PSA: Unauthorized API use can disable your FordPass account

[mkhuffman]

I loved the data analysis Tronity provided. And I really liked having that widget on my phone that showed me the status of my car.

But I am not pissed off about losing access because I think this was not something Ford expected (even though they should have) and they didn't have the infrastructure prepared for what we wanted to do with OUR data. I think they will provide a supported API that allows third party apps to access OUR data, eventually. That is why I am not in the pissed off camp, just in the very disappointed camp. I guess that is because I tend to be an optimistic person.

Sponsored

 

[ocr_salty]

5weeks now waiting for my account to be unlocked. Got an email telling me to remove any third party access (I’ve used the widget in the past but deleted it weeks ago). Only connection left is from my energy supplier via smartcar.com who say they’re officially supported by Ford and offer API access for many companies on many vehicles, not just electric ones. Wiring now to see what happens.

However @Ford Motor Company need to take note, their handling of this is a complete joke, and they cannot withhold personal information especially when it relates to Credit/debit card and other financial data.

 

[Gimme_my_MME]

5weeks now waiting for my account to be unlocked. Got an email telling me to remove any third party access (I’ve used the widget in the past but deleted it weeks ago). Only connection left is from my energy supplier via smartcar.com who say they’re officially supported by Ford and offer API access for many companies on many vehicles, not just electric ones. Wiring now to see what happens.

However @Ford Motor Company need to take note, their handling of this is a complete joke, and they cannot withhold personal information especially when it relates to Credit/debit card and other financial data.

Smartcar is NOT supported. They are not using API calls, they are merely using your login to pull as much data from the server and then selling that information to others

 

[TRP]

I used my wife's FP account to login to FP and the app appears to work on my phone now. However, I tried to get in the car with it using PAAK and no luck. So it appears that I am stuck with the FOB while PAAK works just fine on my wife's phone ?‍

Has anyone tried creating an entirely new account? Basically leaving the original locked and just moving on? Thinking about trying this today

I'm still in the pissed camp and probably will be until @Ford Motor Company figures this out. I purchased a vehicle with 1 FOB and the ability to use my phone as a key and they have taken that away from me. I have no ability to access my financing account or do anything with the other managed services that come with this car....map updates, BC subscription, etc......

 

[SnBGC]

I remember an e-mail from Ford a while back that warned about this. It said something about not sharing username and password with anyone else or the Ford.com account might be disabled. Did anyone else get that e-mail?

 

[ocr_salty]

Smartcar is NOT supported. They are not using API calls, they are merely using your login to pull as much data from the server and then selling that information to others

They make it quite clear on their website that the pull the data from the API, and then provide it to whoever has permission from the user to view it. So in my case I provided access to my FP account, by signing in on a Ford website, and smartcar provide my SOC to Octopus Energy who command charge start/stop.

 

[Gimme_my_MME]

They make it quite clear on their website that the pull the data from the API, and then provide it to whoever has permission from the user to view it. So in my case I provided access to my FP account, by signing in on a Ford website, and smartcar provide my SOC to Octopus Energy who command charge start/stop.

That is what they say but not what they do. They spoofed the Ford website that you signed into.

 

[kennelh]

Has anyone tried creating an entirely new account? Basically leaving the original locked and just moving on? Thinking about trying this today

Yes. When I was locked out, FP was still working. We created new second e-mail account, logged into FP on a different phone, and entered the VIN. Ford sent a request to allow access to the first phone/FP account, and we accepted.

 

[Mach-Lee]

That is what they say but not what they do. They spoofed the Ford website that you signed into.

Wow, spoofing is definitely nefarious. If they are actually logging into your account that might explain why some people have been getting unsolicited verification codes in their email. That's probably Smartcar trying to log in so they can steal your data.

 

[ocr_salty]

That is what they say but not what they do. They spoofed the Ford website that you signed into.

WOW. I’ll take that up with my energy supplier than as it’s them that directed me to smartcar. Thanks!

 

[Mach-Lee]

WOW. I’ll take that up with my energy supplier than as it’s them that directed me to smartcar. Thanks!

I've found that the app authors and energy suppliers usually have no idea the extent of what Smartcar is doing. It's news to them when they find out Smartcar is collecting way more data than they requested. Smartcar may also be lying to them about being an authorized partner with Ford. There's definitely some bad dealings involved somewhere.

 

[TRP]

Yes. When I was locked out, FP was still working. We created new second e-mail account, logged into FP on a different phone, and entered the VIN. Ford sent a request to allow access to the first phone/FP account, and we accepted.

Ok, this is what I did. I used a different email and set up a new account. I had to then go to the car, delete FP from my phone and remove all keys from the car. Then set up PAAK again on both of our phones.

With my wife's login I can manage my connected services. I don't seem to have that ability on my new account. At least I have PAAK back again. I do keep the FOB in a faraday pouch in the car incase of emergency, but I should be able to use the door code and start password to get going anyway.

The only thing I do not have access to is my Ford Finance account. I'll have to call them and get that sorted out.

SnBGC.....if I did get that email, I didn't pay much attention to it. Probably because it just did not occur to me that using Optiwatt would cause an issue (that is if in fact it is the root of this for me as I suspect).

 

[phidauex]

Ford needs to get on this… We are the power users who are also big advocates of the cars. Making us miserable isn’t a good plan…

My only use right now is Home Assistant (running locally, I didn’t provide my password to any third parties) and for now everything is working.

I did create another user account which I shared the car with, but that isn’t connected to Finance or my PAAK account. Could be a good strategy for others.

Ford needs a legit API with an authentication token method, and documented usage restrictions. But until then at least they could send a message indicating that something is violating a rate limit, and then either throttle or pause responses until it is fixed rather than just disabling the account.

There are tons of valid uses for this information and if I were forced to stop all non-ford integrations that would be a meaningful part of my decision whether or not to buy another Ford.

 

[TRP]

I know Ford has a presence on here, limited maybe, but they are here. As an individual I am pretty powerless to make them take notice. As a group we would have a bigger voice. Maybe if Car and Driver or some other such publication wrote an article about it we would get there attention, I dunno, just throwing stuff out there.

 

[ocr_salty]

I've found that the app authors and energy suppliers usually have no idea the extent of what Smartcar is doing. It's news to them when they find out Smartcar is collecting way more data than they requested. Smartcar may also be lying to them about being an authorized partner with Ford. There's definitely some bad dealings involved somewhere.

Yeah I’m quite concerned now as one of the pieces of information that smartcar use is the location of the vehicle. Definitely need to take this up with my supplier.

Sponsored