3 ms·

Even without measuring the distance you could require periodic re-authentication after entry to keep the car driving. If the attacker did a one-time relay to op

Even without measuring the distance you could require periodic re-authentication after entry to keep the car driving. If the attacker did a one-time relay to open the car and start it and then drives away they'd lose contact and thus fail the next challenge-response authentication cycle.

LeonM 4y ago
None of the keyless start systems do this, on purpose. Because this may lead to very dangerous situations. Imagine your engine shutting off on the highway, and your steering wheel locks, just because the car briefly looses response from the keyfob... Also, just about every keyless entry systems have a physical backup key, to start and drive the car in case the battery in the keyfob is empty. A periodical re-authentication would make this impossible. Stuck in the middle of the desert with a perfectly good car, but an empty keyfob battery? Well, sucks to be you, you'll likely die, but at least your car won't be vulnerable to relay attacks!
- the8472 4y ago
  That doesn't mean it's impossible to prevent relay attacks, it's just that people choose not to. Additionally, the highway scenario could also be mitigated with a warning and a grace period. The desert scenario can be mitigated with having a fallback such as having the contactless system double as a smartcard you can put into a reader or by wireless power transfer. Plus, if your contactless system fails in the desert you're screwed anyway as soon as you turn off the engine once.
IgorPartola 4y ago
Please don’t. Imagine I am driving and suddenly the car in front of me fails to reauth and suddenly stops in the middle of an intersection. That would be unnecessarily unsafe.
- privacyking 4y ago
  It could just only deactivate the car if the car is stationary. Problem solved.
  - LeonM 4y ago
    > It could just only deactivate the car if the car is stationary. Right, stop once for a traffic jam, car loses sync with keyfob, and you'll become a stationary target on a highway. Better swap out those batteries in your keyfob real quick before that 18-wheeler smashes into your car with kids in the backseat! But hey, at least your car won't be stolen! > Problem solved. I guess this proves my point I was trying to make in my original post. Every xx months a sensation article like this comes out, and suddenly everyone, even on HN, becomes an expert that will 'just' solve the issue with a naive solution. Car manufacturers, hire smart engineers. If the solution was simple, they would have fixed it already. Cars are always a trade-off between safety, security, reliability, affordability and practicality. Great that your solution makes car theft resistant, but if also kills people, it's not such a great sell...

LeonM 4y ago

None of the keyless start systems do this, on purpose. Because this may lead to very dangerous situations. Imagine your engine shutting off on the highway, and your steering wheel locks, just because the car briefly looses response from the keyfob... Also, just about every keyless entry systems have a physical backup key, to start and drive the car in case the battery in the keyfob is empty. A periodical re-authentication would make this impossible. Stuck in the middle of the desert with a perfectly good car, but an empty keyfob battery? Well, sucks to be you, you'll likely die, but at least your car won't be vulnerable to relay attacks!

the8472 4y ago
That doesn't mean it's impossible to prevent relay attacks, it's just that people choose not to. Additionally, the highway scenario could also be mitigated with a warning and a grace period. The desert scenario can be mitigated with having a fallback such as having the contactless system double as a smartcard you can put into a reader or by wireless power transfer. Plus, if your contactless system fails in the desert you're screwed anyway as soon as you turn off the engine once.

IgorPartola 4y ago

Please don’t. Imagine I am driving and suddenly the car in front of me fails to reauth and suddenly stops in the middle of an intersection. That would be unnecessarily unsafe.

privacyking 4y ago
It could just only deactivate the car if the car is stationary. Problem solved.
- LeonM 4y ago
  > It could just only deactivate the car if the car is stationary. Right, stop once for a traffic jam, car loses sync with keyfob, and you'll become a stationary target on a highway. Better swap out those batteries in your keyfob real quick before that 18-wheeler smashes into your car with kids in the backseat! But hey, at least your car won't be stolen! > Problem solved. I guess this proves my point I was trying to make in my original post. Every xx months a sensation article like this comes out, and suddenly everyone, even on HN, becomes an expert that will 'just' solve the issue with a naive solution. Car manufacturers, hire smart engineers. If the solution was simple, they would have fixed it already. Cars are always a trade-off between safety, security, reliability, affordability and practicality. Great that your solution makes car theft resistant, but if also kills people, it's not such a great sell...