Volkswagen App

seppygator

also doesnt work here anymore...

seems they just wanted to show us they can make it work with no technical diffuclties whatsoever within minutes if they want to...but they don't want to...

DeletedUser1041

Maybe this is a little too optimistic but any chance they just tested it before officially rolling it out rather than tormenting all of us? It's Volkswagen so honestly either is possible.

Taijian

I was able to log in once, then I stayed logged in. But once I logged out for testing purposes, I could no longer log in, either.

graphog

I just found this thread since I wanted to post the response I received from VW. They make it sound like they might change their mind. But honestly, I'm sceptical. Several apps stopped working for me lately (public health insurance, public car registration app, a banking app). A year ago there wan't a single app that did not work!

The introduction of the current integrity checks was not based on an assessment that a particular operating system or device configuration is or could potentially be insecure. Rather, these measures are part of a broader security and data privacy concept for the Volkswagen App and the associated vehicle services.

As part of the review of the previous architecture, potential data privacy and security-relevant aspects were identified in connection with third-party access to vehicle-related customer data via unofficial reverse-engineering solutions. The current integrity checks were introduced to further strengthen security, transparency, and control when accessing customer accounts, vehicle-related services, and personal data.

The integrity checks are part of these protective measures. Their purpose is to ensure that access to customer and vehicle data, as well as security-relevant vehicle functions, only occurs from device environments that meet the integrity requirements defined for the use of the Volkswagen App.

As a result, it may happen that device configurations that worked in the past no longer meet the currently applicable integrity requirements. In addition to the operating system itself, other factors, such as the integrity status of the respective device environment, can also play a role.

We would also like to clarify that this should not be understood as a statement that your device or your configuration is fundamentally insecure. Rather, this reflects the security and data privacy requirements that Volkswagen currently applies to protect customer accounts, vehicle-related services, and personal data.

Your feedback has been forwarded to the responsible product and development teams and will be taken into account there. We are continuously working on solutions to align the needs of our customers with our requirements for security and data privacy.

Thank you for your patience and understanding!

This thread is quite long now. Can somebody tell me what the community experience is regarding a good next step? What can I respond to them and who else can I write to?

P.S.: still not able to log in on 4.2.1

Themble

Unfortunately my next step was to delete my account.

de0u

graphog Maybe write back politely, saying that you have read their response several times but can't figure out how it helps you access your car from your very secure phone and why they are OK with known-insecure EOL devices getting access. Maybe also say that because you are still confused you are going to share the correspondence so far with somebody at your legislator's office to see if they can help you understand. Then politely schedule an in-person appointment with somebody in your legislator's office and ask them to send VW an inquiry.

That may well get you nothing... except that VW will definitely need to spend a lot of staff effort figuring out how to respond if they do get a polite inquiry from your legislator's office. Even if they send an "important person" the same soothing claptrap they sent you, they will probably feel more nervous about doing it.

That kind of approach will cost you a lot more time than going back and forth with them online. But sending customers soothing claptrap online is much cheaper for them than trying to figure out how to respond to an "important person". At some point they may spend some energy wondering whether their position actually makes sense.

Or perhaps see if you can get Ars Technica to write a piece about how wacky the policy seems.

Johnnyloans

graphog

If their app is only secure because the malicious actor isn't on an administrator or root account, that's middle-school-classroom, security tactics.

iswrong

Johnnyloans I think GrapheneOS and other systems are just collateral damage and the real reason is an extension of ending their public API. They also hint at this in their message:

graphog As part of the review of the previous architecture, potential data privacy and security-relevant aspects were identified in connection with third-party access to vehicle-related customer data via unofficial reverse-engineering solutions.

When they blocked their public API, which was used by Home Assistant, someone people started using the same authentication flow as the apps: https://github.com/robinostlund/volkswagencarnet/pull/329

Not defending what they did, but I think they wanted to close that off and did it by introducing remote attestation. They could still accomplish the same while also attesting GrapheneOS.

iswrong

I am going to bow out of the discussion. We have ordered a new car and it is not a VW. I will send VW yet another reply to let them know that breaking GrapheneOS support was one of the factors that were part of that decision (of course, a bunch of other things we liked more about the other brand as well).

« Previous Page