PSA: Unauthorized API use can disable your FordPass account

[macchiaz-o]

That article is behind a paywall.

I don't know how to read the full details without logging in to one of the paywall sites, but here's more info although vague:

https://dockets.justia.com/docket/california/candce/4:2021cv04895/380949

Sponsored

 

[kwailau]

I too have been locked out of my Ford.com account due to the error: CSIAH0320E.

Spent 30 minutes on hold with Ford's customer service number but no one ever answered. Got on the chat support and got a response after 20 minutes.

The agent did confirm that the issue is with 3rd party apps like Optiwatt. Was told to delete the app. He started a case for me and said that someone will contact me 3 to 5 business days. Finger crossed.

I really like using Optiwatt though to track how much electricity I am using to charge my car. I hope the two companies will play nice with one another soon.

 

[Ravensfan1996]

I got locked out with several others yesterday. Ford said they would get back to us in 3-5days. I use to use scriptable (widget) and optiwatt, but i deleted those several months ago. Only thing that has access is ford pass, alexa app, and apple maps. I guess ill see what they say

 

[Gimme_my_MME]

I got locked out with several others yesterday. Ford said they would get back to us in 3-5days. I use to use scriptable (widget) and optiwatt, but i deleted those several months ago. Only thing that has access is ford pass, alexa app, and apple maps. I guess ill see what they say

If you never changed your password then smartcar has still been using your login

 

[kennelh]

FYI: I just received an e-mail from Recurrent titled "Ford App Issues with Recurrent"

Hello,

We noticed that we have not received any recent data from your Ford vehicle. This may be due to a vehicle sale, a FordPass password change, a disconnect request on your part, or something else.

We have become aware of an issue with Ford servers locking 3rd party app users out of their FordPass accounts and we wanted to check to see if this affected you at any point. This issue may occur after some period of time using Recurrent (via Smartcar connection) or other third party vehicle monitoring services.

If you encountered any issues your FordPass account or received any communications from Ford about it, we’d love to hear from you (reply to this email or contact us at [email protected]) so we can better understand the impact on Ford drivers.

 

[klb]

Build an API -> Gain Users -> Profit! Unless you build the API in a way that leads to lockouts.

I talked with support again today. They seem exasperated.

After waiting on hold and being disconnected a few times, I finally got through. I was transferred twice then given a direct number to a supervisor's phone when the computer crashed and the support tech was afraid they would lose the information. I spent about an hour speaking with said supervisor on Sunday. Supe spoke with security yesterday and today. Password has been reset a few times. Security says they are seeing a ping per minute to my account from a plausible network location. Nothing on my network is pinging Ford, no FordPass app, no automation, no charger. The MME is on the network... Could the vehicle be the culprit?

 

[GoGoGadgetMachE]

FYI: I just received an e-mail from Recurrent titled "Ford App Issues with Recurrent"

came here to post this myself. what a fun mess ?

 

[Mach-Lee]

Build an API -> Gain Users -> Profit! Unless you build the API in a way that leads to lockouts.

I talked with support again today. They seem exasperated.

After waiting on hold and being disconnected a few times, I finally got through. I was transferred twice then given a direct number to a supervisor's phone when the computer crashed and the support tech was afraid they would lose the information. I spent about an hour speaking with said supervisor on Sunday. Supe spoke with security yesterday and today. Password has been reset a few times. Security says they are seeing a ping per minute to my account from a plausible network location. Nothing on my network is pinging Ford, no FordPass app, no automation, no charger. The MME is on the network... Could the vehicle be the culprit?

Here’s the list again: Optiwatt, Recurrent, ev.energy, ABRP (OTA live data), Tronity, Charge Smart MA, SmartCharge Rewards, other utility control apps, HomeBridge, Home Assistant, widgets. If you car is still on their servers it's an issue until fully removed.

 

[eltonlin]

Update on my end - thanks to the thread I called the Fordpass # (+1 (833) 385-0512) on Monday 11/28.

Spoke to a nice agent who took down my info. I told them I deleted the car from Recurrent.

Account was re-enabled today 11/29. Was expecting it to take weeks... So thanks in advance for those who reported and got this escalated to the Ford teams...

 

[Fixbear]

None that I know of.

One simple question we have to ask ourselves. Did we enter our Ford Pass login and password in anything other than Ford Pass. If so, you have breached your user agreement. Just change your password to be sure.

 

[balthisar]

Well, I'm here because I'm locked out, and get this, the only thing I have connected is Home Assistant. Locally, on my own machine. I've not given the password to anyone, or to an outside service. It's all operating on my local machine.

Someone mentioned an email address to someone at Ford. Would you mind sending me that email address? I'll write to these folks from my ford.com address (sigh, I'm a salaried engineer at Ford with access to developer.ford.com API's, and now I have to go through this crap).

I repeat: I've not used any outside service. Just my own instance of Home Assistant. Those of you that think Home Assistant is safe might want to disable FordPass until we can figure out what's going on.

 

[Fixbear]

I remember an e-mail from Ford a while back that warned about this. It said something about not sharing username and password with anyone else or the Ford.com account might be disabled. Did anyone else get that e-mail?

I did and immediately changed my password to lock out a charging app. I did notice extra polling and LVB drain, so was happy to do it. It was my warning about violating the log in agreement. Thankfully I did not get locked out.

 

[Ravensfan1996]

If you never changed your password then smartcar has still been using your login

What is smartcar?

 

[Fixbear]

So...why doesn't @Ford Motor Company prevent these unauthorized 3rd party services from being able to log into FordPass accounts? If the access shouldn't be allowed to begin with, it should be prevented rather than locking users out after the fact.

Because you gave them your log-in

 

[kennelh]

Here’s the list again: Optiwatt, Recurrent, ev.energy, ABRP (OTA live data), Tronity, Charge Smart MA, SmartCharge Rewards, other utility control apps, HomeBridge, Home Assistant, widgets. If you car is still on their servers it's an issue until fully removed.

In case anyone was wondering, the Android widget only accesses your account from the app itself. No account info is transmitted to a server. If you disable/remove the widget, that's all you need to do.

Sponsored