[ajayc123]

Originally Posted by mobike008

"Building" cars is an alien concept in India. It's pretty common here in US or elsewhere in the world. You pay for a base car and then build on top of it for features that you want.

If you are implying that the base model has all the top end features waiting to be activated using a switch, then I would call it a lot of hardware added to the car thar may never get used. Would you imagine a fearure like ADAS or 360 degree camera to be activated by a switch?

Building on top of a base model coukd be a configurator which is different from switching on a feature, which is the essence of this thread.

What value is seen by adding a heated seat that may never be activated? To me its a collosal waste.

[Vid6639]

Originally Posted by Samurai

As someone working with cryptography for a long time, I can tell you it is not possible. Otherwise, all ecommerce would have collapsed long ago.

Samu don't say that. BMW and VAG owners enable almost all features of their cars using aftermarket apps and dongles. lol.

I myself have a bunch of features coded and added on to my car which were not available even in my top spec one

Premium cars in India have a lot of customization so this is not something alien to us. lol. Only thing is we don't fall for these tricks to make money from us by bundling it as a service and charging monthly when the hardware is built into the car

[shyampsunder]

Originally Posted by Samurai

Will this be legal? What happens to 15 years of road tax, if you enable features after the sale?

Yes it's legal. It's similar to you buying an OEM accessory from dealer. If the same accessory came pre-installed from the factory, you would've paid the GST + roadtax. In fact BMW itself used to give out Apple car play as a software addon priced at 18% GST.
Volvo used to do the polestar software upgrade to unlock before car performance as well

[Samurai]

Originally Posted by Vid6639

Samu don't say that. BMW and VAG owners enable almost all features of their cars using aftermarket apps and dongles. lol.

I can say that, because I know how to do it. BMW/VAG have not bothered to secure their features that seriously using higher bits cryptography. May be they want an unofficial cottage industry thrive to keep the DIY community live.

But if they bring in folks who secure financial/banking software to design their feature licensing, it is game over for the app/dongle cottage industry. It is quite easy to do, they just haven't bothered with it.

Ever seen your netbanking broken into by the dongle guys? They could be 100 times richer doing that. But they can't. Ransomware guys also rely on social engineering to break into systems and not by breaking cryptography. But once they take over, they encrypt all data using cryptography, then it is impossible to open without the key. Not even your dongle guy has one in a billion chance of opening it.

It is just mathematics, and cryptography libraries (openssl) are literally free.

[kiku007]

The subscription model in general is here to stay and will most likely become commonplace in the future. However, BMW's implementation of the same is botched and only gets them negative PR in an attempt to make money by warming people's backsides for a fee.

I can see a use case where Hertz gets the top of the line BMW Electric cars for their fleet and charge their customers different rental fees based on a tiered structure that offers different options. People may have the option to choose between things like RWD, AWD, Short or Long range, performance mode enabled and the Hans Zimmer sound effects. Hertz probably just needs to use an iPad to enable it. They don't need to maintain a fleet with different variants. The possibilities are immense!

However, as a customer of BMW I want to option my BMW with heated seats, pay for it as a part of the initial purchase and be done with it. You gotta be kidding me if you want me to pay a monthly fee for that.

I think BMW should fine tune the subscription model based on the backlash.

P.S: You also have to check the current BMW or Porsche online configuration tools to get a reality check on how the options list completely changes the price segment of the model you choose. Things you may consider as standard for a luxury car are indeed optional for these brands.

[Jaggu]

Lol subscription model is such a con! Get's even worse with this idea, coz you already paid for it while purchasing the car (hardware) and then they expect to milk you more by using software subscription to enable the same feature. One must be totally bonkers to accept this, unless the base price of the car is also cheap, like one segment less. Then maybe it makes sense to go for subscribe for add on's and purchase is for short term.

Maybe a use case exists in a lease plan scenario?

Next is what? 1000$ iPhone you need to pay 3$ monthly to use FaceTime. That would be pinnacle of subscription model!

[McLaren Rulez]

Originally Posted by Samurai

As someone working with cryptography for a long time, I can tell you it is not possible. Otherwise, all ecommerce would have collapsed long ago.

It is just mathematics, and cryptography libraries (openssl) are literally free.

openssl is to achieve goals such as secure communication over open networks and user authentication against a third-party attacker. The situation here is not that - the customer is attacking BMW's protocol!

This is called jailbreaking and has been going on with iPhones, Teslas and many more. Vice has a good article for laymen on the situation with Teslas - https://www.vice.com/en/article/y3mb...es-they-expect.

[Dry Ice]

I wish they make their new grille a subscription option.

That would be acting genuinely in consumer’s interests.

[Samurai]

Originally Posted by McLaren Rulez

openssl is to achieve goals such as secure communication over open networks and user authentication against a third-party attacker. The situation here is not that - the customer is attacking BMW's protocol!

I had to scratch my head for a while wondering why you limited openssl to such a small use case. Then I realised that is the description one gets while googling for openssl. Ah, sorry sir, openssl is lot more than that. It can simply be used to secure any digital asset, and link to a trust chain. For example, any company director would have a DSC, which is mainly used to sign company documents, including form 16. I have been securing software licenses using openssl for decades now.

This is called jailbreaking and has been going on with iPhones, Teslas and many more. Vice has a good article for laymen on the situation with Teslas - https://www.vice.com/en/article/y3mb...es-they-expect.

Thanks, I remember jailbreaking android OS during the Moto defy days. That doesn't dispute I said. Right now car makers are not securing their software too hard, because high security = high inconvenience. However, as OTA updates become a norm, car makers can tighten the screw and make jail-breaking an impossibility.

[McLaren Rulez]

Originally Posted by Samurai

I have been securing software licenses using openssl for decades now.

I've no doubt you are a renowned expert at that. But with hardware elements like seat heaters already built into the car, we'll see how long BMW lasts at preventing its customers from turning them on

[Samurai]

Originally Posted by McLaren Rulez

I've no doubt you are a renowned expert at that.

That's a very silly attempt at mockery. Any Java, Perl, PHP, Python, C (many more) programmer can easily do what I just claimed, and we have plenty of such programmers in the forum itself. Practically every web application, and most software applications use cryptography at some level these days. In matter of few APIs, extremely hard encryption can be achieved. Any techie knows that, but I suppose you not a techie, which is fine. It is the underlying mathematics that does the hard encryption, not the programmer.

Originally Posted by McLaren Rulez

But with hardware elements like seat heaters already built into the car, we'll see how long BMW lasts at preventing its customers from turning them on

BMW may never secure it fully for practical reasons like logistics of key generation and provisioning. It is never perfect with systems that are not constantly online. Unlike a cloud server, a car would regularly go to places without network, and make it unable to authenticate. Therefore, they can't afford to use foolproof security.

[McLaren Rulez]

Originally Posted by Samurai

That's a very silly attempt at mockery.

Not sure why you felt it was mockery - none was intended. It was highlighting the difference between software and hardware but apologies if you took offence. Let's move on to cars now.

[aah78]

Originally Posted by Vid6639

Premium cars in India have a lot of customization so this is not something alien to us.

I think the customization here doesn't imply factory customization, but add-on aftermarket oddments (e.g. shiny steering wheel ornaments).

[clevermax]

Originally Posted by Samurai

I can say that, because I know how to do it. BMW/VAG have not bothered to secure their features that seriously using higher bits cryptography. May be they want an unofficial cottage industry thrive to keep the DIY community live.

But if they bring in folks who secure financial/banking software to design their feature licensing, it is game over for the app/dongle cottage industry. It is quite easy to do, they just haven't bothered with it.

Ever seen your netbanking broken into by the dongle guys? They could be 100 times richer doing that. But they can't.

I am totally with you on that. BMW or any other manufacturer can prevent the parallel mod industry from doing anything at all in the software if they really want to. They just don't bother, or they want those guys to do that, or they still carry the baggage of outdated computing hardware in which they coded the feature.

Consider the case of Windows. Microsoft is almost giving it for free for those who know how to activate it using some scripts that are in the public domain. One doesn't even have to run any virus-infested crack executables or activator exes. Is it because MS lacks the proficiency to prevent such activations? Not at all.

In today's connected car world, it will be easier for any company to lock down features on a software level and prevent anyone else from unlocking them. So, if we hear about someone managing to unlock even these subscription-based features, it is either a case of sensitive info leaked (private keys may be) or the manufacturer designing the feature in such a way that it could be unlocked by some backdoor options by a brilliant guy.


Coming to seat and steering heating as a subscription, it is hilarious. Would it be okay if your office chair manufacturer offered 'reclining' as a feature only to be unlocked with a subscription?

Heating finally has to happen via some heating coils or induction heating or something that converts electricity into heat. Hacking should be possible at that level if it's not possible at the software level.

[vivekkp]

I for one think this is a great move by BMW. This is purely from the Indian context.

1. As a end user you save lot of money in road tax as this is calculated as a % on the exshowroom price. You never pay road tax for the accessories you buy. Since BMW would launch it as a barebone model, the exshowroom price would remain lower.
2. BMW could also save some money w.r.t savings in the GST (not 100% sure about this one)
3. Many people who buy such luxury brand don't keep the car for more than 5 years. This is what i have observed in my personal group. Since car is a depreciating asset, why to pay for a feature when you don't intend to use the car till its end of life?