PSA Warning: PAAK might leave your Mach-E (or possessions inside) vulnerable to theft

[User100723]

Why? I shouldn't have to reconfigure my phone's settings for a single app. I've given the FordPass app the permissions it requested. If those weren't appropriate, then it's a bug in FordPass that it's requesting them.

While I love the fact that this kicked off a great conversation, I think it's become somewhat derailed. I never intended my post to turn into a "PSA." I was just sharing my test and results. Someone else decided to edit the title and flag it as 'news.'

The purpose of my testing was simple: Can I trust PaaK?

The answer turned out to be "no."

Testing at 30-50 ft wasn't really needed for my paranoia. Even a 10 foot test through a non-windowed wall would have been enough (it just wasn't feasible for me to test that short a distance.)

If I sit down in a restaurant and my car is on the other side of a solid wall, my car might be vulnerable to anyone wandering by. Keep in mind that I might only be 6-10 feet away from the car (on the other side of a wall.) At this distance, someone just walking by the car might cause the welcome lights to turn on... and the door button light to illuminate. Suddenly, a person who might never have given my car a second thought becomes curious. They press that welcoming button the driver door... and the door pops open! Wow! My phone doesn't even let me know that my car was just opened...

Keep in mind that this is all about PASSIVE functionality on my part. I haven't pressed any buttons.


Comparing it to the fob: I haven't done any specific tests using only the fob, though it would probably be a good idea.

Now waaaait a minute, are you saying the car detects people approaching it based on heat/camera signatures, as opposed to using the signal strength/distance of the fob/phone that belongs/is paired to the car?

If so, that’s news to me. I’ve never experienced this before, and have only known of Teslas and some very unobtainable vehicles having this advanced person-based approach detection feature.

Sponsored

 

[garyd9]

Now waaaait a minute, are you saying the car detects people approaching it based on heat/camera signatures, as opposed to using the signal strength/distance of the fob/phone that belongs/is paired to the car?

If so, that’s news to me. I’ve never experienced this before, and have only known of Teslas and some very unobtainable vehicles having this advanced person-based approach detection feature.

I'm not saying I have any clue whatsoever how the car detects people approaching.

However, It's common knowledge that people walking around the car when the PaaK or fob is nearby (and it doesn't need to be the phone or fob moving around) keeps waking up the car. I don't know how it works, only that it does.

If my car is parked in my garage (basement level) with the fob (and my phone) upstairs (main level of my house), and I walk around my car, it's constantly waking up, clicking, turning on welcome lights, etc. After a while it stops, but I think I've read that older versions of the firmware didn't stop and would cause 12v battery drains!

 

[User100723]

I'm not saying I have any clue whatsoever how the car detects people approaching.

However, It's common knowledge that people walking around the car when the PaaK or fob is nearby (and it doesn't need to be the phone or fob moving around) keeps waking up the car. I don't know how it works, only that it does.

If my car is parked in my garage (basement level) with the fob (and my phone) upstairs (main level of my house), and I walk around my car, it's constantly waking up, clicking, turning on welcome lights, etc. After a while it stops, but I think I've read that older versions of the firmware didn't stop and would cause 12v battery drains!

Wow ok, gotta try that and see if I get the same reaction. It’s just fascinating to me if our cars actually have that kind of an advanced system onboard.

otoh, I have a feeling the reason some are experiencing their car waking up even though fob/phone itself is not moving but within range might just be because of short interference with the transmitted signal.

In your experiments, have you tried to turn the car around so that the rear is facing the direction of the phone, and approach the car in a way where you’re not crossing between or alongside the path of the phone’s signal to the car? Maybe the key (no pun intended) is to try to align the car in a way so that the chances of someone accidentally causing the car to wake up to a reconnected PAAK signal due to walking alongside or between the signal path are reduced?

 

[Ravensfan1996]

So with my Car in the garage, and my phone on the counter in the kitchen maybe 15 ft away my PAAK does not allow me to open the doors.

 

[garyd9]

In your experiments, have you tried to turn the car around so that the rear is facing the direction of the phone, and approach the car in a way where you’re not crossing between or alongside the path of the phone’s signal to the car? Maybe the key (no pun intended) is to try to align the car in a way so that the chances of someone accidentally causing the car to wake up to a reconnected PAAK signal due to walking alongside or between the signal path are reduced?

No... I never wanted to get that far into experimenting. I just had a simple question of "what if" and tried it. Having answered my question, I turned off PaaK and I'm really not concerned about it anymore.

I'm very happy carrying around a fob in addition to my phone. I've been doing that for years.

 

[AhardFSU]

If location services are not set to "always allow", then force-closing FordPass on iOS does prevent PAAK from functioning. I've confirmed that many times. The car does not wake up or connect to the phone with the app closed.

If location services are set to "always allow" FordPass can persist in the background by constantly requesting your location, and PAAK will continue to work even if FordPass is closed.

Despite the warnings from the app, I recommend leaving FordPass location permissions set to "while using" only so quitting the FordPass app will disable PAAK. It will also use less phone battery that way.

I don't doubt you're correct, but the way iOS manages whether BLE has access to the app is affected by the location permission setting and whether the app has a current saved state.

So I just did this using my Iphone. Location Services was set to 'Always allow'. Even if I closed the Ford Pass app by flicking up from the bottom of the app, my car would open freely. However, when I changed Location Services to 'While using the app', and I closed the Ford Pass app, I could never get the car to open no matter how many times I put my phone next to the button on the door. Even after walking away and coming back I could never get it open.

So as you mentioned, the rule of thumb for iphone users is to set the Location Services to "While using the app' for the Ford Pass app. That way your car won't just open if you're 30, 40, 50 or 1 ft away as long as the app is closed.

You Android users also have a similar setting. You can select "Allowed only while in use" under Location Services for the Ford Pass app.

 

[Jerrytball]

The only thing strange I noticed today was I could open the car, I could open the front and the back of the car, I could block the car, but I went to start, and all I got was starting climate, climate failed to start, and the car did not start With the phone remotely, but when I got in the car started fine

 

[ThatGuyLando]

I can't get the car to open consistently with my phone in my pocket...

 

[AhardFSU]

I can't get the car to open consistently with my phone in my pocket...

Same.

 

[Secret Sauce]

If location services are not set to "always allow", then force-closing FordPass on iOS does prevent PAAK from functioning. I've confirmed that many times. The car does not wake up or connect to the phone with the app closed.

If location services are set to "always allow" FordPass can persist in the background by constantly requesting your location, and PAAK will continue to work even if FordPass is closed.

Despite the warnings from the app, I recommend leaving FordPass location permissions set to "while using" only so quitting the FordPass app will disable PAAK. It will also use less phone battery that way.

I don't doubt you're correct, but the way iOS manages whether BLE has access to the app is affected by the location permission setting and whether the app has a current saved state.

Some iOS services can be terminated by deleting the saved state. Some will stop right away; others, when iOS times them out. Whenever you delete a saved state, it forces the app to start from some square one, but the behavior is app-specific. If you swipe up on Safari for example, all the open pages will return the next time the app is activated, because the URLs are stored in iCloud (unless you have turned this off). The point being, how iOS handles these events is not user-controlled, and not user facing, for the most part.

As this pertains to PAAK, I have the Location Services for the FordPass app set to "while using" but sometimes it will allow me to unlock and start the car when I am not using the app. Other times, I have to activate the app. So what is happening is not entirely clear and consistent, and this I assume happens because iOS manages so much behind the scenes.

 

[bbulkow]

I have the belief, which i haven't tested, that a phone based explicit lock somehow is different from a walk away lock in that it doesn't reopen on pure proximity sometimes.

It would certainly be unreasonable to press lock right at at the car and have it automatically and instantly unlock.

Yet, it would also seem unreasonable to explicitly lock, go far away, come back, and need to explicitly unlock. I would expect proximity to work.

Maybe there is some form of timer... Or even a single disconnect....

Any testing in this case?

If there is a difference, disabling walk away, or an explicit lock in shady situations, might be better than a full disable of paak... ?

 

[RandyMache]

I haven't done the full distance-variable test like you, but I can confirm it unlocks from 20' away with my iPhone 12.

I've warned about this issue for a long time, if you park outside and your phone is nearby you should quit FordPass completely or disable Bluetooth so people can't walk up and open your car. People have had things stolen out of their Mach-E this way. The BLE technology is very difficult to effectively distance filter due to differences in phone ping response times and signal strength characteristics, which vary widely from phone to phone, and even from OS version to OS version. It's extremely difficult for Ford to keep up with the tuning/calibration for each specific phone model, so as a result the response time and/or signal strength threshold may get increased to a healthy margin to ensure it works more reliably. And then it ends up working too far away.

Luckily the car IS able to accurately determine if the PAAK is inside or outside the vehicle, so it's not going to start or drive for a kleptomaniac. They just get inside and rummage around.

The fob is a lot better because it's a known hardware configuration, so time-of-flight performance can be precisely characterized. Therefore the distance filter on the fob (about 4' max) is very tight and works well, the car will never open if the fob is 8' away (unless a relay attack is used).

The problem is BLE really wasn't designed to be used for Phone As A Key, so it doesn't work perfectly and the technology didn't live up to its expectations. The solution for these inconsistent ranging problems is to move from using BLE to UWB technology which has a defined timing standard and centimeter ranging accuracy. Hopefully we see that technology in the next-gen EVs.

If my phone and key fob are 10 feet away, I can't get in my MME. I have to be within 1 meter for my locks to unlock.

 

[Space_Pony]

I keep my fob and my phone just inside from the attached garage, about 10 ft from the car. The mme door will not open unless I carry the phone or fob to the car. I would rather the car remain unlocked since it's in a locked garage but it always locks on its own.

 

[thenew3]

If the MME doesn't use UWB, how does it detect when the phone is far away enough and auto lock the car (walk away lock)?

My car locks when I walk 10-15 feet away. My phone is still connected to the car via BT and I can still lower/raise windows from the app. so how does it know I've walked sufficiently away to lock the car while the BT is still connected? (I can easily connect to BT even from 50-100 ft away).

 

[Fixbear]

If the MME doesn't use UWB, how does it detect when the phone is far away enough and auto lock the car (walk away lock)?

My car locks when I walk 10-15 feet away. My phone is still connected to the car via BT and I can still lower/raise windows from the app. so how does it know I've walked sufficiently away to lock the car while the BT is still connected? (I can easily connect to BT even from 50-100 ft away).

Yes, but it uses the door control modules. They have shorter detection ranges.

Sponsored