Ok, I’m missing something then.

What is CSS used for?

Right, that’s what I understood. So using a VPN, a CSS will be able to identify that my phone is active, but not the content I’m accessing, or who I am accessing it from, correct?

The previous comment said VPNs do nothing against this type of attack- were they just referring to identifying your device?

Forgive my ignorance, but isn’t preventing this type of man in the middle attack exactly what VPNs are for?

Head units are no longer a seperate component.