4 ms·

This is Tesla/Elon fanboism at its finest here. How is the title clickbaity? The title says exactly what happened. Tesla took shortcuts, clear and simple. They

This is Tesla/Elon fanboism at its finest here. How is the title clickbaity? The title says exactly what happened. Tesla took shortcuts, clear and simple. They didn't implement things like code signing and there's the implementation detail where they were using certificates, but oops, we don't actually check them. If this was Ford or Toyota having this type of security lapse, then people would be all over it. The likelihood of this happening in the wild is zip because Tesla is fixing it using the OTA capabilities which is great, and I give them credit for that. But don't underestimate the seriousness of this.

Retric 6y ago
Requiring a thief both get within 15 feet of the key and know the VIN is way down on the list of known issues. Not to defend a Tesla but most car companies keyless entry features are as bad if not much worse. The only notable thing about this one is it’s over Bluetooth. Anyone wanting to steal a car can just roll up with a tow truck, so car companies don’t put a lot of effort into this stuff. Hell, I have done the got into someone else’s car sit down and realize it’s not my car. As in I unintentionally unliked the wrong car. I know of 2 other people who had similar experiences with different brands.
- stuff4ben 6y ago
  Damn! Were you/they able to start the car?? Yes, I get that other automakers are bad, but my complaint to the parent commenter was more about the so-called click-baitiness of the title. And if you weren't able to start the car that you accidentally unlocked, then this Tesla vuln is technically more serious.
  - Retric 6y ago
    I didn’t try and start the car, the seat was in a very different position so I quickly noticed something was wrong. However, one of my friends did.
  - mikestew 6y ago
    Damn! Were you/they able to start the car?? When I was an auto mechanic back in the 90s, more than once I've pulled a car into a bay that wasn't the car I was supposed to work on. The keys matched, make and model matched, must be the one that needs an oil change. And, yes, I've changed the oil on a car that wasn't there for an oil change. It didn't happen but a handful of times over a few years, but it did occasionally happen. Does it happen with modern keyless entry? Dunno, I've been a software dev for the last 25 years.
- snypher 6y ago
  Are you saying it makes it easier or harder? The VIN is right there on the windshield and a lot of people leave their keys within 15 feet of the outside/sidewalk/common areas.
  - Retric 6y ago
    It’s less secure than being able to start the car without access to the drivers key.
    - Retric 6y ago
      *more
- FireBeyond 6y ago
  > 15 feet of the key My car keys are right inside the front door, so stand on my porch and you're well within range. > and know the VIN Good thing the VIN is required by law to be visible through the front windshield of your car, which is very likely parked in your driveway, on your way to the front door.
  - Retric 6y ago
    15 feet is the range in optimal conditions. Anyway, it was clearly a vulnerability, but my comparison was to systems that would unlock and start the car without access to the key or the need to enter numbers next to a car.
boringg 6y ago
I don't care for Tesla or Elon much but I do pay attention to how media makes money. Tesla articles drive clicks which drive ad dollars. That model is frustrating and you get stories that are overblown which leads to more people disregarding stories and getting disenfranchised with publications.
- stuff4ben 6y ago
  Fair enough, I get that sentiment regarding the media. Although I don't think this article warranted the click-bait accusation.
throwaway0a5e 6y ago
People would give Toyota a pass. They'd praise Toyota's conservativeness in engineering and use that as an excuse for not being up to speed with modern security practices. It's the only other brand that gets as much fanboyism as Telsa. Ford, GM, Nissan, FCA for sure, would be raked over the coals in the comments though.
- FireBeyond 6y ago
  Yup. Jeep had a potential OTA exploit and Tesla fans were here crowing about how "stupid" they were, and how only Tesla had done OTA "right".

Retric 6y ago

Requiring a thief both get within 15 feet of the key and know the VIN is way down on the list of known issues. Not to defend a Tesla but most car companies keyless entry features are as bad if not much worse. The only notable thing about this one is it’s over Bluetooth. Anyone wanting to steal a car can just roll up with a tow truck, so car companies don’t put a lot of effort into this stuff. Hell, I have done the got into someone else’s car sit down and realize it’s not my car. As in I unintentionally unliked the wrong car. I know of 2 other people who had similar experiences with different brands.

stuff4ben 6y ago
Damn! Were you/they able to start the car?? Yes, I get that other automakers are bad, but my complaint to the parent commenter was more about the so-called click-baitiness of the title. And if you weren't able to start the car that you accidentally unlocked, then this Tesla vuln is technically more serious.
- Retric 6y ago
  I didn’t try and start the car, the seat was in a very different position so I quickly noticed something was wrong. However, one of my friends did.
- mikestew 6y ago
  Damn! Were you/they able to start the car?? When I was an auto mechanic back in the 90s, more than once I've pulled a car into a bay that wasn't the car I was supposed to work on. The keys matched, make and model matched, must be the one that needs an oil change. And, yes, I've changed the oil on a car that wasn't there for an oil change. It didn't happen but a handful of times over a few years, but it did occasionally happen. Does it happen with modern keyless entry? Dunno, I've been a software dev for the last 25 years.
snypher 6y ago
Are you saying it makes it easier or harder? The VIN is right there on the windshield and a lot of people leave their keys within 15 feet of the outside/sidewalk/common areas.
- Retric 6y ago
  It’s less secure than being able to start the car without access to the drivers key.
  - Retric 6y ago
    *more
FireBeyond 6y ago
> 15 feet of the key My car keys are right inside the front door, so stand on my porch and you're well within range. > and know the VIN Good thing the VIN is required by law to be visible through the front windshield of your car, which is very likely parked in your driveway, on your way to the front door.
- Retric 6y ago
  15 feet is the range in optimal conditions. Anyway, it was clearly a vulnerability, but my comparison was to systems that would unlock and start the car without access to the key or the need to enter numbers next to a car.

boringg 6y ago

I don't care for Tesla or Elon much but I do pay attention to how media makes money. Tesla articles drive clicks which drive ad dollars. That model is frustrating and you get stories that are overblown which leads to more people disregarding stories and getting disenfranchised with publications.

stuff4ben 6y ago
Fair enough, I get that sentiment regarding the media. Although I don't think this article warranted the click-bait accusation.

throwaway0a5e 6y ago

People would give Toyota a pass. They'd praise Toyota's conservativeness in engineering and use that as an excuse for not being up to speed with modern security practices. It's the only other brand that gets as much fanboyism as Telsa. Ford, GM, Nissan, FCA for sure, would be raked over the coals in the comments though.

FireBeyond 6y ago
Yup. Jeep had a potential OTA exploit and Tesla fans were here crowing about how "stupid" they were, and how only Tesla had done OTA "right".