7 ms·
This is why keyless "start button" functions on cars is a bad idea. The old approach of keyfob to unlock the car and a real key for the ignition is safer. Hav
by RachelF 1y ago
This is why keyless "start button" functions on cars is a bad idea.
The old approach of keyfob to unlock the car and a real key for the ignition is safer.
Having multiple levels of security is good.
However, having worked in the car security industry many years ago, I discovered that car manufacturers actually like it when their customer's cars are stolen - Insurance payouts often result in another sale.
- someothherguyy 1y agoAs a DIY option, there are definitely ways you could add MFA-like security with a simple switch/relay (attached to said authentication factor) in most ignition systems. However, that wouldn't help with the "desyncing" or unlocking aspects of this attack.
- _kb 1y agoA physical steering wheel lock works too. Not every problem needs a tech solution.
- arcanemachiner 1y agoThey're basically describing a hidden kill switch/toggle, which is just as much of a tech solution as the one you're describing. Of course, they wrapped it in some nerdy terminology, which IMO obscures the intent of their suggestion.
- bitexploder 1y agoRemovable steering wheel. Most thieves do not carry a steering wheel with them.
- _kb 1y agoRowan Atkinson approves. https://youtube.com/watch?v=yns_DhYrOpY&t=19m30s https://youtube.com/watch?v=yns_DhYrOpY&t=19m30s
- acomjean 1y agoI had a used VW gti (late last century) with an imobilizer. It let the engine crank but wouldn’t start. It also locked the hood from opening, leading to some panic when first getting the car and forgetting it had this feature. It was a circular key below the steering wheel.
- bri3d 1y agoAs far as I know no vehicles use this kind of rolling code algorithm for push button start, only key fob functions. Certainly not in Europe (due to immobilizer regulations) but I don’t believe anywhere else either. Generally, long range key fob button functions and the short range start release functions are separated, both intentionally for security reasons and due to the different problem space occupied by each. It’s also worth noting that European makes in general tend to have much better cryptographic key security. My understanding is that this is due to a combination of regulation, a relationship between insurance and automakers which requires some security standard, and a high rate of theft leading to an adversarial environment.
- majke 1y agoCan you expand on the “immobilizer regulations”? I wasn’t aware any of this was regulated in.
- bri3d 1y agoUN/ECE 116
- extraduder_ire 1y agoFrom a quick skim through the text, it seems to define what an immobiliser is, how it should work, and how it can be advertised on a car. I don't see anything in there about them being mandatory across the EU. I know some member states passed laws mandating them before that document was published. Perhaps I got the wrong document.
- bri3d 1y agoAlso take a look at 74/61/EEC. Some form of “immobilizer” has been required in Europe since 1998, and between actual ECE/UN directives and insurance partnerships, the standard increases every few years.
- inferiorhuman 1y ago
- derektank 1y agoPretty short sighted, given how much we've seen insurance rates climb for specific makes. People know you'll be paying through the nose for certain Hyundais models. That kind of brand damage can't be cheap
- appreciatorBus 1y agoSure, but in my experience, people never attribute high insurance costs to the underlying risks being high, rather they blame that on the insurance companies and then vote for people who promise to “do something about it“. I’m sure there is brand damage from people hearing that a particular car is frequently stolen, because having your car stolen as a pain. I am skeptical the analysis reaches deeper than this first level tho.
- tomatocracy 1y agoI don't think high insurance costs would result in brand damage as such. But it absolutely would result in reduced sales and/or reduced resale value, because sufficiently many people comparing which car to buy will look at the insurance cost for each particular car they are comparing as part of that decision.
- appreciatorBus 1y agoI agree that if sufficiently many people consider insurance costs in the buying decision, then a high theft rate will reduce sales. I guess I am just wondering whether or not most people actually do that. It’s been a while since I bought a car, but my impression was that many (most?) people just buy based on the biweekly payment, and everything else from depreciation to gas to insurance is an afterthought.
- vel0city 1y agoNote those Hyundai's relied on old fashioned cut keys and not electronic transponders, and the solution was electronic transponders because the old style stuff was so trivially bypassed.
- ethagnawl 1y agoI'm currently driving a rental which has this feature and I can't stand it. There is no added value and this feature exists solely to appeal to people who think it's "cool". (They must exist, right?) I guess you get used to it with time but I find myself constantly having to throw the key back into the car so I can do things like exit momentarily and keep the air conditioning going. I also don't trust that the car won't then lock itself with the key and my child inside, so I also have to remember to roll down the window.
- vachina 1y agoUnwarranted worries. I keep the fob in my pocket all the time, the car will keep running without the fob. Also usually these systems have incar fob detection. Mine will refuse to lock if it senses the fob is inside the car.
- SirMaster 1y agoThat doesn’t make sense. You can’t lock the car if your key is inside? So a bad person can just open your door and attack you because you can’t lock your door when your key is inside? My Camry has incar fob detection and I can definitely lock the car while the fob is inside.
- vachina 1y agoI meant lock the car from the outside, using the door handle.
- gertlex 1y agoThanks for the clarification. Wild to me I didn't know this external lock button was a thing (my car's 16 years old... but I drive a rental a couple times/year...).
- alias_neo 1y agoIt won't let you press the button on the handle to lock it if the key is inside and you're not, prevents you from locking the keys in the car, mine does the same, the car will beep 3 times if I try to lock it from outside while the key is inside. If you're also inside, you just press the lock button in the car and it'll lock just fine.
- nextlevelwizard 1y agoI know this might be splitting hairs, but... >The old approach of keyfob to unlock the car and a real key for the ignition is safer. "Safe" feels like wrong word to use here. Safety is not same as security. One could also argue that criminals being able to steal parked cars is safer over all for society as they then don't feel the need to car jack you while you are actually in the vehicle. If you actually want to keep your car secure (meaning criminals wont break into it or steal it in this context) just drive old beater and do not leave anything valuable in the car or trunk. I am driving a car that is nearly as old as I am and its fighting a losing battle against rust and I have nothing more valuable than trash inside the car.
- leoedin 1y ago> One could also argue that criminals being able to steal parked cars is safer over all for society as they then don't feel the need to car jack you while you are actually in the vehicle. Here in the UK vehicle theft reached an all time low in 2014. It’s doubled since then. If there was an increase in car jacking it must have been minescule by comparison. It’s not really a crime that happens here. I had an old beater van that got stolen. It turned out that model was known to be easy to steal. I suspect most car theft is done because it’s easy and fairly low risk. Walk up to a car in the night, fiddle around for a few minutes and drive off. I still drive a car with a key. It’s completely fine. Who actually asked for keyless entry?
- teruakohatu 1y ago> Who actually asked for keyless entry? Probably the vast majority of consumers? There is no reason why keyless entry cannot be more secure than a physical key, other than incompetence. The cars stolen in New Zealand are usually, as you say, cars that are known to be easy to enter and drive away. Even then, they break a window. But I have also heard of break-ins at night targeting certain high-end cars and going as far as gaining entry to a garage.
- alias_neo 1y ago> I have also heard of break-ins at night targeting certain high-end cars and going as far as gaining entry to a garage My next door neighbour had someone enter their home while they slept, take the key and drive off in their car, because it was "stolen to order" most likely. I couldn't give a shit if someone breaks in to my garage, or frankly if the car is stolen, but I don't want them coming into my house where my family is asleep for the keys. What happens if the keys weren't downstairs by the front door, because I left them on the bedside table or something? I shudder at the thought.
- jiveturkey 1y agodisagree, if you mean simple cut key. a screwdriver defeats it. ok, if you mean a key that has a chip embedded, where the key cuts are just window dressing and the real magic is still in cryptographic proof of "something you have". i am not aware of any such key ever being produced, but i certainly do not have comprehensive knowledge. GM had something close to that.
- leoedin 1y agoI’m pretty sure most cars in the later key era used some sort of chip verification on ignition for the key. It wasn’t just a physical thing. Given it was 15 years ago, I don’t know how cryptographic the proof was - perhaps it was just reading a number from the key. But the hyper short range nature of it made it quite secure.
- gchadwick 1y agoImmobilizers (which lock out the engine until there's been some authorization from another device, i.e. from a chip in the key) have been mandatory in cars in the UK at least (and I would presume Europe on similar time scales) for almost 30 years (from 1998). Seems they've been sold in cars for a few years longer than that (from 1992). According to: https://www.carwow.co.uk/guides/glossary/what-is-a-car-immobiliser https://www.carwow.co.uk/guides/glossary/what-is-a-car-immob.... Maybe never introduced into the US market? Would find that hard to believe.
- kube-system 1y agoImmobilizers were introduced into the US long before that, but never mandated.
- jiveturkey 1y agoimmobilizers that use a chip in a physical key, are to the best of my knowledge, all simple clonable protocols. the predecessor to a code was a simple resistor. i specifically meant a kind that uses private key crypto. we absolutely could have that today but we've moved on to fobs. please correct me if I'm wrong ... i haven't studied it that extensively.
- boobsbr 1y ago> car manufacturers actually like it when their customer's cars are stolen Hyundai and Kia have joined the chat
- Hamuko 1y agoExcept those guys had it go so far that trying to insure a cheap Kia was extremely expensive, since insurers considered them a toxic asset.
- kube-system 1y agoIt actually got worse than that -- some insurers in some locations were refusing to insure them at any price.
- rpcope1 1y agoI've never seen anything but problems with keyless ignitions. It really seems like a solution in search of a problem no one actually had, and makes the car much more irritating. I guess it's in line with the whole remove real controls and buttons crap because "muh software", "muh reprogrammable interfaces" etc that certain nerds think is a good idea for who knows what reason.
- kube-system 1y agoI've only ever personally seen failures with keyed ignitions. They are subject to physical wear. This is a problem solved by keyless ignitions which have zero physical wear parts.