4 ms·

To some degree customers love it. It allows you to program your own replacement key without having to go through the manufacturer or an official dealer.

j1elo 1y ago
No doubt they would charge $100 or more for just clicking a button and having the equivalent of an NFC writer.
- colechristensen 1y ago
  When my favorite quadruped knocked my keys into the trash I had to get my car towed to the dealer for them to program me a new key. One one hand, top notch security as it was impossible to do any other way. On the other hand the total to get this done was something like $500 after everything.
  - dylan604 1y ago
    I did this to myself by placing my keys in a pocket of a bag that I've never used before when returning to the airport parking. I found the keys in the bag after paying to have it re-keyed after paying for the tow from the airport to the closest dealer.
    - mh- 1y ago
      This is totally something I'd do. I'm very organized when I travel for work and everything has a place. If I absentmindedly slip something into the wrong part of my bag, it might as well be invisible..
      - dylan604 1y ago
        I'm a great example of "for someone supposed to be smart, you do the dumbest things"
        mh- 1y ago
        Haha, I heard this a lot growing up. And now I have kids of my own..
      - imp0cat 1y ago
        Get a bluetooth tracker (Apple Air Tag, Samsung Smart Tag or the generic Google Find My compatible one for other Android devices), set it up with your phone and attach it to your car keys. Then anytime you misplace your keys, you can look at a map on your phone and it will show you where to go.
        mh- 1y ago
        Yeah, big +1 on this tip. I have AirTags on my bags themselves as well as some other things. Don't have them on my key fob, but you may have inspired me to attach one haha. The map thing when you're nearby and it goes into the sonar-like mode is super cool. Especially combined with the ping noise.
        colechristensen 1y ago
        Airtag in the glove compartment of your car.
        mh- 1y ago
        Oh this is brilliant. Why haven't I thought of this? I travel a lot for work and always take a pic of my parking space number. A few weeks back I forgot to, realized I forgot before I got in the security line and was like.. nah, I won't forget on a short trip. When I got back later that week I walked the entire floor of the garage, about 25 minutes.
        imp0cat 1y ago
        Yea, hiding one in the car is a great idea, too.
      - colechristensen 1y ago
        I have a photographic memory for items dropped in a terrible mess, years later "oh that thing is there under this and that" I also have a problem with thinking of wise places to leave something and then it is gone forever unless I dig through 75% of everything I own. After I find it I am reminded of what my thought process was.
- pkaye 1y ago
  I wonder who make more money on this. The car dealer or the manufacturer.
- hungmung 1y ago
  Well they don't call them stealerships for nothing.
IshKebab 1y ago
What does? The article is very unclear about what exactly this does.
- the_mitsuhiko 1y ago
  The attacks to rolling code keys are well known but these keys continue to exist. They allow you to pair a key yourself to the car that you buy online. Particularly in the US it's quite common that people buy used cars and then another key online that they pair themselves. You won't be able to do this for instance with VAG cars that have KESSY. First of all the immobilizer is paired to the key, secondly the only way to pair a new key to it is via the manufacturer or a licensed dealership because you need a blob from their central server. But the consequence is that people feel like they are being fleeced when they need another key, because it can cost you hundreds of dollars to pair one. In general these types of attacks are much harder in Europe where immobilizers have a legal minimum standard that manufacturers have to meet. On the other hand in the US immobilizer are entirely optional, which has famously led to KIA and Hyundai cars shipping without them and the Kia Boys TikTok phenomenon.
  - fc417fc802 1y ago
    > But the consequence is that people feel like they are being fleeced when they need another key, because it can cost you hundreds of dollars to pair one. Because the ARE being fleeced. It's an artificial dependency on the vendor on the one hand versus a blatantly insecure approach on the other. Secure pairing that can be done by the end user isn't rocket science.
    - the_mitsuhiko 1y ago
      It is a bit rocket science because cars stand around. The CAN bus can even be externally accessed if you pop open the right part of the car (common fault are adaptive headlights). It is not as trivial as people make it out to be because cars violate one of the most important principles of having good security: no physical access.
theamk 1y ago
You can have strong cryptography + ability to self-pair. See bluetooth or wifi or zigbee or many other technologies..
- fc417fc802 1y ago
  Maybe the car manufacturers should just give up and adopt BTLE. Proper security, and you could unlock with your phone.

j1elo 1y ago

No doubt they would charge $100 or more for just clicking a button and having the equivalent of an NFC writer.

colechristensen 1y ago
When my favorite quadruped knocked my keys into the trash I had to get my car towed to the dealer for them to program me a new key. One one hand, top notch security as it was impossible to do any other way. On the other hand the total to get this done was something like $500 after everything.
- dylan604 1y ago
  I did this to myself by placing my keys in a pocket of a bag that I've never used before when returning to the airport parking. I found the keys in the bag after paying to have it re-keyed after paying for the tow from the airport to the closest dealer.
  - mh- 1y ago
    This is totally something I'd do. I'm very organized when I travel for work and everything has a place. If I absentmindedly slip something into the wrong part of my bag, it might as well be invisible..
    - dylan604 1y ago
      I'm a great example of "for someone supposed to be smart, you do the dumbest things"
      - mh- 1y ago
        Haha, I heard this a lot growing up. And now I have kids of my own..
    - imp0cat 1y ago
      Get a bluetooth tracker (Apple Air Tag, Samsung Smart Tag or the generic Google Find My compatible one for other Android devices), set it up with your phone and attach it to your car keys. Then anytime you misplace your keys, you can look at a map on your phone and it will show you where to go.
      - mh- 1y ago
        Yeah, big +1 on this tip. I have AirTags on my bags themselves as well as some other things. Don't have them on my key fob, but you may have inspired me to attach one haha. The map thing when you're nearby and it goes into the sonar-like mode is super cool. Especially combined with the ping noise.
        colechristensen 1y ago
        Airtag in the glove compartment of your car.
        mh- 1y ago
        Oh this is brilliant. Why haven't I thought of this? I travel a lot for work and always take a pic of my parking space number. A few weeks back I forgot to, realized I forgot before I got in the security line and was like.. nah, I won't forget on a short trip. When I got back later that week I walked the entire floor of the garage, about 25 minutes.
        imp0cat 1y ago
        Yea, hiding one in the car is a great idea, too.
    - colechristensen 1y ago
      I have a photographic memory for items dropped in a terrible mess, years later "oh that thing is there under this and that" I also have a problem with thinking of wise places to leave something and then it is gone forever unless I dig through 75% of everything I own. After I find it I am reminded of what my thought process was.
pkaye 1y ago
I wonder who make more money on this. The car dealer or the manufacturer.
hungmung 1y ago
Well they don't call them stealerships for nothing.

IshKebab 1y ago

What does? The article is very unclear about what exactly this does.

the_mitsuhiko 1y ago
The attacks to rolling code keys are well known but these keys continue to exist. They allow you to pair a key yourself to the car that you buy online. Particularly in the US it's quite common that people buy used cars and then another key online that they pair themselves. You won't be able to do this for instance with VAG cars that have KESSY. First of all the immobilizer is paired to the key, secondly the only way to pair a new key to it is via the manufacturer or a licensed dealership because you need a blob from their central server. But the consequence is that people feel like they are being fleeced when they need another key, because it can cost you hundreds of dollars to pair one. In general these types of attacks are much harder in Europe where immobilizers have a legal minimum standard that manufacturers have to meet. On the other hand in the US immobilizer are entirely optional, which has famously led to KIA and Hyundai cars shipping without them and the Kia Boys TikTok phenomenon.
- fc417fc802 1y ago
  > But the consequence is that people feel like they are being fleeced when they need another key, because it can cost you hundreds of dollars to pair one. Because the ARE being fleeced. It's an artificial dependency on the vendor on the one hand versus a blatantly insecure approach on the other. Secure pairing that can be done by the end user isn't rocket science.
  - the_mitsuhiko 1y ago
    It is a bit rocket science because cars stand around. The CAN bus can even be externally accessed if you pop open the right part of the car (common fault are adaptive headlights). It is not as trivial as people make it out to be because cars violate one of the most important principles of having good security: no physical access.

theamk 1y ago

You can have strong cryptography + ability to self-pair. See bluetooth or wifi or zigbee or many other technologies..

fc417fc802 1y ago
Maybe the car manufacturers should just give up and adopt BTLE. Proper security, and you could unlock with your phone.