9 ms·

I hear you, I just bought a new car and internet connectivity was a deal-breaker for me. Part of the reason I was in the market was I wanted to make sure to ge

I hear you, I just bought a new car and internet connectivity was a deal-breaker for me. Part of the reason I was in the market was I wanted to make sure to get one before it was impossible [1]. The dealers don't know about the cars at this level of detail. I had to use these questions to pry the data out of them: 1. Is this a connected car? Can I unlock it or start the engines from my smartphone? 2. Is that feature an option or is the feature part of the base model? 3. Can I get the connected feature later? Would I have to bring the car in to get something installed or can you enable them from your computer? #3 is a really important question. Subaru (and perhaps others) ship all their cars with the hardware for connectivity, but the actual feature requires a subscription. The car is always connected to the internet, because the dealer can start your subscription remotely, but the salesmen don't understand that implication. They're thinking solely in terms of features you're getting, not what hardware the car has. [1] It's almost impossible now to buy a new car without passive keyless entry that isn't a bottom-tier economy model, despite the well documented security problems with many of those protocols.

benjaminjackman 9y ago
What Make/Model/Years did you find that met your criteria?
- Slansitartop 9y ago
  I ended up getting a 2017 Honda Accord V6 with Sensing. I got everything that I wanted, but had to compromise and get passive keyless entry. The Toyotas Camrys also seemed good, except I couldn't find a V6 to test drive and they didn't have Android Auto. Just a note: I'm not super-paranoid about my car getting hacked. I didn't want a cellular modem because I know I won't use whatever features it enables, and I didn't want my car to be ransomed for a bitcoin. I didn't want passive keyless entry because it didn't seem like much of a convenience, and it weakens security against petty theft. My criteria, in priority order: Must haves: * V6 engine * No cellular modem * No passive keyless entry (not really available anymore, so I had to drop it as a dealbreaker) Nice to haves: * Android Auto/Carplay * Adaptive cruise control, etc.
aetherson 9y ago
My parents had cars for a long time that you could steal by breaking the window and doing something moderately easy with a commonly available tool and the steering column. They never had their car stolen and if they did, their insurance would have replaced it. At a time when crime was higher in the US and it was significantly easier to fence cars and successfully live on illicitly obtained monies than it is today. Given the above, convince me I should care about how hard it is to break into passive keyless entry cars?
- scribu 9y ago
  The difference is in how easy it is to scale an attack. Once an attacker can remotely hack a single car, they can hack all cars that have an identical configuration, with little additional cost. What happens then? Even if insurance companies could replace all affected cars simultaneously (very unlikely), they’d have to replace them with a model that isn’t affected.
  - aetherson 9y ago
    Passive keyless entry is not remotely hackable, it's locally hackable, that's not scalable and besides which cars sold today (with very few exceptions) can not self drive, so even if you could remotely unlock it you'd still need someone local to drive away with it.
    - LinuxBender 9y ago
      Numerous internet connected cars are remotely hackable and you can take over engine controls, steering, breaking. This was performed on live highways multiple times. DOT investigated at least one of the incidents involving some SUV's.
    - scribu 9y ago
      You’re of course right about passive keyless entry and perhaps the GP has that confused with other features that do require an internet connection. Anyway, even if it isn’t autonomous, suppose a car has a smartphone app that allows you to turn on the heating before getting in. And then someone exploits that and gains control over the heating. They could then proceed to drain the batteries or the fuel tank by leaving it on over night, let’s say. Not exactly a threat to national security, but still a major inconvenience.
nojvek 9y ago
Toyotas. Toyotas are really dumb cars with wheels and an engine. Granted they’ve got smarter recently but I like they haven’t gone too fancy. It’s still a dumb car that survives anything like a Nokia.

benjaminjackman 9y ago

What Make/Model/Years did you find that met your criteria?

Slansitartop 9y ago
I ended up getting a 2017 Honda Accord V6 with Sensing. I got everything that I wanted, but had to compromise and get passive keyless entry. The Toyotas Camrys also seemed good, except I couldn't find a V6 to test drive and they didn't have Android Auto. Just a note: I'm not super-paranoid about my car getting hacked. I didn't want a cellular modem because I know I won't use whatever features it enables, and I didn't want my car to be ransomed for a bitcoin. I didn't want passive keyless entry because it didn't seem like much of a convenience, and it weakens security against petty theft. My criteria, in priority order: Must haves: * V6 engine * No cellular modem * No passive keyless entry (not really available anymore, so I had to drop it as a dealbreaker) Nice to haves: * Android Auto/Carplay * Adaptive cruise control, etc.

aetherson 9y ago

My parents had cars for a long time that you could steal by breaking the window and doing something moderately easy with a commonly available tool and the steering column. They never had their car stolen and if they did, their insurance would have replaced it. At a time when crime was higher in the US and it was significantly easier to fence cars and successfully live on illicitly obtained monies than it is today. Given the above, convince me I should care about how hard it is to break into passive keyless entry cars?

scribu 9y ago
The difference is in how easy it is to scale an attack. Once an attacker can remotely hack a single car, they can hack all cars that have an identical configuration, with little additional cost. What happens then? Even if insurance companies could replace all affected cars simultaneously (very unlikely), they’d have to replace them with a model that isn’t affected.
- aetherson 9y ago
  Passive keyless entry is not remotely hackable, it's locally hackable, that's not scalable and besides which cars sold today (with very few exceptions) can not self drive, so even if you could remotely unlock it you'd still need someone local to drive away with it.
  - LinuxBender 9y ago
    Numerous internet connected cars are remotely hackable and you can take over engine controls, steering, breaking. This was performed on live highways multiple times. DOT investigated at least one of the incidents involving some SUV's.
  - scribu 9y ago
    You’re of course right about passive keyless entry and perhaps the GP has that confused with other features that do require an internet connection. Anyway, even if it isn’t autonomous, suppose a car has a smartphone app that allows you to turn on the heating before getting in. And then someone exploits that and gains control over the heating. They could then proceed to drain the batteries or the fuel tank by leaving it on over night, let’s say. Not exactly a threat to national security, but still a major inconvenience.

nojvek 9y ago

Toyotas. Toyotas are really dumb cars with wheels and an engine. Granted they’ve got smarter recently but I like they haven’t gone too fancy. It’s still a dumb car that survives anything like a Nokia.