PSA: Unauthorized API use can disable your FordPass account

[waltermorel]

I just heard back from Ford.

I was told that allowing third party apps use of my account is a violation of the terms and conditions for that account, and if I do not remove my account information from Tronity, my FP account may be permanently disabled. I am sure this applies to the widget I have been using also.

This is a huge negative strike against Ford in my book. It is the wrong policy especially because I consider the data my car produces to belong to me, not Ford.

I have almost a year of my car's data in Tronity and now I don't have any choice but to stop it. I was really looking forward to getting another winter of driving data to compare with last year.

To say I am pissed off is putting it mildly.

I’m in the same position and removed my Tronity account. Unfortunately I’m still waiting my Fordpass to be reactivated. How long did it take for you ?

Sponsored

 

[mkhuffman]

I’m in the same position and removed my Tronity account. Unfortunately I’m still waiting my Fordpass to be reactivated. How did it take for you ?

I have not cancelled Tronity yet, but will be doing it shortly. And then I will tell Ford I am "clean" and they will request the account to be reactivated.

I checked the Tronity web site and it appears they are aware of the issue, because you cannot add any Ford vehicles at this time:

 

[x19]

I have not cancelled Tronity yet, but will be doing it shortly. And then I will tell Ford I am "clean" and they will request the account to be reactivated.

I checked the Tronity web site and it appears they are aware of the issue, because you cannot add any Ford vehicles at this time:

Interesting, as I only started using Tronity on October 1 — so I was still able to add my car less than two weeks ago. I wonder if Ford is doing a gradual enforcement rollout.

 

[mkhuffman]

Interesting, as I only started using Tronity on October 1 — so I was still able to add my car less than two weeks ago. I wonder if Ford is doing a gradual enforcement rollout.

This is what you could have been able to do if Ford had a reasonable policy about letting us access our own data:

 

[Arjan]

I am in the same boat as you guys, i have put the linked car (in Tronity)on "pause" so no more data is being pulled. Still waiting on any reaction from ford.

Data was still being put into Tronity and Fordpass, just logging in on any webbrowser failed

The data from Tronity is awesome !

 

[mkhuffman]

On a good note, the EA team said they are going to put in an enhancement request for those of us who want to use services like Tronity. So in about 25 years, we may get access to our car's data.

 

[Mach-Lee]

Wow, I’m surprised all you guys have been using this tronity app (I’ve never heard of before) and provided your Ford login to do so. You probably have 12V drains. Ford is finally cracking down on API-abusing apps. The new way (FordConnect API) will use OAuth so your password is not seen by any 3rd parties, and will likely include rate limits so the apps stop draining 12V batteries from endless polling. Yes it’s against terms of service to give your login to a 3rd party app.

Apps that use the smartcar API provider will probably be next, that’s another big API abuser. Basically if you ever gave out your Ford password in an app you should be concerned.

 

[DadzBoyz]

I would love to make my widget fully compliant, using just Oauth2 to get permission to access the API. All I need to get started would be for Ford to acknowledge my request for information how to do so.

https://developer.ford.com/apis

 

[kennelh]

https://developer.ford.com/apis

Thanks. Been been, done that, waiting for Ford to reply to my requests

 

[mkhuffman]

I reached out to Tronity and Nils responded that they are negotiating a partnership with Ford for next year. He also said he is looking for a interim solution for the rest of this year.

He offered to refund any months we can't use Tronity because of this issue.

I am a little less pissed off now. Also because Lee makes some valid points. As usual.

 

[Arjan]

Wow, I’m surprised all you guys have been using this tronity app (I’ve never heard of before) and provided your Ford login to do so. You probably have 12V drains. Ford is finally cracking down on API-abusing apps. The new way (FordConnect API) will use OAuth so your password is not seen by any 3rd parties, and will likely include rate limits so the apps stop draining 12V batteries from endless polling. Yes it’s against terms of service to give your login to a 3rd party app.

Apps that use the smartcar API provider will probably be next, that’s another big API abuser. Basically if you ever gave out your Ford password in an app you should be concerned.

Only had 1 drain message what turned out to be a light being left on by my kids....
Otherwise it was really working well.

The strange thing is that web access was denied but tronity kept on getting information.

 

[mkhuffman]

Update: it appears my account is enabled again.

I turned off Tronity and removed the Android Widget. I am very disappointed I had to do that, and it is something I will consider carefully the next time I purchase a car. Unfortunately for Ford, this does impact my decision process. They really need to correct this issue so we can get access to our data, like we should be able to.

 

[Machmus]

It's a long tread about the Tronity block on this german mach-e forum I found. Turn on english translation in your web browser.

https://mach-e-forum.de/thread/2467...egen-nutzung-von-drittanbieter-apps/?pageNo=3

 

[Mach-Lee]

It's a long tread about the Tronity block on this german mach-e forum I found. Turn on english translation in your web browser.

https://mach-e-forum.de/thread/2467...egen-nutzung-von-drittanbieter-apps/?pageNo=3

Wow they were pinging EVERY TWO MINUTES 24/7? That's a lot of API requests, no wonder they were blocked.

The issue here is server bandwidth and processing time costs money, and if somebody wants to make requests that often, they need to pay for it. If too many people get this app it could also put a significant load on Ford's servers (Ford seems to be using IBM Cloud). I'm sure Ford never anticipated this being an issue beforehand. It's been free in the past but that probably needs to change.

Ford should offer a paid API key for data access. Hopefully they are working on that, but since Ford isn't a tech company it will probably take some time. Unfortunately we are in that interim period where the tech and user demands exceed Ford's technical bandwidth at the moment.

Guessing they got a huge bill from IBM Cloud and decided to take action.

 

[mkhuffman]

Ford should offer a paid API key for data access. Hopefully they are working on that, but since Ford isn't a tech company it will probably take some time. Unfortunately we are in that interim time where the tech and user demands exceed Ford's technical bandwidth at the moment.

I don't have a problem paying for it. I was paying Tronity anyway. Hopefully that is the route they will take.

Sponsored