PSA: Unauthorized API use can disable your FordPass account

[cditty]

I would expect that they have a list of authorized apps as those require registration with Ford. Although I would not be surprised if Ford doesn't make it available to customer service. This is what they should make available with a link from within Ford Pass under Account > Help.

Agreed. And they could even post a list of known apps that are not allowed. They asked what I was using when I called so then a list would be possible.

Sponsored

 

[klb]

My disappointment in the FordPass app is strong and this disappointment is growing.

First, FordPass reported a ~90 mile trip at 61 miles/kWh (amazing!!!!) that never happened (and I worry that this "ghost mileage" was added to the odometer). Today, I am locked out after using only the FordPass app.

As a cloud software architect, I would prefer to run this on my own network so I know exactly which jerk to blame when things go wrong: this one! At the least, I want to be able to pull down all of the data.

Anybody have any leads on this kind of action? When Ford decides to let the software rot in n years, when they shut off the cloud services, what do you all plan to do? Or today, how are you all getting the good data out of this walled garden and into your private analytics stack?

Thanks in advance for sharing your knowledge and thoughts.

 

[cditty]

My disappointment in the FordPass app is strong and this disappointment is growing.

First, FordPass reported a ~90 mile trip at 61 miles/kWh (amazing!!!!) that never happened (and I worry that this "ghost mileage" was added to the odometer). Today, I am locked out after using only the FordPass app.

As a cloud software architect, I would prefer to run this on my own network so I know exactly which jerk to blame when things go wrong: this one! At the least, I want to be able to pull down all of the data.

Anybody have any leads on this kind of action? When Ford decides to let the software rot in n years, when they shut off the cloud services, what do you all plan to do? Or today, how are you all getting the good data out of this walled garden and into your private analytics stack?

Thanks in advance for sharing your knowledge and thoughts.

I'm a geek. I want to download my data and put it in pretty colors and graphs. Have it tell me how much it costs me to drive to mcdonald's and back or to work, etc. I can't get that from Ford. I had to go elsewhere.

 

[macchiaz-o]

While I can understand this, they are still taking away access from car features that I paid for. Ford should have blocked the incoming api calls from the websites and not canceled the user access to paid for features.

Except in this case, you published your private user credentials to Smartcar so that Smartcar could impersonate you. You gave Smartcar permission to do this, but Ford did not, and Ford owns Ford's data and services.

Most of the fault lies with Smartcar on my opinion. They should be making arrangements of their own with Ford to license and access the data they want, but they obviously haven't done so. Instead they are impersonating Ford to complete the connection and this is very obviously in violation of Ford's terms of service.

How should Ford block Smartcar while not blocking you? They could enable MFA if they are careful to do it in a way that Smartcar still won't impersonate. I'd find this inconvenient but acceptable if it's done well...

Other than that, I'm not sure what else they could do. Smartcar could make its connections through various cloud services or VPN endpoints so as to attempt to hide itself, but we as owners may be doing the same especially if you run your own phone or watch widgets or Home Assistant or whatever.

I still have my number code. Wait, what is it? Hell, I haven't used it since I set up the car.

Turn off your phone's Bluetooth and go test it. Be prepared...

Punishing the customer is never a good way to get repeat buyers. This is my first ford. If I continue to be locked out of the app and the features I use, then it will be the last. I like the car, but I don't like having paid for features and then being told I can't use them.

From your posts, it sounds like you violated the terms but were unaware. It also sounds from others' posts that Ford will eventually reenable your account if you contact them, but with a warning that you must not violate the agreement again or else you will lose access permanently...

Yeah I understand the frustration but hopefully this is also a lesson learned?

Volkswagen is also upset with Smartcar. https://www.law360.com/amp/articles/1518492

I'm guessing that as vehicle connectivity is more common, you would face this particular issue across most makes.

 

[klb]

I'm a geek. I want to download my data and put it in pretty colors and graphs. Have it tell me how much it costs me to drive to mcdonald's and back or to work, etc. I can't get that from Ford. I had to go elsewhere.

Please elaborate, what do you mean by "elsewhere"?

 

[macchiaz-o]

First, FordPass reported a ~90 mile trip at 61 miles/kWh (amazing!!!!) that never happened (and I worry that this "ghost mileage" was added to the odometer).

Check the odometer in the car. Is it wrong?

You're experiencing the same trip log calculation errors that we all see. It's just using some values from the prior trip while calculating the current trip or similar adjacency errors. It's frustrating that this doesn't get corrected.

Today, I am locked out after using only the FordPass app.

Are you sure? You never authorized any other non-Ford service with your Ford credentials? I've never heard of anyone locked out for using the FordPass app on their own phone.

 

[klb]

Check the odometer in the car. Is it wrong?

You're experiencing the same trip log calculation errors that we all see. It's just using some values from the prior trip while calculating the current trip or similar adjacency errors. It's frustrating that this doesn't get corrected.



Are you sure? You never authorized any other non-Ford service with your Ford credentials? I've never heard of anyone locked out for using the FordPass app on their own phone.

I can't check the data until the account is reactivated. I raised Cain with a supervisor at Ford support and I've been assured access by 10AM eastern tomorrow.

I had FordPass-HA running last week but deactivated and deleted it after the first set of requests because it did not add the values I sought such as data export. There was a five day gap between that usage and deactivation.

 

[SnBGC]

The problem is that Optiwatt (and all of these apps) provided a login screen which mimicked the Fordpass login screen. This is something that phishing does, not legitimate companies. I agree with you 100% on sharing userid and password with someone else. If you are reading this Optiwatt, Smartcar, and others, how about getting legit with Ford so that we can continue to use your service.

Wow. That is super sneaky. Isn't that in violation of some law or regulation? (Impersonating another business or entity) If not, it should be.

 

[cditty]

Except in this case, you published your private user credentials to Smartcar so that Smartcar could impersonate you. You gave Smartcar permission to do this, but Ford did not, and Ford owns Ford's data and services.

Most of the fault lies with Smartcar on my opinion. They should be making arrangements of their own with Ford to license and access the data they want, but they obviously haven't done so. Instead they are impersonating Ford to complete the connection and this is very obviously in violation of Ford's terms of service.

How should Ford block Smartcar while not blocking you? They could enable MFA if they are careful to do it in a way that Smartcar still won't impersonate. I'd find this inconvenient but acceptable if it's done well...

I work in IT. If I had worked on this team, I would have looked at where all the traffic was coming from. WOW. We really have 1,00 users coming from this ip range? A 2 minute look would have determined that it was X app. Block that range. Issues a warning to the user and tell them what happened. Don't block them.

Mine was actually Tronity. Don't know what Smartcar is.

 

[cditty]

Please elaborate, what do you mean by "elsewhere"?

I went to Tronity. They pull all that info from the car/api and then tell me the details I want. Didn't realize that I was breaking ford api rules.

 

[ChasingCoral]

Im not very familiar with how that is done in HomeAssistant.

The code for the integration is here: https://github.com/itchannel/fordpass-ha

But, I suspect that the HA code itself decides what user agent is specified by its http client (that is just my guess).

I stopped using the integration after that incident.

Really doubtful it was HA. There's likely thousands of people using that integration because it's used for both EV and ICE vehicles.

Can confirm, I use it, works great! But I'll be ready if they flag my account, thanks for he heads up OP.

The lockout seems to be entirely related to APIs directly accessing your vehicle or account. The person I spoke with at Ford (high up in the backside services at Ford) said it was not any of the home automation apps I had. In my case it was strictly Recurrent/Smartcar.

 

[ChasingCoral]

I finally got in touch with someone via Ford chat yesterday. All they would tell me is that my account is blocked, and that someone from "our IT department" will have to review it. I asked them for a list of apps that are "unauthorized", and unsurprisingly, they didn't have one to give me.

They are amassing a list of places where problems have been found but I doubt they will provide that list. It is likely to always remain an internal, dynamic list.

They are more likely to have a reliable list of those that are authorized but I doubt they would give that out, either.

 

[macchiaz-o]

Mine was actually Tronity. Don't know what Smartcar is.

I went to Tronity. They pull all that info from the car/api and then tell me the details I want. Didn't realize that I was breaking ford api rules.

My apologies... I lost track and thought you were using a service that used Smartcar.

I don't know how Tronity was collecting vehicle data. Did you have to provide Tronity with your personal ford.com credentials while registering the vehicle with them? If so, this is likely where the problem started.

I tried to find more info on the Tronity web site and came across this page which indicates Mustang Mach-E registrations are currently paused. Maybe they heard from Ford and are reworking towards an approved/authorized api?

https://help.tronity.io/hc/en-us/articles/360018314060-Supported-Vehicles-and-Characteristics

 

[ChasingCoral]

Volkswagen is also upset with Smartcar. https://www.law360.com/amp/articles/1518492

That article is behind a paywall.

 

[cditty]

My apologies... I lost track and thought you were using a service that used Smartcar.

I don't know how Trinity was collecting vehicle data. Did you have to provide Tronity with your personal ford.com credentials while registering the vehicle with them? If so, this is likely where the problem started.

I tried to find more info on the Tronity web site and came across this page which indicates Mustang Mach-E registrations are currently paused. Maybe they heard from Ford and are reworking towards an approved/authorized api?

https://help.tronity.io/hc/en-us/articles/360018314060-Supported-Vehicles-and-Characteristics

I honestly don't remember. I talked to the developer and they are aware of the issue. They said they suspended/paused my account until they get this figured out.

Sponsored