Rjevski

43 ms·

391.
by Rjevski 8y ago
In Europe not really. US is a different league I believe, one I can't comment on.
392.
by Rjevski 8y ago
Look up “VAG Tacho”: http://maltchev.com/kiti/ This tool successfully recovers SKC codes from pretty much any VAG Group’s (Volkswagen, Audi, Seat, Skoda) cars. It can also do other things like edit the odometer and pro
393.
by Rjevski 8y ago
One person in the Ars Technica comment thread says they manage a lot of these machines in an enterprise environment, so surely they would be running clean Windows without any extra crapware, ruling out this possibility.
394.
by Rjevski 8y ago
Almost every single comment you've posted so far mentions your website. While it's great that you're proud of your creation, it is not a valid reason to pitch it especially when it's completely irrelevant to the discussi
395.
by Rjevski 8y ago
Related discussion: https://news.ycombinator.com/item?id=17169314
396.
by Rjevski 8y ago
It is probably retrieving the "SKC" code which is necessary to program keys. However, this is by no means secure where the car's ECU will happily dump its entire storage (including the SKC code) over the diagnostics port if y
397.
by Rjevski 8y ago
My solution wasn't to protect against that - if you're up for desoldering stuff you may as well just replace the ECU with your own one which is happy to start the car. This was just an idea to thwart installation of compromised fi
398.
by Rjevski 8y ago
"Сигнализация" would be more akin to alarm.
399.
by Rjevski 8y ago
In my case they always had the keys, it was purely the electronics side that was failing. In fact I explicitly remember one idiot who manually broke the transponder chip inside the key in half (no idea what they were attempting to do - repl
400.
by Rjevski 8y ago
Not sure, but given the shitty cars I’ve worked on, I wouldn’t care even if they were stolen - nobody would call the police for such things - if anything they’d be glad someone took them away for free! I would probably feel differently if I
401.
by Rjevski 8y ago
There are other wireless SD cards that already run a Linux OS. The main problem would be to figure out how your camera saves the files (it might not save them in a playable format right away - for example it could save most of the data but
402.
by Rjevski 8y ago
Seems like an easy problem to solve - every ECU generates its own encryption/signing key at first boot and dumps it over the serial port, which then gets recorded somewhere. This is eventually passed down to the car’s owner in the docu
403.
by Rjevski 8y ago
Relaying would still require the owner to push a button on the keyfob, right?
404.
by Rjevski 8y ago
Not sure I agree. It’s one thing if you get physical access, replace the engine control module by a crooked one that will send the proper signals to the ignition and all the other actuators and start the car. It’s another thing if you talk
405.
by Rjevski 8y ago
I’ve never worked on a Tesla. I’ve left the trade long ago finding my way in software engineering instead. Tesla is probably the only one I’d trust though. While I don’t expect them to be bulletproof either (at least not at first), I expect
406.
by Rjevski 8y ago
The difference is that in IT, whether you are a professional or not, the systems you’re working on will still ask you for authentication. In cars, it’s security by obscurity. If you know the protocol to talk to the car’s computers via the O
407.
by Rjevski 8y ago
I wouldn’t trust a mobile carrier with anything - they can’t even protect their mobile customers from basic stuff as SMS spam or eavesdropping via SS7. Not to mention, I technically can’t see how this thing will be able to phone home if the
408.
by Rjevski 8y ago
I’m surprised they wouldn’t just arrive with a GSM/3G/LTE jammer to begin with.
409.
by Rjevski 8y ago
I had a phone stolen recently at knifepoint (attempting to sell it on a classifieds site). When I told the police I could make them come back next day (posting another ad, etc) they wouldn’t give a shit. I suspect this is the same reason.
410.
by Rjevski 8y ago
I’m curious, why not just proper cryptographic challenge-response? Key sends a “wake up” signal, car hears it and sends a random challenge, key receives it, signs it with its private key and send is back. If the response is correct the car
411.
by Rjevski 8y ago
I used to fix cars for a living. Sometimes it involved “cracking” alarm & immobiliser systems. My clients all claimed they broke/lost their keys to their car - most of the time they were believable (car stuck in front of their driv
412.
by Rjevski 8y ago
To be fair, I am not against open banking - it’s definitely a step in the right direction. But I just want people to know that it’s not a silver bullet and it’s got many shortcomings. It’s definitely not the solution to the lack of bank’s A
413.
by Rjevski 8y ago
They are not using APIs to begin with. I'm not sure what else is there to lock down. Maybe we should just let idiots be idiots, and natural selection (or in this case, financial selection?) do its thing and the problem will go away eve
414.
by Rjevski 8y ago
> Unless you put the next winning lottery numbers in there, your data isn't that valuable. My Facebook or other data obtained through web tracking is definitely more valuable than my boring bank balance. The thing about web banking
415.
by Rjevski 8y ago
> Allowing anyone to use any software to access their banking data would allow them unprecedented abilities to automate, and attack. In certain countries (Germany, etc) there are actually open protocols (FinTS/HBCI, etc) that bank
416.
by Rjevski 8y ago
My Monzo API allows me to go back to when I opened the account (back then it was just a prepaid card) in 2016. Somehow they are able to get the data directly from this "archive" which frankly shouldn't exist - Facebook is abl
417.
by Rjevski 8y ago
Honestly? My Facebook data (back when I had one) contains way more valuable data than my bank statement. Well let me give you a real example - my personal bank account is Monzo so there is an API and webhooks and all is well. My business ac
418.
by Rjevski 8y ago
I don’t see account access being abused either. People could already be giving out their credentials, but somehow it’s not happening, so I don’t see the argument against personal access tokens.
419.
by Rjevski 8y ago
> For the same reason we can't have quite a lot of other nice things - scammers and shysters will take advantage. In that case, let's get rid of cash, cards, and frankly everything, because otherwise scammers will take advantag
420.
by Rjevski 8y ago
I am prevented from accessing my own data. A lot of bank's online banking is absolutely awful and doesn't go back more than 3 months worth of transactions. Thankfully none of this bullshit actually applies to me (I use Monzo Bank

More ›