PSA: Unauthorized API use can disable your FordPass account

[Kamuelaflyer]

Didn't say anything about paying extra. Just paid for. It was a feature on my window sticker and included in the price.

Remote start
Lock/Unlock the doors
Control the windows
Control the truck/frunk
Horn and lights.
PAK

None of these features should every be "taken" away. I paid for them when I bought my car. Ford should have some other method of linking our accounts to our cars.

Your complaint is with the company you signed up with and the third party they actually used to gather the data. They misled or possibly lied to you.

Sponsored

 

[cditty]

Your complaint is with the company you signed up with and the third party they actually used to gather the data. They misled or possibly lied to you.

No. My complaint is that Ford took away features that were paid for when I bought my car. With so many people here all being kicked/banned from the app, it shows that it was an issue for Ford. Ford should have never banned the user. Ford should have forced us to change our passwords and then blocked the IP addresses accessing their api.

 

[Kamuelaflyer]

No. My complaint is that Ford took away features that were paid for when I bought my car. With so many people here all being kicked/banned from the app, it shows that it was an issue for Ford. Ford should have never banned the user. Ford should have forced us to change our passwords and then blocked the IP addresses accessing their api.

We will just have to disagree then. Ford didn't sign up for third-party services and provide their login details to a third party. The people that have been locked out did. That part alone should have triggered alarms. Nonetheless, I do hope this all gets worked out soon.

 

[kdonnel]

No. My complaint is that Ford took away features that were paid for when I bought my car. With so many people here all being kicked/banned from the app, it shows that it was an issue for Ford. Ford should have never banned the user. Ford should have forced us to change our passwords and then blocked the IP addresses accessing their api.

You violated the TOS and had your login disabled until you were in compliance.

The third party you handed the keys to your car(login) are not to blame, only you.

 

[cditty]

You violated the TOS and had your login disabled until you were in compliance.

The third party you handed the keys to your car(login) are not to blame, only you.

You're right. I violated the terms of service by giving my details to a 3rd party. By all means, let ford come and take my car away that I paid for and that I own.

I am not talking about 3rd parties here. I am talking about Ford and their absent-mindedness in designing an app that has features that YOU paid for when you buy the car. Features that are ONLY available through their app/website. Dodge doesn't take away my remote start if I give someone my login details to their website. Kia doesn't stop me from remote unlocking my doors if I give someone my login details. Ford does. Yes, I am to blame for getting myself blocked. I never said I wasn't. My beef is with Ford banning the users from paid features instead of blocking the IP addresses that they know are accessing their APIs. THIS is what I am pissed off about. Ford, take away my Ford.com/App features. But don't touch features that I paid for when I bought the car.

And before anyone says it, I know Kai and Dodge don't have those features tied in their apps. (Dodge does but it's a paid uconnect service.). I am only trying to give an example.

 

[kdonnel]

You're right. I violated the terms of service by giving my details to a 3rd party. By all means, let ford come and take my car away that I paid for and that I own.

I am not talking about 3rd parties here. I am talking about Ford and their absent-mindedness in designing an app that has features that YOU paid for when you buy the car. Features that are ONLY available through their app/website. Dodge doesn't take away my remote start if I give someone my login details to their website. Kia doesn't stop me from remote unlocking my doors if I give someone my login details. Ford does. Yes, I am to blame for getting myself blocked. I never said I wasn't. My beef is with Ford banning the users from paid features instead of blocking the IP addresses that they know are accessing their APIs. THIS is what I am pissed off about. Ford, take away my Ford.com/App features. But don't touch features that I paid for when I bought the car.

And before anyone says it, I know Kai and Dodge don't have those features tied in their apps. (Dodge does but it's a paid uconnect service.). I am only trying to give an example.

You realize that by giving away your login details anyone at the 3rd party(and any one that hacks them) could login to ford.com or the FordPass app as you?

See the location of your car(s). Send someone to where your car is, they know where it is because FordPass tells them, open it and steal anything from it using FordPass to open the doors. Or just take the car.

They could use the FordPass app to remove your vehicle from your account.

They could use any FordPass points they found in your account.

If you financed through Ford they would have access to your finance account. I did not so I am not sure what they could do but I imagine if you have auto payments setup they could cancel them or change them so they overdraw the attached checking/savings account.

They could sign you up or cancel any of your connected services. Bluecruise, Navigation, Streaming, Alexa, or BlueOval Charge.

Use that same password and login at other sites? They have gained access to all those sites as well.

Every person who found their account locked and were forced to change their passwords should thank Ford, not be upset with them.

 

[Herb]

I ran across this Reddit thread on Optiwatt which is not too flattering of their practices
""

 

[mws2]

So.. speaking as someone in tech who deals with APIs getting overloaded, I'll make the following observations:

1) Yes, if you give your information to a third party it's against TOS. That's on you and your problem (I did this myself. I own it.)
2) Ford made the mistake of getting IBM to provide their API services and authentication for same. IBM's setup sucks rocks, in my experience.
3)Honestly, all Ford needed to do is to use a better provider. One who understands that you need to rate-limit your inbound calls.(Let's face it, would any of us mind if these tools were limited to one update per user id every 5 or 10 minutes?)

Fault on all sides, but as a huge enterprise, I'd expect better of Ford.

 

[wavyphotons]

So as a user, is there any way I can get status of the 12v battery ? I don't see it in the Ford app . And I assume even if I make a call to their API to get that, it will be considered against TOS (in case someone can write a script that users can run periodically on their own)?

 

[ThatGuyLando]

So as a user, is there any way I can get status of the 12v battery ? I don't see it in the Ford app . And I assume even if I make a call to their API to get that, it will be considered against TOS (in case someone can write a script that users can run periodically on their own)?

Haven't tried but maybe through an odb app like torque? Shouldn't violate anything because it's straight from car to phone but who knows maybe Ford will ban that too

 

[ChasingCoral]

Yup - we are trying to understand how many Ford drivers have been affected by this.

@GoGoGadgetMachE In terms of Smartcar, I am happy to put anyone in touch with them if there are concerns about lingering connectivity. The best way to do that is to email me at [email protected] so I can copy them. They have many clients aside from us so there is no way for us to access or touch their data.

After Ford got me back online 11/20, I changed my password and contacted Recurrent, removing service from my two vehicles. Unfortunately, now I’m locked out again. Smartcar is still at it.

It seems the vin needs to be removed completely from Smartcar.

Liz: How do we make this happen?

 

[bretrevans1]

Update: No reply from anyone from Ford via email or call but I did remove my Mach-E from OptiWatt. Today, my account was restored and I am able to log back into my Ford Pass. Happy for now but still want OptiWatt to work with my car!

How long after you deleted your vehicle from Optiwatt did your account get restored ?

 

[cditty]

After Ford got me back online 11/20, I changed my password and contacted Recurrent, removing service from my two vehicles. Unfortunately, note I’m locked out again. Smartcar is still at it.

It seems the vin needs to be removed completely from Smartcar.

Liz: How do we make this happen?

Good luck. I was told that after 2 times of being locked out, you are perm banned. Heard from the support line. Don't know if true or not.

 

[JimmyMachE]

Haven't tried but maybe through an odb app like torque? Shouldn't violate anything because it's straight from car to phone but who knows maybe Ford will ban that too

Yes, OBD2 dongle gives direct access to the parameters of the 12v battery:
https://www.macheforum.com/site/threads/completely-dead.23272/page-4#post-544559

 

[mkhuffman]

Yes, OBD2 dongle gives direct access to the parameters of the 12v battery:
https://www.macheforum.com/site/threads/completely-dead.23272/page-4#post-544559

But if you use to it monitor the LVB when the car is off, it will drain the battery. I would not do that on a regular basis. Yes the HVB will maintain it, but only when charge hits 40%. Not something you want to do to your LVB regularly.

Sponsored