses other than Tesla's API at all.

The real way to test is to run something like Little Snitch or Wireshark to see if the app is sending packets outside. I might do that later when I have time.

 

[-motts-]

Just curious, is the code open source? Has anyone validated it and confirmed it does not send anything to remote servers?

I mean, his link is a link to the GitHub project...

 

[DopeGhoti]

I can vouch for TeslaMate. You lose the aggregation information that TeslaFi gets you, but you gain the security of knowing that your data are yours. It runs in a docker container that you can audit and ensure that no data from it go anywhere but to you or Tesla and, as others have pointed out, it is open-source and you can review to your heart's content.

 

[m3supra]

Needing to share accounts/passwords with spouses to get the app to work/drive the car is some BS. Almost every software offering regarding security has some sort of share/invite other users with different levels of access.

How hard is it to create a new table of shared/collaborator users that are granted access and are assigned an encrypted non-master key that is stored on the other user's phone? C'mon, interns do this kind of work.

 

[RobDickinson]

Needing to share accounts/passwords with spouses to get the app to work/drive the car is some BS. Almost every software offering regarding security has some sort of share/invite other users with different levels of access.

You dont. They can create their own tesla account and you can instruct tesla to give them access to the vehicle on it.

 

[Dan203]

This is problematic because your password (which you probably use elsewhere, be honest) is being given to a stranger.

If you actually do this you're an idiot! Lastpass, Dashlane, 1Password, etc... all have free versions now that easily let you create unique, and random, passwords for every site. That way you never use the same password twice and if something does get hacked they only have a password that works for that site.

I'm currently developing a Tesla related service. I will allow the option to use your user/password, but I don't actually store it anywhere. They're sent directly to Tesla and only the response data with the auth token is stored in the database. Also all communication with Tesla happens on the backend, not the front end, so the auth token never gets sent to the client. And I'm using Google Firebase for the backend, which is heavily encrypted using multiple layers of protection. (look up the white paper on their security) The biggest vulnerability to the whole thing will be if someone hacked my Google account. But since I use LastPass and my Google account uses a 20+ digit random password, and also has 2FA enabled, that's highly, highly, unlikely. But if the service takes off I'll institute a policy to change my password every 30 days just to be safe.

So really the only trust here is me. I can't post the source on GitHub as it would just allow someone to rip off my hard work and I do plan to charge a small amount for this service. But my contact info is pretty readily available. I'm a moderator over on TiVoCommunityForum (same user name) and have been for almost 20 years and the developer of a popular TiVo related software product called pyTivo Desktop. I'm also a developer for a commercial product called VideoReDo (day job) which I've worked on for over 15 years now.

And even if it all goes wrong and some service like this steals your user name and password all you have to do is change your password and all previous tokens are immediately invalidated.

I'm not saying there is zero risk in trusting a service like this with your credentials but the risk is pretty low if you're smart about your personal security.

 

[daniel]

The idea of giving any app the user name and password for my car, or for any online service, or giving any online service the user name and password for any other service, never would have occurred to me in a million years. I found the OP informative for revealing the fact that there are people who would do this. I'd heard of TeslaFi and just assumed it was a web site where people entered information about their car. I didn't realize people actually gave it access to their car. It really does seem like giving complete strangers the key to your car and asking them to open it up periodically to check whether you'd inadvertently left your wallet on the back seat.

You can't live your life cowering under the bed and in 2019 most of us need to use the internet and there are always risks. But giving strangers complete access to your car just to log your driving stats? In an age where data leaks and mass dumps are common, and all too few on-line companies have adequate security in place?

 

[Dan203]

The idea of giving any app the user name and password for my car, or for any online service, or giving any online service the user name and password for any other service, never would have occurred to me in a million years. I found the OP informative for revealing the fact that there are people who would do this. I'd heard of TeslaFi and just assumed it was a web site where people entered information about their car. I didn't realize people actually gave it access to their car. It really does seem like giving complete strangers the key to your car and asking them to open it up periodically to check whether you'd inadvertently left your wallet on the back seat.

You can't live your life cowering under the bed and in 2019 most of us need to use the internet and there are always risks. But giving strangers complete access to your car just to log your driving stats? In an age where data leaks and mass dumps are common, and all too few on-line companies have adequate security in place?

You don't have to give up your username and password. There is a way that you as the owner could generate the token that the 3d party site needs to call the functions that act on your car. Problem is that unless you're pretty technical it's not easy to do. So you'd have to trust some other 3rd party app or website to make the call to the Tesla API to get the token you're going to enter into another 3rd party site.

The biggest issue is that Tesla offers no way for you as the owner to restrict how that token is used. Like if you wanted a site to be able to say track your power usage but NOT allow that site to unlock your car, there is currently no way to do that. The token returned by the Tesla API is universal and can be used for every single function their API offers.

So if we're being total doom and gloom.... the Tesla API offers a way to track your car via GPS. A way to unlock your car. And a way to remotely authorize someone to drive away in your car. So any one of these services could potentially be used to literally steal your car.

But the same can be said if you use a sh*tty password for your Tesla account. If someone cracks your password they could know exactly where your car is and have all the tools they need to unlock it and drive away. So if you do what the OP said and reuse your Tesla password for other sites you're putting your car at risk.

Regardless of what you take away from this thread one thing you should do immediately.... start using a password manager like LastPass, Dashlane or 1Password. The #1 way people get "hacked" is by reusing passwords. Some sh*tty site you used gets hacked and the database with all the emails/passwords is unencrypted and then the hackers go around to popular sites and try those same email/password combos to see if they work. If every site has a unique password then this will never be an issue.

 

[RobDickinson]

I'm currently developing a Tesla related service. I will allow the option to use your user/password, but I don't actually store it anywhere.

So really the only trust here is me.

mkay we have to trust that you don harvest the account details but still

 

[m3supra]

You dont. They can create their own tesla account and you can instruct tesla to give them access to the vehicle on it.

Last I heard, this takes a month. Try to reach customer service, customer service files ticket, some dev probably inserts a row into a db table. If it's faster now, good job Tesla I guess? Still a stupid low hanging fruit that engineering could fix.

 

[camalaio]

The code is open source, it's all in the Github link. Unfortunately I'm not familiar with the non-Javascript parts of it, but I did a cursory check of the auth, API access, and other parts of the code. So far it appears that the only connections to the outside are accessing Tesla's API and getting data back, and there are no other outbound connections. The databases and the processing of stats all take place in localhost. I don't see any remote addresses other than Tesla's API at all.

The real way to test is to run something like Little Snitch or Wireshark to see if the app is sending packets outside. I might do that later when I have time.

Just a quick note that using Little Snitch, Wireshark, etc. will only give you a false sense of security in this case. A primary "attack" possible is authenticated use of the Tesla API unbeknownst to the owner, which you wouldn't be able to discern easily as legitimate or malicious, especially if you're not technically competent and inspecting each HTTP request and are familiar with the API to some level.

I don't doubt that the developer's intentions are in the right place though! Just saying that there is definitely a level of trust involved even with such an option.

If you actually do this you're an idiot! Lastpass, Dashlane, 1Password, etc... all have free versions now that easily let you create unique, and random, passwords for every site. That way you never use the same password twice and if something does get hacked they only have a password that works for that site.

I'm currently developing a Tesla related service. I will allow the option to use your user/password, but I don't actually store it anywhere. They're sent directly to Tesla and only the response data with the auth token is stored in the database. Also all communication with Tesla happens on the backend, not the front end, so the auth token never gets sent to the client. And I'm using Google Firebase for the backend, which is heavily encrypted using multiple layers of protection. (look up the white paper on their security) The biggest vulnerability to the whole thing will be if someone hacked my Google account. But since I use LastPass and my Google account uses a 20+ digit random password, and also has 2FA enabled, that's highly, highly, unlikely. But if the service takes off I'll institute a policy to change my password every 30 days just to be safe.

So really the only trust here is me. I can't post the source on GitHub as it would just allow someone to rip off my hard work and I do plan to charge a small amount for this service. But my contact info is pretty readily available. I'm a moderator over on TiVoCommunityForum (same user name) and have been for almost 20 years and the developer of a popular TiVo related software product called pyTivo Desktop. I'm also a developer for a commercial product called VideoReDo (day job) which I've worked on for over 15 years now.

And even if it all goes wrong and some service like this steals your user name and password all you have to do is change your password and all previous tokens are immediately invalidated.

I'm not saying there is zero risk in trusting a service like this with your credentials but the risk is pretty low if you're smart about your personal security.

First, it's not productive to call those that don't use a password manager "idiots". Some people have strong and unique passwords without using them and are better off for it. Even if not, most people don't use a password manager. Are most people idiots? Even if they are, they're a reality we need to work with so it's best to help them kindly rather than assert their idiocy from your self-appointed pedestal.

Second, the relatively new internet wisdom holds here in my opinion: "if the service is free, you are the product". Even though I use one for accounts I don't really care about (e.g. forums), I am highly suspect of why and how the service can be offered for free. For anything actually sensitive (bank, car, Amazon, etc.) I use strong and unique passwords that exist only in my brain. That's still the best approach if you can manage to juggle those passwords. And I certainly am not going to advertise which password manager I use just in case of a more targeted attack (quite possible for someone running a service).

And to your changing password point, note that I pointed out this may not work and may not be immediately possible. Someone with your credentials can change both your email and password, making recovery impossible without going through Tesla support (and we know how long that takes!). You could be inconvenienced for quite some time.

It really does seem like giving complete strangers the key to your car and asking them to open it up periodically to check whether you'd inadvertently left your wallet on the back seat.

Hahaha, yes, this is a great analogy especially since some of the services do things like check if your car is locked. Genuinely sort of helpful, but you're giving away the car keys to do so. Your statement is spot on.

 

[Dan203]

Second, the relatively new internet wisdom holds here in my opinion: "if the service is free, you are the product". Even though I use one for accounts I don't really care about (e.g. forums), I am highly suspect of why and how the service can be offered for free.

I have offered my TiVo software, pyTivo Desktop, completely free of charge for the last two and a half years. Even though the whole project has a continued cost to me hundreds of dollars a year for hosting, domain registration and an Apple development account required to offer a Mac version. I've never asked my users for a dime. In fact only recently, like last week, at the request of several users did I finally add a donation button, and it's pretty subtle. I collect no personal data on people who download or use it, so it's impossible for me to sell that to anyone. I don’t even know who they are. I spent several months of my time developing and tweaking the software simply because I enjoyed the experience (learned a new language) and I get satisfaction from knowing people enjoy using it. That's all. No sinister money making plot under the hood.

For the Tesla project I'm working on I'm planning to charge a small fee, like a few bucks a year, just to cover server costs. I was originally going to offer it for free as well, but based on the size of the Tesla user base and the costs involved with scaling Firebase I'm worried that it could end up costing me thousands of dollars a month if it gets popular. But it wont collect any data other than your name and the auth data needed to connect to your car. It's not a competitor to TeslaFi or the like and requires very little info to function. So selling your data wont be an option here either.

My main motivation behind this project was to yet again learn something new (never used Firebase before) and to create something that I myself wanted for my own car. I'm going to offer it to other people because I think it's something that others might like as well, but if it doesn’t take off oh well. It works for me and that's really all I wanted.