6 ms·

Similarly, when you buy a used car, how can you be sure the previous owner didn't copy the key (you know, the thing that lets you open the door and drive away)

Similarly, when you buy a used car, how can you be sure the previous owner didn't copy the key (you know, the thing that lets you open the door and drive away) and still has it? That's not a new question. Similarly, you move into a new apartment and the super gives you the key (to the door, not a cryptographic one). You installed a new lock, right?

basseq 11y ago
In newer cars, keys are unique and registered to the car individually. My Audi has a list of all keys registered, and I can have the dealer unregister any I've lost.
- ethbro 11y ago
  Any details on how this process works? Cursory searching reveals the procedure for manually adding blank keyfobs to Audis, but what you describe above seems... a fairly technically complex system to take on faith. (Given the article we're talking about)
  - basseq 11y ago
    Technically: not a clue. Modern keys are complex things. Gone are the days where you can have a piece of metal re-cut for $5 at Home Depot. A replacement key for modern cars is an expensive proposition: they have to be custom-ordered from the factory (with proof of identity and insurance) then programmed by your dealer. Replacement keys for modern Audis/BMWs/Mercedes run $300-400 all-in. (Remember that scene from Gone in 60 Seconds? And that was 15 years ago. And also a movie.) You can buy blanks, sure, but without programming, it's nothing more than a hunk of metal. Is it somehow possible to "clone" a key? Never underestimate hackers, but it ain't easy. Per Brian-Puccio's use-case, unless the previous owner is presenting auto exploits at DefCon, you don't have to worry about someone having a copy of a key you don't know about. (And if they've lost it, you can go to the dealer and have it un-registered.) Aside: Google around for articles on new car theft: you'll find that no thieves are copying keys or hot wiring or anything like that. In fact, the "new thing" is to get a signal amplifier that allows a car's keyless entry/start system to "find" a key that's sitting 100 feet away inside someone's house or office, then just drive away.
  - basseq 11y ago
    One correction: MMI doesn't list all the registered keys, but it does track them (e.g., you just see the total number registered). I know that dealers can un-register, and I know they're unique. http://pixady.com/image/6ds http://pixady.com/image/6ds
    - ethbro 11y ago
      Neat! Thanks for the additional details. The part I was curious about was the dealership being involved in the process. In other words, who is authoritative: if the car queries the manufacturer for authorization, or if the dealership is updating the car. Both with pros and cons, ofc.

basseq 11y ago

In newer cars, keys are unique and registered to the car individually. My Audi has a list of all keys registered, and I can have the dealer unregister any I've lost.

ethbro 11y ago
Any details on how this process works? Cursory searching reveals the procedure for manually adding blank keyfobs to Audis, but what you describe above seems... a fairly technically complex system to take on faith. (Given the article we're talking about)
- basseq 11y ago
  Technically: not a clue. Modern keys are complex things. Gone are the days where you can have a piece of metal re-cut for $5 at Home Depot. A replacement key for modern cars is an expensive proposition: they have to be custom-ordered from the factory (with proof of identity and insurance) then programmed by your dealer. Replacement keys for modern Audis/BMWs/Mercedes run $300-400 all-in. (Remember that scene from Gone in 60 Seconds? And that was 15 years ago. And also a movie.) You can buy blanks, sure, but without programming, it's nothing more than a hunk of metal. Is it somehow possible to "clone" a key? Never underestimate hackers, but it ain't easy. Per Brian-Puccio's use-case, unless the previous owner is presenting auto exploits at DefCon, you don't have to worry about someone having a copy of a key you don't know about. (And if they've lost it, you can go to the dealer and have it un-registered.) Aside: Google around for articles on new car theft: you'll find that no thieves are copying keys or hot wiring or anything like that. In fact, the "new thing" is to get a signal amplifier that allows a car's keyless entry/start system to "find" a key that's sitting 100 feet away inside someone's house or office, then just drive away.
- basseq 11y ago
  One correction: MMI doesn't list all the registered keys, but it does track them (e.g., you just see the total number registered). I know that dealers can un-register, and I know they're unique. http://pixady.com/image/6ds http://pixady.com/image/6ds
  - ethbro 11y ago
    Neat! Thanks for the additional details. The part I was curious about was the dealership being involved in the process. In other words, who is authoritative: if the car queries the manufacturer for authorization, or if the dealership is updating the car. Both with pros and cons, ofc.