5 ms·

I like the idea in theory, but I'm not sure if it's practical. There's no such thing as a secure system, there are only systems with no known security issues --

I like the idea in theory, but I'm not sure if it's practical. There's no such thing as a secure system, there are only systems with no known security issues -- a vehicle that has no known security issues one day, is one discovery away from being completely open the next day. So, it would be hard to legislate the security of a system. The solution might be to incentivize a quick resolution. For example, if a security issue is found with a vehicle, there could be laws that govern how quickly a fix needs to be available, how it's made available, and how far back it goes in model years. I would suggest that the severity of the issue (life threatening | theft | inconvenience) and the number of vehicles affected, should dictate how much time they have to resolve it.

cogman10 3y ago
> There's no such thing as a secure system I mean, in modern vehicles you can pretty much get there, but you might have to give up some features. For example, walk up unlock. You need to push a button somewhere to make unlock secure. The way you get there is through FIDO. Have the engine controller ask the hardware key to confirm who it is through a handshake. Don't start/enable the engine if that handshake fails. With that in place, the route to theft involves removing/replacing the engine controller which can be a major pain to do fast. Cars with bad security systems generally involve pulling the steering column off and touching the right two wires together to start then engine. That said, preventing theft of the contents of a car is impossible. Windows break easy and it's stupid easy to push the unlock button. That can't change.
bsder 3y ago
> There's no such thing as a secure system This is tautologically true. However, the car manufacturers haven't even tried. They had the same default password for every car. Then they had wireless systems that were vulnerable to replay. Then they had wireless systems that were vulnerable to relay. etc. The wireless systems on cars need two things: encryption and time of flight detection. The problem is that adds a couple dollars of cost per car and will lock out users some amount of time inversely proportional to the development cost (which the car manufacturers will shirk on so the system will suck). So, no manufacturer will do it short of being forced by legislation. From an engineering point of view, the main limitation is the battery in the keyfob. If you interrogate the keyfob too often, it will drain the battery and consumers will complain.
vkou 3y ago
> There's no such thing as a secure system Nobody's demanding that auto manufacturers build a secure system, we are just expecting them to meet an incredibly low bar of security. The manufacturers in question, unlike their peers, have failed to clear it.
- bonestamp2 3y ago
  I agree with you, I'm just not sure how you'd wright the law that makes them clear the low bar when that bar might need to move up before the bill even becomes a law. That's why I would prioritize some kind of "security update bill" instead of trying to legislate the low bar that needs to be crossed.

cogman10 3y ago

> There's no such thing as a secure system I mean, in modern vehicles you can pretty much get there, but you might have to give up some features. For example, walk up unlock. You need to push a button somewhere to make unlock secure. The way you get there is through FIDO. Have the engine controller ask the hardware key to confirm who it is through a handshake. Don't start/enable the engine if that handshake fails. With that in place, the route to theft involves removing/replacing the engine controller which can be a major pain to do fast. Cars with bad security systems generally involve pulling the steering column off and touching the right two wires together to start then engine. That said, preventing theft of the contents of a car is impossible. Windows break easy and it's stupid easy to push the unlock button. That can't change.

bsder 3y ago

> There's no such thing as a secure system This is tautologically true. However, the car manufacturers haven't even tried. They had the same default password for every car. Then they had wireless systems that were vulnerable to replay. Then they had wireless systems that were vulnerable to relay. etc. The wireless systems on cars need two things: encryption and time of flight detection. The problem is that adds a couple dollars of cost per car and will lock out users some amount of time inversely proportional to the development cost (which the car manufacturers will shirk on so the system will suck). So, no manufacturer will do it short of being forced by legislation. From an engineering point of view, the main limitation is the battery in the keyfob. If you interrogate the keyfob too often, it will drain the battery and consumers will complain.

vkou 3y ago

> There's no such thing as a secure system Nobody's demanding that auto manufacturers build a secure system, we are just expecting them to meet an incredibly low bar of security. The manufacturers in question, unlike their peers, have failed to clear it.

bonestamp2 3y ago
I agree with you, I'm just not sure how you'd wright the law that makes them clear the low bar when that bar might need to move up before the bill even becomes a law. That's why I would prioritize some kind of "security update bill" instead of trying to legislate the low bar that needs to be crossed.