Incorporation of Teslemetry Authentication into TWCManager #588

Activity

1. danielsan1 commented on Jun 15, 2024

   

   danielsan1

   on Jun 15, 2024

   More actions

   Thanks for the finding! It’s the same for me unfortunately - setting up the extra domain/server thing to bring TWCmanager back to normal operations is not working for me :-/
   @ngardiner @MikeBishop can this provider help not-so-advanced users to finally make TWCmanager work properly again? (In an easy way)
2. ngardiner commented on Jun 19, 2024

   

   ngardiner

   on Jun 19, 2024

   Owner

   More actions

   This has all of the features needed to make TWCManager work (other than actually being part of the codebase today) based on what is published on their website.

   It seems a bit expensive for what it is. If someone had a subscription anyway I could see it being of use but if this was just for TWCManager I would not call it good value.

   That said, I don't think anything exists today which I would call good value. In theory it would be simple enough to host a web app which did the key generation and exchange with Tesla on your behalf, the problem being trusting that web app since it would have access to your private key.

   Then again, for how long have we been using apps/websites which fetched Tesla Auth tokens...
3. MikeBishop commented on Jun 20, 2024

   

   MikeBishop

   on Jun 20, 2024

   Collaborator

   More actions

   Trouble is, I'm fairly sure running a service that just resells access to your auth tokens is pretty blatantly against Tesla's terms of use.

   Two asides:

   • Shameless plug again: You can selfhost the same with https://github.com/MikeBishop/fleetapi-tokens, written by someone who has a fair amount of code in something you're already running, but it requires at least a bit of know-how. It assumes that you can:
     • register a domain
     • either get a static address and point that domain to it or configure dynamic DNS
     • run a web app in Docker that's accessible to the public on that address
     • register on the Tesla dev site
   • While in theory the Tesla Auth tokens apps acted locally on your machine, it's true that any of them could have exfiltrated the token elsewhere as well. The Fleet API somewhat reduces the scope of such a breach by making refresh tokens single-use -- if the attacker refreshes before you do, your refresh will fail and you'll see the error; if you refresh before the attacker does, they only get access to the car for a few hours after you use the app.