BMW ConnectedDrive lets me control my returned rental car (Sixt)
The default rental driver profile had Bluetooth disabled, so I created my own BMW ID, paired it with the car, removed the existing profile, and even triggered software updates.
When returning the car, I told the Sixt representative that I had linked my BMW ID — they assured me that the vehicle would be reset.
Today — just before deleting the “My BMW” app — I checked out of curiosity.
Surprise: I still had full remote access:
- live location tracking
- remote lock/unlock
- honking (hehe)
- turn lights on/off
At this point, the car was presumably already rented to someone else. I could track the new renter’s location and remotely interact with the car.
IMO, this exposes a serious security/privacy issue:
- BMW ConnectedDrive still had my account associated to the vehicle VIN
- Sixt’s reset procedure didn’t revoke my BMW ID access
I suspect this may not be limited to Sixt, but could affect other rental fleets using ConnectedDrive if proper backend disassociation isn’t done.
BMW allows fleet integrations via ConnectedDrive Fleet Services, but I wonder how many rental cars globally still have previous renters’ IDs attached.
I have rented BMWs in the Netherlands and don't recall being able to use these features either.
Thus you seem to have encountered a situation which BMW and Sixt know about and have procedures in place to prevent, but their Italian subsidiary seems to have missed it with a certain batch of fleet vehicles, or just this specific one. I'd report it Sixt and move on.
As the person that is entering their own personal information into a car that you do not own, you absolutely should be the one to remove that data. Do not depend on someone else doing their job. You took the time to add it, so take the time to remove it. It is the only way to be sure.
I rejected and didn't go further. I appreciate the honesty, though.
You don't need a profile on the car, at least not a manually entered profile. I always assumed the "pairing" was more of a basic handshake than some big data load/share/whatever.
It's probably for automated emergency notifications, better route tracking when GPS is unavailable, etc.
Apple does a lot of magick with their own software, and also there are some telemetry related things, I guess.
Maybe car related data is used for car integration, IDK. Need to watch [0].
[0]: https://developer.apple.com/videos/play/wwdc2016/723/
Most rental car companies don't bother setting up fleet services for their connected vehicle services. They require infrastructure that car rental companies don't seem to consider important.
I've used this mostly to remote start my rental car in cold climates. I delete my account after my rental is done, though I've learned recently that some providers, like Hyundai, make this SURPRISINGLY difficult.
The only exceptions I've seen to this are FordPass with Avis (this was locked down a few years ago) and Tesla with Hertz (before they unloaded them all).
1) physical access gives remote privileged access - this is a car, not a server! We don't lock cars in data centers, friends, family, mechanics, the car wash, valets or an entire custom base in this case may have access.
2) there is an idiosyncratic process that must be followed to ensure the vehicle is suitable for this use which is sufficiently obscure that it's often overlooked. The risks of which, are quite grave (remote tracking).
3) even if everything is done "correctly", it will limit the functionality to the product you've paid to rent.
It showed disabled in the menu, but it was definitely still active.
So SIXT are forcing this horrible feature on everyone
A much worse feature than the one everyone complains about, the one that kills the engine when idling
In the rain, driving through roadwork, with abrupt lane changes, you have to cope with the car yanking the wheel back and forth when it can't figure out where the lanes are.
Constant interruptions and problems from the computer. I've dealt with a few "modern cars" but this was over the top. I'll never rent or buy a BMW going forward.
Absolutely rock bottom by far the worst driving experience ever. Ultimate driving experience indeed. Insane and subtle annoyance, major wtfbbq moments, endless alarm dinging when you exceed whatever speed limit it incorrectly read from a sign, and on and on. The slamming on of the parking brake as you approach a large blade of grass in reverse is nerve wracking and startling even when you know it’s going to happen.
On narrow streets and in parking lots it feels less maneuverable than my full size American SUV. It may have the same turning radius despite being half the size.
Your tweet is making me laugh because honestly you cannot exaggerate how bad this car is. Every time we get in and start going my wife and I share a moment of incredulity. How can they have made this car this bad?
Before this, the strangest I had seen was in a new Renault Clio where they had removed the tachometer and instead had a large icon of a green leaf that fades in and out of existence.
I felt like that was peak modern UI "design" but now I know you can do so much worse.
https://www.theverge.com/2023/9/7/23863258/bmw-cancel-heated...
Not surprised the X2 sucks it’s the cheapest model and usually the Germans do not do well in this category. The cheap small Mercedes are similar.
The biggest annoyance is the horn beeps when I leave the car running and grab something from the trunk.
Typical German beancounter MBA run company treating SW like a cost center.
"We need to add interactive computers on cars because that's the latest hip trend, but we need to outsource it to the cheapest bidder because SW development is not a "real" engineering discipline and we don't like paying for good SW developers."
Then a manager from another division hears there's computers in cars and decides to improve his KPIs by forcing ConnectedDrive signup in every car and gets a massive promotion.
BMW lost its (not only visual but whole company) soul when they decided that catering to Chinese aesthetics will be their global image forward, and the details of how the car behaves is... nuts.
VAG lost my trust with DieselGate already.
Zee Germans.
Basically BMW goes out of its way to force drivers onto ConnectedDrive. Half of the functionality is hidden - for no clear reason - behind online ID.
You'd assume that if my wife or I open the car with our respective keys, we'd have the matching profile loaded, the seat adjusted, etc. Mwahahaha. NO! Unless the key is linked to an online ID - no soup for you! Infuriatingly stupid.
The dealer essentially forced me to create an online ID and activate ConnectedDrive saying they can't deliver the car otherwise. Immediately after, the car enrolled itself in some sort of Premium trial and never bothered to mark what functions are included and which are premium. It took 2 phone calls to get the trial cancelled and - what do you know - the traffic info was a part of it! What a bunch of wankers.
Even then, you'd assume that if they are so set of online bullshit, it would be polished. Ha, dream on. If you unlock the car and it has no cell connectivity, you get a guest profile. Car starts speaking German, all settings are at defaults, including the seat position.
I mean ... it's not my first BMW, but the pace of its enshittification is beyond belief. Stay the heck away.
My biggest peeve is when the car has several different contexts for configuration and/or auth that have been layer on each other like mud deposits. The user meanwhile has no idea that's what happened. So for example the seat position can be saved by pressing a button. But also is saved in a driver profile when the vehicle is locked. And then that driver profile can be backed by a cloud account. There's no user feedback at all as to what and where the car stored your seat position and the driver is left bemused as to why the seat is where it is and how to have it in the right place.
This is frankly just bad customer service. Companies don't take it seriously as a problem because nobody is upset about it and it doesn't affect their bottom line.
So yeah at least one of the big renters has handled it appropriately on the cars I've rented from them.
The UX is painful and now bluetooth is controlling even more portions of the car ... hilarious yet dumb and concerning.