"Reset your password..." email

[ChasingCoral]

This is incorrect, Ford has an easily accessible and publicly documented API system. You can sign up for access and read the docs at https://developer.ford.com/apis.

So, which of these accesses the EV-specific systems in the Mach E, Lightning, and eTransit?

We'll wait.

Sponsored

 

[macchiaz-o]

So, which of these accesses the EV-specific systems in the Mach E, Lightning, and eTransit?

We'll wait.

It's in there.

 

[ChasingCoral]

It's in there.

Are these the same APIs that folks used to make Apple Watch widgets that locked them out of their Ford accounts?

 

[cryptk]

Are these the same APIs that folks used to make Apple Watch widgets that locked them out of their Ford accounts?

I can't tell you anything about how the Apple watch widgets were implemented, I don't have an Apple watch and I've never looked into that code base. But I can tell you that there are projects that have used those APIs and ran into issues. I can also tell you that those projects made a few changes and they no longer run into issues.

The most common issues that I've seen as reasons for accounts being shut down while using those officially published APIs fall into two broad categories, both of which have known solutions.

- using the same account credentials for more than one integration (Ford pass counts as an integration against the API in this context). Ford's systems then see the account being logged in from multiple different IP addresses concurrently and it seems that they tend to block accounts for that. The known solution is to make a separate account per integration and share the vehicle between them.

- making too many requests to the API too quickly has also resulted in people having their accounts blocked. The solution here is obvious, don't hit the API servers so hard. As far as why Ford doesn't implement proper rate limiting on their end, your guess is as good as mine.

But what it comes down to is that there are officially published and documented APIs, there is a method to sign up for that API access as a developer (it's free, I have a developer account with Ford myself), and you cannot assume that people are doing shady back channel communications just because things are getting blocked. There have been multiple cases where Ford has blocked people for doing legitimate activities. Read my earlier post in this thread about having an account blocked because the email address had a plus sign in it. That would have resulted in the account being blocked whether I was using FordPass or a third party integration because it had nothing to do with how I was using the API, it was purely because they didn't like the format of my email address, and that reasoning came directly from Ford. The FordPass support manager spoke with the security team to determine why my account was blocked and they told him in no uncertain terms that the plus sign matches a filter that they use to detect bots.

 

[itzbilly]

I connect my Ford pass app with my con Edison ev.energy app in order to get con edison's energy incentives. I hope they find a solution soon because those like me, would like to continue getting these incentives to save on energy costs. Just last month alone Con ed compensated me with $80.00 for charging off peak hours and I have no intention of stopping this unless ford disables my account. I will try and do a work around by perhaps disabling my Ev.energy app when I am not using it and see if I continue to get this security warning!

in the same boat, relying on ev.energy for the charging incentives. had a lengthy conversation with FordPass support where they told me to use a different email with the ev.energy service.. did so and it was fine for 2 weeks but still had 29 reset password emails come in yesterday.

- using the same account credentials for more than one integration (Ford pass counts as an integration against the API in this context). Ford's systems then see the account being logged in from multiple different IP addresses concurrently and it seems that they tend to block accounts for that. The known solution is to make a separate account per integration and share the vehicle between them.

this is an interesting potential solution, any idea how we as standard consumers can set up a separate account to link our vehicles and allow our energy providers to access the Ford API without setting up such an account with FordPass?

 

[cryptk]

in the same boat, relying on ev.energy for the charging incentives. had a lengthy conversation with FordPass support where they told me to use a different email with the ev.energy service.. did so and it was fine for 2 weeks but still had 29 reset password emails come in yesterday.



this is an interesting potential solution, any idea how we as standard consumers can set up a separate account to link our vehicles and allow our energy providers to access the Ford API without setting up such an account with FordPass?

When I did it, I just registered a second account just like you would for FordPass, then I shared the vehicle over. Dysfunctionality is available for standard consumers, this is how you would do it if you shared the vehicle with someone else and you both wanted to have FordPass. I just happen to be using the second account for something other than FordPass, but I did do the account creation and vehicle sharing through it.

 

[itzbilly]

When I did it, I just registered a second account just like you would for FordPass, then I shared the vehicle over. Dysfunctionality is available for standard consumers, this is how you would do it if you shared the vehicle with someone else and you both wanted to have FordPass. I just happen to be using the second account for something other than FordPass, but I did do the account creation and vehicle sharing through it.

Wouldn't this add Fordpass as an "actively used integration" just by registering it in the first place? or would the lack of activity remove Fordpass from consideration?

 

[cryptk]

Wouldn't this add Fordpass as an "actively used integration" just by registering it in the first place? or would the lack of activity remove Fordpass from consideration?

It's not a problem with how many integrations are being used as far as we have been able to tell. It's using more than one concurrently, from different IP addresses. There is some leeway there otherwise you would get banned every time your phone went from your home wifi to it's cellular connection. It's not a "one and done" kind of ban, it's more about consistent behavior over time.

TL;DR: you are overthinking it a bit, it's not that strict.

 

[ChasingCoral]

It's possible Recurrent no longer uses Smartcar.

This page on the Recurrent website indicates they still use Smartcar:
https://support.recurrentauto.com/en/who-is-smartcar

 

[macchiaz-o]

This page on the Recurrent website indicates they still use Smartcar:
https://support.recurrentauto.com/en/who-is-smartcar

Not surprising.

Now it's up to Recurrent (or maybe Smartcar, if they choose to continue on with them) to update their Ford integration implementation to use the current, designed-for-public-use APIs. And they need to adhere to Ford's terms for usage. They did neither of these things before.

@liz_at_recurrent

 

[RickMachE]

I have no skin in this game, but my utility has programs with many car companies. None resulted in discounted energy, but all result in money back over the year (I get $100 per year in two payments).

With Ford, they contact Ford somehow and ask that vehicles in the program not be allowed to charge during a 2 hour period. Ford sends commands to the vehicles to inhibit charging. Customer can override.

That's the legit way to do it.

Recurrent, and I guess others, are trying to not do it legitimately. Or not pay for it. Recurrent has been an issue in that regard for several years, I'm surprised Ford has taken this long to take official action against them. No one should be able to run a for profit business by taking data under false pretenses, i.e. "we're the customer".

 

[itzbilly]

When I did it, I just registered a second account just like you would for FordPass, then I shared the vehicle over. Dysfunctionality is available for standard consumers, this is how you would do it if you shared the vehicle with someone else and you both wanted to have FordPass. I just happen to be using the second account for something other than FordPass, but I did do the account creation and vehicle sharing through it.

It's not a problem with how many integrations are being used as far as we have been able to tell. It's using more than one concurrently, from different IP addresses. There is some leeway there otherwise you would get banned every time your phone went from your home wifi to it's cellular connection. It's not a "one and done" kind of ban, it's more about consistent behavior over time.

TL;DR: you are overthinking it a bit, it's not that strict.

ha, created a new account to try this and got a reset password email just now (1.5 hours after). looks like this won't be a viable option for ev.energy.

 

[cryptk]

ha, created a new account to try this and got a reset password email just now (1.5 hours after). looks like this won't be a viable option for ev.energy.

Probably because that is an actual third party use case where you are giving your credentials to a third party. It's not a problem in the case of home assistant, because it's still first party usage as the application is self-hosted.

 

[cryptk]

I have no skin in this game, but my utility has programs with many car companies. None resulted in discounted energy, but all result in money back over the year (I get $100 per year in two payments).

With Ford, they contact Ford somehow and ask that vehicles in the program not be allowed to charge during a 2 hour period. Ford sends commands to the vehicles to inhibit charging. Customer can override.

That's the legit way to do it.

Recurrent, and I guess others, are trying to not do it legitimately. Or not pay for it. Recurrent has been an issue in that regard for several years, I'm surprised Ford has taken this long to take official action against them. No one should be able to run a for profit business by taking data under false pretenses, i.e. "we're the customer".

My utility has a similar program, but rather than handling it through the car, they handle it through the EVSE. The only downside there is that when I purchased my EVSE, I had to make sure it was one of the ones on the approved list, I ended up with a Charge Point Home Flex which worked with my local utilities program.

 

[RickMachE]

My utility has a similar program, but rather than handling it through the car, they handle it through the EVSE. The only downside there is that when I purchased my EVSE, I had to make sure it was one of the ones on the approved list, I ended up with a Charge Point Home Flex which worked with my local utilities program.

In 2021 my utility required one of two brands and models to get the $500 rebate. In 2023 that requirement was gone. I don't know if they're still tapping into data there or not, they were getting a data feed from JuiceBox corporate back then.

Sponsored