5 ms·

Even though there may be a legitimate use-case from a car serviceability standpoint, this does serve to illustrate the wider problem of creating backdoors in sy

Even though there may be a legitimate use-case from a car serviceability standpoint, this does serve to illustrate the wider problem of creating backdoors in systems: they always end up getting abused and into the wrong hands.

raverbashing 5y ago
Sure but there must be a way for mechanics/dealerships to work around issues with lost keys. "Oh sorry, you lost your key the car is bricked" is not an acceptable answer for a car owner.
- zelos 5y ago
  If you've lost the key then the manufacturer can presumably issue a new one once you prove you own the car.
  - mbreese 5y ago
    This is normally handled at the dealer level. Both because the dealer is the point of contact for the customer but also for speed and scalability. So, somehow dealers need the ability to reset keys. This means there are devices are kind that can do this. And with a device at every dealer, a few going missing isn’t going to uncommon. But, to me, this is the more interesting device. Using trackers (Apple or tile or whatever) isn’t what is making this possible. They might make it easier to find a target car when it’s more secluded, but a tracker isn’t the primary tech that makes the theft possible.
    - jack_pp 5y ago
      I think he meant the dealer can give you a new copy of your old key, then you wouldn't need to reset the car.
      - mbreese 5y ago
        But the dealer doesn’t have a stock of duplicate keys. That would be even worse! They might be able to lookup the key codes from the manufacturer to be able to either (a) fabricate a physical key and/or (b) program a new key fob. This would make more sense because then, at least, the manufacturer would have a record of who requested the information. And if a car was stolen, they’d know who to go back to. Also, the manufacturer would know of a particular dealer was making too many requests that something could be fishy.
  - ghaff 5y ago
    This is sort of a variation of the tradeoff if someone loses access to their Google (or whatever) account because they've lost their password, don't have access to a backup email, phone number, etc. They can either make it a fairly easy and flexible process online--in which case it's also fairly easy to game--or they can tell you to show up in Mountain View with multiple forms of identification during office hours on every other Friday.
  - bellyfullofbac 5y ago
    Well, grandparent poster is arguing this is a backdoor. Sure it is, but for me it's an acceptable backdoor, not comparable to encryption backdoors that governments want, for example for messaging apps that use E2E encryption. And of course just like any backdoor, the thieves seems to have managed to exploit it so they can steal the car without having the owner's key.
    - athenot 5y ago
      Yes. For cars, the risk is low, and there are mitigations such as insurance that can alleviate the pain. What I'm thinking is that if a car's backdoor becomes a mental concept for the general public, it might help popularize the concept of how backdoors in general can be abused. Probably acceptable for a car but not for one's life information. As of now, anytime backdoors to encryption are being "sold" by politicians, there's a messaging that goes along about how the backdoor is ultra-secure, similar to a military complex or a pile of gold in some fort. Of course it's not reality but it's the mental image many non-technical people have. So once there are a few stories about famous people (or relatives) who got their car's system backdoored, it will help raise public awareness of how inappropriate it is for things more important than cars. Maybe. I hope…
      - ghaff 5y ago
        > how backdoors in general can be abused. Probably acceptable for a car but not for one's life information. While I agree about encryption generally, I'd say it depends and it depends on your definition of a backdoor. Probably the most straightforward question for which there is not a universal answer is whether you want the entity storing that (encrypted) information to be able to provide you with access to it if you have lost access to your password and standard recovery mechanisms.
  - FDSGSG 5y ago
    >once you prove you own the car. Yeah, right. How would you do that? Have you ever bought a car? When I had to get a new key for my friends car, I just quickly printed a sales contract and faked his signature.
    - ghaff 5y ago
      In the US, the "proper" way to do this would be to present a state-issued title that matched the government-issued ID of the person making the request. However, I've never needed to do that and, as various people have remarked, there are all sorts of reasons why that might be hard to do without spending time and effort.
      - FDSGSG 5y ago
        This might work if you actually had to get a new title in order to sell the car, but you don't.
        zeusk 5y ago
        Title and registration are separate in the US. Title must be signed at sale. Registration is for on-road use and can be expired for race cars (I trailer mine to tracks). I bricked the ECU on my car while tuning and it was part of the three module handshake for the key authentication. Replacement unit from dealer required sending to BMW corporate - valid title, drivers license and proof of address. I received the ECU and dealer had to program/pair the CAS and keys I had with the new ECU.
        FDSGSG 5y ago
        > Title must be signed at sale Even then this seems like a pretty pointless exercise, titles aren't particularly difficult to forge (assuming you don't just find it in the glovebox). Without cryptographic signatures or a mandatory online ownership registry this quickly devolves into meaningless security theatre. But I suppose that's really the point, they ask for the title in order to make their customers feel safe, not to prevent crime.
  - voussoir 5y ago
    What do we do when the manufacturer goes out of business? The manufacturer of my car certainly won't be sending me any keys.
- j_not_j 5y ago
  I actually had a situation where the dealer disabled the electronic keys entirely (and by accident). They had disconnected the battery for some electrical diagnosis and neglected to re-enable the locks. When I noticed this, many days later (!), I had to take the car and both keys back for them to reprogram. I expect the car was programmed to accept the keys, and not the other way round.

raverbashing 5y ago

Sure but there must be a way for mechanics/dealerships to work around issues with lost keys. "Oh sorry, you lost your key the car is bricked" is not an acceptable answer for a car owner.

zelos 5y ago
If you've lost the key then the manufacturer can presumably issue a new one once you prove you own the car.
- mbreese 5y ago
  This is normally handled at the dealer level. Both because the dealer is the point of contact for the customer but also for speed and scalability. So, somehow dealers need the ability to reset keys. This means there are devices are kind that can do this. And with a device at every dealer, a few going missing isn’t going to uncommon. But, to me, this is the more interesting device. Using trackers (Apple or tile or whatever) isn’t what is making this possible. They might make it easier to find a target car when it’s more secluded, but a tracker isn’t the primary tech that makes the theft possible.
  - jack_pp 5y ago
    I think he meant the dealer can give you a new copy of your old key, then you wouldn't need to reset the car.
    - mbreese 5y ago
      But the dealer doesn’t have a stock of duplicate keys. That would be even worse! They might be able to lookup the key codes from the manufacturer to be able to either (a) fabricate a physical key and/or (b) program a new key fob. This would make more sense because then, at least, the manufacturer would have a record of who requested the information. And if a car was stolen, they’d know who to go back to. Also, the manufacturer would know of a particular dealer was making too many requests that something could be fishy.
- ghaff 5y ago
  This is sort of a variation of the tradeoff if someone loses access to their Google (or whatever) account because they've lost their password, don't have access to a backup email, phone number, etc. They can either make it a fairly easy and flexible process online--in which case it's also fairly easy to game--or they can tell you to show up in Mountain View with multiple forms of identification during office hours on every other Friday.
- bellyfullofbac 5y ago
  Well, grandparent poster is arguing this is a backdoor. Sure it is, but for me it's an acceptable backdoor, not comparable to encryption backdoors that governments want, for example for messaging apps that use E2E encryption. And of course just like any backdoor, the thieves seems to have managed to exploit it so they can steal the car without having the owner's key.
  - athenot 5y ago
    Yes. For cars, the risk is low, and there are mitigations such as insurance that can alleviate the pain. What I'm thinking is that if a car's backdoor becomes a mental concept for the general public, it might help popularize the concept of how backdoors in general can be abused. Probably acceptable for a car but not for one's life information. As of now, anytime backdoors to encryption are being "sold" by politicians, there's a messaging that goes along about how the backdoor is ultra-secure, similar to a military complex or a pile of gold in some fort. Of course it's not reality but it's the mental image many non-technical people have. So once there are a few stories about famous people (or relatives) who got their car's system backdoored, it will help raise public awareness of how inappropriate it is for things more important than cars. Maybe. I hope…
    - ghaff 5y ago
      > how backdoors in general can be abused. Probably acceptable for a car but not for one's life information. While I agree about encryption generally, I'd say it depends and it depends on your definition of a backdoor. Probably the most straightforward question for which there is not a universal answer is whether you want the entity storing that (encrypted) information to be able to provide you with access to it if you have lost access to your password and standard recovery mechanisms.
- FDSGSG 5y ago
  >once you prove you own the car. Yeah, right. How would you do that? Have you ever bought a car? When I had to get a new key for my friends car, I just quickly printed a sales contract and faked his signature.
  - ghaff 5y ago
    In the US, the "proper" way to do this would be to present a state-issued title that matched the government-issued ID of the person making the request. However, I've never needed to do that and, as various people have remarked, there are all sorts of reasons why that might be hard to do without spending time and effort.
    - FDSGSG 5y ago
      This might work if you actually had to get a new title in order to sell the car, but you don't.
      - zeusk 5y ago
        Title and registration are separate in the US. Title must be signed at sale. Registration is for on-road use and can be expired for race cars (I trailer mine to tracks). I bricked the ECU on my car while tuning and it was part of the three module handshake for the key authentication. Replacement unit from dealer required sending to BMW corporate - valid title, drivers license and proof of address. I received the ECU and dealer had to program/pair the CAS and keys I had with the new ECU.
        FDSGSG 5y ago
        > Title must be signed at sale Even then this seems like a pretty pointless exercise, titles aren't particularly difficult to forge (assuming you don't just find it in the glovebox). Without cryptographic signatures or a mandatory online ownership registry this quickly devolves into meaningless security theatre. But I suppose that's really the point, they ask for the title in order to make their customers feel safe, not to prevent crime.
- voussoir 5y ago
  What do we do when the manufacturer goes out of business? The manufacturer of my car certainly won't be sending me any keys.
j_not_j 5y ago
I actually had a situation where the dealer disabled the electronic keys entirely (and by accident). They had disconnected the battery for some electrical diagnosis and neglected to re-enable the locks. When I noticed this, many days later (!), I had to take the car and both keys back for them to reprogram. I expect the car was programmed to accept the keys, and not the other way round.