Whoa! Come on tesla!

[Oldschool496]

Use a WiFi access point at the airport, hotel, etc? May not be safe. All risk choices.

I Never, Never, Never sign on to any outside wifi's or hotspots. I watch my family members scramble for the wifi key every time we go to a Hotel or other place. I showed them the video last night, they got a huge dose of reality.

This goes way beyond the car, WAYYYY beyond. The car is replaceable, its just an object that happens to be insured.

your identity, social media, banking is all at risk all the time even being safe and not signing on to unknown wifi. That just adds an extra layer of "we gotcha" if you do sign on. The pineapple is in the backpack of the person at the library, coffee shop, hotel room next to yours, airport. The pineapple could virtually be everywhere you are.

 

[Oldschool496]

"FBI Surveillance Van #22"

LOL
Now thats a good one. Hackers love those. We used to call our CIA LAN. I changed it pretty fast. Going now two step verification on this site.

Thanks OP good job on the video.

 

[silentcorp]

Wait, we shouldn't give our credentials to a unsecure third party? Who would have thought?!

 

[StellarRat]

The obvious solution is to require a rectal scan to open the car.

 

[Oldschool496]

The obvious solution is to require a rectal scan to open the car.

LOL
I wonder how much they would use that?

 

[StellarRat]

LOL
I wonder how much they would use that?

I don't know, butt you'd definitely want to have to want get into the car.

 

[brkaus]

LOL
I wonder how much they would use that?

Could that be related to the handle redesign on the 3?

 

[Dan123]

Wait, I'm confused.

Why would you ever type in your tesla.com credentials anywhere other than the app or tesla.com?

Is there something special about supercharger locations that requires you to enter your credentials?

EDIT:

Note I'm not saying that 2FA is a bad thing. Tesla should definitely add it to your tesla.com account.

Because it would be made to look exactly like Tesla.com. Many (not all) people would be fooled into entering their password.

But even without this hack, for people who reuse their passwords, someone can just try to log into Tesla.com using publicly available lists of emails/passwords. One they succeed, they can locate the car and steal it.

This is a very real security issue.

 

[Oldschool496]

handle redesign on the 3?

I don't know

That could be a problem, thats my fear they may enjoy it, the whole scanning, handle, shock treatment thing.

 

[Oldschool496]

Because it would be made to look exactly like Tesla.com

Yes, everyone views their app, and my guess is they knock you off it and you have sign back in, thats when it happens. We all view our app upon charging, don't we? or certainly somewhere in the process of supercharging. I know I do every time without fail.

Ever been signed in to something like your bank and get knocked off, now it makes you wonder. Now with facial recognition iPhone and finger print ID on our phones this is harder I would imagine if this is how they get you to reinitiate.

 

[Knightshade]

Yes, everyone views their app, and my guess is they knock you off it and you have sign back in, thats when it happens. We all view our app upon charging, don't we? or certainly somewhere in the process of supercharging. I know I do every time without fail.

Ever been signed in to something like your bank and get knocked off, now it makes you wonder. Now with facial recognition iPhone and finger print ID on our phones this is harder I would imagine if this is how they get you to reinitiate.

The app isn't a web page- so this makes 0 sense.

A wifi hacker can't remotely spoof a local app on your phone.

(nor am I clear how you think they will "knock you off" your local app so you have to sign back in anyway)

 

[Oldschool496]

The app isn't a web page- so this makes 0 sense.

A wifi hacker can't remotely spoof a local app on your phone.

(nor am I clear how you think they will "knock you off" your local app so you have to sign back in anyway)

Well, I am glad you know then. I have to sign in on occasion and its selected "stay signed in". What you think is happening when the app does that? Safe Travels. Getting knocked off is possible.

 

[Rottenapplr]

The obvious solution is to require a rectal scan to open the car.

Innovative solution! Care to volunteer?

 

[SammichLover]

Watch the video, it explains how this can be worked around

Is there a place I can read up the [accurate] technical details of this, instead? I dislike the stress generated by listening to the Teslanomics guy.

https://imnotsurewhattocallthis.files.wordpress.com/2011/10/stress-confusionchoke.gif

 

[Knightshade]

Is there a place I can read up the [accurate] technical details of this, instead? I dislike the stress generated by listening to the Teslanomics guy.

https://imnotsurewhattocallthis.files.wordpress.com/2011/10/stress-confusionchoke.gif

Already explained in this very thread multiple times. If you have their tesla login you can disable PIN to drive via the app, or simply use the tesla login IN PLACE OF a forgotten PIN in the car.

PIN to drive is totally useless if your tesla.com login is compromised.

 

[SammichLover]

Already explained in this very thread multiple times. If you have their tesla login you can disable PIN to drive via the app, or simply use the tesla login IN PLACE OF a forgotten PIN in the car.

PIN to drive is totally useless if your tesla.com login is compromised.

Thanks. So it is all based around phishing my Tesla account password by some other means? Yeah, I had always assumed giving up that would be bad. I don't use PIN to drive because "never valet, not even once", and it didn't strike me as adding much actual security value.

I had scanned down through the thread to try figure out what the big deal was, and it wasn't being clearly spelled out. Just found a lot of dancing around it with stuff written with the assumption I'd watched the video rather than a sum-up. Which of course normally makes sense.

Another clickbait by Ben. *thumbsup*

 

[davedavedave]

The app isn't a web page- so this makes 0 sense.

A wifi hacker can't remotely spoof a local app on your phone.

(nor am I clear how you think they will "knock you off" your local app so you have to sign back in anyway)

True - but the vector here would be to spoof Tesla's service endpoints that the app talks too and use a MITM proxy. Luckily, all this is mitigated by a lot of clever handshaking between the App, Tesla's services, and the car. (see this: I decompiled the Tesla Android app and poked around a bit to try to figure out how the Model 3 phone key works : teslamotors )

Oh, also, WRT the safety of using your cell phone data plan instead of free wifi - there's always this: Stingray phone tracker - Wikipedia ... but Tesla's mobile app security wouldn't be compromised with this either.

I like Ben Sullen's videos, but this "dramatic reenactment" is not really a realistic, IMHO.

 

[VQTRVA]

I Never, Never, Never sign on to any outside wifi's or hotspots. I watch my family members scramble for the wifi key every time we go to a Hotel or other place. I showed them the video last night, they got a huge dose of reality.

This goes way beyond the car, WAYYYY beyond. The car is replaceable, its just an object that happens to be insured.

your identity, social media, banking is all at risk all the time even being safe and not signing on to unknown wifi. That just adds an extra layer of "we gotcha" if you do sign on. The pineapple is in the backpack of the person at the library, coffee shop, hotel room next to yours, airport. The pineapple could virtually be everywhere you are.

What about signing on via a browser on the mobile phone via LTE?

 

[NetworkNerd]

The obvious solution is to require a rectal scan to open the car.

Innovative solution! Care to volunteer?

I am having these bad images of this and the automatic Tesla charger. Buurrr

 

[dsvick]

Well, I am glad you know then. I have to sign in on occasion and its selected "stay signed in". What you think is happening when the app does that? Safe Travels. Getting knocked off is possible.

That's not getting knocked off by some third party, that's having a token on your phone expire or having it's IP address change so that the server no longer recognizes it as the one that it was supposed to remember.