Exploiting Volvo/Eicher's fleet platform to gain control over all users/vehicles

📝 Discussion Summary (Click to expand)

Three dominant threads in the discussion

Cloud‑dependent car functions create security and usability risks
“You are at the complete mercy of the security and correctness of the cloud management software for the correctly functioning of the car.” – spockz
Digital‑key solutions fail when they require constant online access and lack a reliable offline fallback
“If the car gives people the ability to start a trip with a phone, it's dangerous to assume they'll always carry a keyfob as a backup.” – gruez
Automakers give poor, delayed responses to security disclosures, harming future responsible research
“And terrible (non‑)response from VECV, if they have any interest in receiving timely disclosure from future researchers.” – greyface‑

🚀 Project Ideas

An open‑source library that lets smartphones act as car keys via direct Bluetooth LE pairing, eliminating cloud dependency and ensuring operation in dead zones.
Provides cryptographic mutual authentication so the car can be started offline while maintaining security against hijacking.

Key	Value
Target Audience	Electric vehicle owners, privacy‑conscious drivers, developers building automotive accessories
Core Feature	Offline Bluetooth‑LE key exchange with mutual authentication
Tech Stack	Rust (core), Android SDK (Kotlin), iOS SDK (Swift), libsodium for crypto, DBus for Linux integration
Difficulty	Medium
Monetization	Revenue-ready: Subscription (e.g., $5/mo for cloud‑sync add‑ons)

HN commenters repeatedly called out the frustration of cars that “can’t phone home” and require dealer codes – this tool directly addresses that pain.
Generates discussion on standardizing automotive key protocols and could become a reference implementation for right‑to‑repair advocates.

A SaaS that continuously scrapes manufacturer API documentation (e.g., BMW, Ford) and alerts users when endpoints change or disappear, preventing surprise loss of functionality.
Generates auto‑updated adapter scripts so developers can keep their integrations working without manual rewrites.

Key	Value
Target Audience	Automotive security researchers, indie developers building car apps, owners wanting to retain control over their vehicles
Core Feature	Real‑time API change detection with auto‑generated fallback adapters
Tech Stack	Python backend, PostgreSQL, GraphQL API, Docker, AWS Lambda
Difficulty	High
Monetization	Revenue-ready: Tiered pricing (Free for 5 checks, $15/mo for unlimited)

HN users emphasized the “generous timeline” and desire for faster disclosure – this service speeds up awareness of API changes.
Sparks conversation about responsible disclosure pipelines and could be adopted by security researcher communities.

A plug‑and‑play USB dongle with open‑source firmware that emulates a broad range of automotive digital‑key standards, allowing any car with supported OBD‑II or CAN interface to be started without cloud.
Includes a companion app that provisions keys locally, stores them encrypted on the device, and works completely offline.

Key	Value
Target Audience	Car owners with modern connected vehicles, makers of custom accessories, repair shops seeking right‑to‑repair tools
Core Feature	Offline universal digital‑key emulator via USB/CAN, programmable per vehicle VIN
Tech Stack	C++ firmware on ESP32, CAN bus library, Android/iOS companion app (React Native), SQLite for key storage
Difficulty	High
Monetization	Revenue-ready: Hardware sales (one‑time purchase) with optional $10/year firmware update subscription

Directly echoes the “Why is this even allowed?” frustration about cars refusing to start without phone reception – this dongle restores autonomy.
Will ignite debate on regulation, manufacturer lock‑in, and could become a catalyst for policy discussions on automotive right‑to‑repair.