There seem like so many ways to make this more secure than a public-but-hard-to-guess URL. Am I missing them? Does anyone have ideas on why it's a bad idea to for example require a login?
Edit: just want to append that this is really neat! I don't think it's dumb at all but my knee-jerk reaction was "aaah somehow this will turn into someone hacking cars that aren't theirs"
I agree users will want something better. I want to learn a little more about who the potential users are before implementing an authentication system for them.
For example, if this were to be strictly a consumer app, then Google or Facebook auth would make sense. If this ends up being used by businesses, that speaks to another solution perhaps.
It's an interesting idea, but I fail to see how it compares to TinyURL. Wouldn't this be closer to "Quantified self for your car" ? I could see the data plugged into something that would allow me to predict when I should fill my gas tank and how much I usually spend and stuff like that.
It could be considered that, but marketing it that way would make people go "huh?", just like I did at first.
I see potential in turning it into a fleet management solution for small businesses. Have it tell you when maintenance is coming up, track vehicle usage, etc. I'm sure there are small businesses with vehicles where the owner has better things to do that figure out what maintenance is due for what vehicle.
I don't know if I'd describe it as "TinyURL for your car", but after reading about what it does the description makes sense. It might be hard for people to initially "get" though.
Where I see some future potential is in fleet management for smaller fleets (think your local plumber that has a couple of work vans, or maybe a small taxi company, etc). Being able to inexpensively monitor the locations of the vehicles, how far they've been driven, whether there are any trouble codes, etc, might have potential. I could also see potential for having maintenance reminders built in (e.g., set up the maintenance schedule, have it remind you say 500km, 250km, 100km before maintenance is required).
All of that would require some user management stuff and vehicle management stuff, but that's just software. You've got the hardware side of things taken care of already.
Why are people so hung up on the url? What's important is the information that you can access. Its like describing Facebook as a set of urls for people
I agree the connection is weak. The similarity is that both services provide a short URL for a resource. In the case of TinURL, it is a longer URL. In the case of gping.io, it is your vehicle.
Gimme a mulligan on the tagline and I promise to come up with something better :)
There is also https://dash.by which works with many cheap OBDII devices, including Bluetooth ones. I was actually about to get started with them, but your setup is actually a cool idea. That is to say, you are combining an OBDII dongle and a cheap phone into what is essentially a single "device" which is actually internet connected.
My suggestion would be to research Automatic and Dash and see if you can improve on their setup by bundling all three components into one: try to actually create a device that combines and OBDII dongle, a GPRS modem, a GPS chip, etc. Also see if you can find and white label a cellular provider similar to RingPlus do you can do the whole thing as a service: $5/month plus a $100 device is not a bad deal.
I have one from 2008, which I don't use anymore. It speaks NMEA and it sends the data over GPRS. I guess there are 3G devices now. An advantage of GPRS is that it's everywhere (at least in Europe) because basically it's data over GSM. It's cheap. A data only SIM with 2 MB per month per year (yes MB) was 12 Euro per year. But you're not sending many positions and it's few bytes per position. I made a site like gping.io back then. Not enough customers but it could be different now.
A word of caution for any kind of GPS device, phone included. The GPS antenna needs to see the sky, best if a lot of sky. The roof of the car is enough to severely shield the GPS signal. You need assisted GPS then.
But you can hide your phone somewhere under the carpet or something and use an portable battery to have juice for weeks, this can work as a nice anti thief device. Automatic s' dongle can be easily located by a thief.
I feel that it really helps explain and accept the long list of readme-like instructions thrown on the landing page.
Otherwise one is inclined to judge the project by the standards of mainstream products (tinyurl is quite mainstream) and will likely conclude that it is overcomplicated.
On a mostly unrelated note, does anyone know of a good carrier like RingPlus in Canada? Specifically something with no contract where I can opt to get only data in bite-sized increments? This seems like it would be great for projects like this.
Edit: Petro Canada seems to have something like this, but with a somewhat annoying expiration policy.
I own a wifi-based OBDII adapter, but two things concern me about it that likely apply here as well.
1) It's always on, as the port is always powered, to my knowledge. I usually only drive on the weekends. Should I be unplugging it after each drive?
2) Security. The wifi adapter presents an open wireless network; I assume security on these bluetooth modules is also similarly lacking. What can an attacker do given the device's built-in capabilities, and what else can they do if they're able to compromise it?
To the author of this package though, it looks great. As others have mentioned, there's lots of room for growth here, and you've got the key data pipeline established.
> What can an attacker do given the device's built-in capabilities, and what else can they do if they're able to compromise it?
well, bmw DIY people have been using the OBDII port (over bluetooth, wifi, and cabled) to rewrite ECM fuel and ignition mappings between models for a very long time...
the least clever destructive thing I can think of is just zeroing an ECM out as much as is allowed by the hardware.
p.s. i'm sure other car communities do similar stuff; i'm just not well versed on them.
I think the other poster has spoken to #2 pretty well, but as for #1, I've had a USB OBDII dongle plugged into my car continuously for the last two years without issue. I imagine the wifi chip causes yours to draw a bit more power than mine, though I previously had a Bluetooth module plugged in and it didn't present any issue either. I think it's likely fine.
It depends on the module and the car. Some cars power the ODBII port all the time. Some dongles are smart enough to stop drawing power. I had cheap Bluetooth dongle that drained battery a couple of times when left plugged in for week. Better one doesn't cause any problems.
Can you elaborate on a "free" prepaid plan? I do not know anything about RingPlus. However I know that there are a few prepaid providers that offer 100mb/free a month. Would that fit?
I am also interested in which data is transmitted when? Is the data requested when I access the Webservice or is it being sent at specified intervals?
Checking the RingPlus site, the "free" plans seem to be $0/month for service + $X per unit of usage. One of their plans, for example, is $9 for (250 minutes voice + 250MB data + 250 sms + 250 mms). There is also an overage charge, but I don't know what that means. They are also ad supported, apparently, playing an audio ad before each outbound voice call you place.
This seems reasonable for some people. By contrast, for a tracfone, in addition to voice-minutes/data/etc. you also have "service days" that must paid for, even if you don't use the phone at all.
I think they mean it only uses the "data" (MB) portion of your usage, not the "voice minutes" part. As long as they keep below a few MB per month, the cost for RingPlus will be very low. Example, they give you a trial with 100MB literally free, so perhaps they can make that last a few months or years with typical usage.
Mojio[0] makes a neat integrated device that hits some of the same bullet points as this. I worked with some of their developers at an AT&T sponsored hackathon and had a good experience working with their API. Worth a look if you don't mind trading the open nature of this project for smaller packaging.
So, since this is asking for what boils down to a cheap/disposable android device, what is the cheapest one you can buy readily without resorting to sketchy ebay sellers, etc.? Used/refurb is fine.
I use a 1st gen Moto E for bluetooth OBDII monitoring. They were $99 new, and I think the latest 2nd gen is $69 new. Used ones are in the $20-$40 range. Torque Pro runs well on it, but the screen is kinda small.
No TLS anywhere on the site, manually forcing it returns a cert for sni.dreamhost.com.... have you considered (1) ditching dreamhost and (2) getting basic security? This looks really cool but lack of security in handling my location data makes me really nervous to send it all off to you. If this could be self hosted, on the other hand...
That's pretty cool. Looks like you're using the Torque app[0], which doesn't seem to do any real-time uploading. Not the end of the world, but would be kinda nice.
Interesting but there might be a major gotcha. I see on the demo page that they are using Google Maps, however the free version of Google Maps cannot be used for assets tracking as per their terms of service.
You'd need a Premier subscription starting at 10,000 per year to track 100 vehicles. Then it's around 24 USD per extra vehicle.
You can use Open Street Map to avoid that (but then forget about Street View and the like)
Judging by the number of car hacks through OBD-II lately, it sure sounds like a great idea to connect an always on, internet connected android phone with some dubious software to the OBD interface of your car!
77 comments
[ 3.1 ms ] story [ 152 ms ] threadEdit: just want to append that this is really neat! I don't think it's dumb at all but my knee-jerk reaction was "aaah somehow this will turn into someone hacking cars that aren't theirs"
For example, if this were to be strictly a consumer app, then Google or Facebook auth would make sense. If this ends up being used by businesses, that speaks to another solution perhaps.
Thanks for the feedback!
Funnily enough a hard to guess URL can actually be perfectly secure. Google uses them quite a lot inside their services, facebook too I think.
https://www.schneier.com/blog/archives/2015/07/googles_ungue...
I see potential in turning it into a fleet management solution for small businesses. Have it tell you when maintenance is coming up, track vehicle usage, etc. I'm sure there are small businesses with vehicles where the owner has better things to do that figure out what maintenance is due for what vehicle.
Where I see some future potential is in fleet management for smaller fleets (think your local plumber that has a couple of work vans, or maybe a small taxi company, etc). Being able to inexpensively monitor the locations of the vehicles, how far they've been driven, whether there are any trouble codes, etc, might have potential. I could also see potential for having maintenance reminders built in (e.g., set up the maintenance schedule, have it remind you say 500km, 250km, 100km before maintenance is required).
All of that would require some user management stuff and vehicle management stuff, but that's just software. You've got the hardware side of things taken care of already.
The words 'fleet management' may have bounced around in my head once or twice. Nod.
This is a short URL that takes you to information about your car.
I found the name confusing at first, but I can see the logic behind it.
Gimme a mulligan on the tagline and I promise to come up with something better :)
https://en.wikipedia.org/wiki/Digital_object_identifier
[0] https://www.samsara.com
I did not know about this; really exciting to find a competitor with a solution 20 times as expensive. Thank you!
My suggestion would be to research Automatic and Dash and see if you can improve on their setup by bundling all three components into one: try to actually create a device that combines and OBDII dongle, a GPRS modem, a GPS chip, etc. Also see if you can find and white label a cellular provider similar to RingPlus do you can do the whole thing as a service: $5/month plus a $100 device is not a bad deal.
I have one from 2008, which I don't use anymore. It speaks NMEA and it sends the data over GPRS. I guess there are 3G devices now. An advantage of GPRS is that it's everywhere (at least in Europe) because basically it's data over GSM. It's cheap. A data only SIM with 2 MB per month per year (yes MB) was 12 Euro per year. But you're not sending many positions and it's few bytes per position. I made a site like gping.io back then. Not enough customers but it could be different now.
A word of caution for any kind of GPS device, phone included. The GPS antenna needs to see the sky, best if a lot of sky. The roof of the car is enough to severely shield the GPS signal. You need assisted GPS then.
But, it's build-you-own-car-tracker (for 5 bucks)! That's pretty cool too, and likely resonates with the IoT/tinkerer crowd.
I feel that it really helps explain and accept the long list of readme-like instructions thrown on the landing page.
Otherwise one is inclined to judge the project by the standards of mainstream products (tinyurl is quite mainstream) and will likely conclude that it is overcomplicated.
Edit: Petro Canada seems to have something like this, but with a somewhat annoying expiration policy.
https://mobility.petro-canada.ca/plans.aspx
1) It's always on, as the port is always powered, to my knowledge. I usually only drive on the weekends. Should I be unplugging it after each drive?
2) Security. The wifi adapter presents an open wireless network; I assume security on these bluetooth modules is also similarly lacking. What can an attacker do given the device's built-in capabilities, and what else can they do if they're able to compromise it?
To the author of this package though, it looks great. As others have mentioned, there's lots of room for growth here, and you've got the key data pipeline established.
well, bmw DIY people have been using the OBDII port (over bluetooth, wifi, and cabled) to rewrite ECM fuel and ignition mappings between models for a very long time...
the least clever destructive thing I can think of is just zeroing an ECM out as much as is allowed by the hardware.
p.s. i'm sure other car communities do similar stuff; i'm just not well versed on them.
I am also interested in which data is transmitted when? Is the data requested when I access the Webservice or is it being sent at specified intervals?
This seems reasonable for some people. By contrast, for a tracfone, in addition to voice-minutes/data/etc. you also have "service days" that must paid for, even if you don't use the phone at all.
[0]https://www.moj.io
Having this come with signup, and know that my car will auto-refill when it gets below 30% and is at home or work, would be pretty darn useful.
Maybe one of the companies already does this and I just didn't realize?
http://ryancompton.net/2015/02/28/mpg/
[0]: https://play.google.com/store/apps/details?id=org.prowl.torq...
Don't you mean Vehicle VIN Number? :P
(actually though, the V in VIN stands for Vehicle so Vehicle VIN is redundant)
You'd need a Premier subscription starting at 10,000 per year to track 100 vehicles. Then it's around 24 USD per extra vehicle.
You can use Open Street Map to avoid that (but then forget about Street View and the like)
My BMW i3 sounds its alarm because it assumes that an OBD connected when the car is locked belongs to a thief.
So, worth finding someone with the same model car as you to ensure compatibility.