Hacker News Reader

> If I were the insurance companies, I'd be putting pressure on the car companies

And also give car owners an incentive to keep their keys safer, given how many vehicles out there are vulnerable to this. Just fixing this for new cars is only half the solution.

I remember back in the 80s my parents got a discount on their insurance for installing a third brake light in the back window of their old Camaro. If my insurance gave me a discount, I'd get a faraday cage for my keys. I'm considering doing it anyway, even though my house is pretty far from my driveway, and we have cameras.

I've searched for nice-looking faraday cages but haven't found anything good. I think there's a market for fashionable key/phone faraday cages, between this car theft issue and the push to digital detox.

EDIT: curious why this is downvoted? I'm not saying that this shouldn't be fixed by car manufacturers going forward, but we need to do something about the millions of cars on the road already. Is there another solution that would make more sense? Or is there something I'm missing here?

It's unclear how the insurance company would verify you're using the faraday cage. Presumably you're not willing to accept responsibility for the loss.

Sure, this wouldn't mean I'm responsible for any theft of my vehicle, just that it would reduce the likelihood that it would happen — benefiting both the insurer and insured.

The companies could even give away nice-looking faraday boxes that cost them next to nothing to make, and which would probably have decent adoption among people who have requested them. That would cut the hard costs to be very low, and give them a branding/perception benefit.

Imagine seeing "Mercury Insurance is giving away a Fob Box to any customer who wants one." It wouldn't make me switch to Mercury, but it would make me think more highly of them. And if I were just out of college and choosing my first insurance company, I'd undoubtedly choose them.

Given the spate of thefts and the likelihood that it continues, a promo like this could resonate for a long time and get mentioned in lots of news stories.

Use a cookie tin. Holiday ones are often decorated nicely.

> And also give car owners an incentive to keep their keys safer, given how many vehicles out there are vulnerable to this. Just fixing this for new cars is only half the solution.

Why is it always up to us to deal with the consequences of all this poorly thought out new crap?

It sort of reminds me of the way they want us to believe that "identity theft" should be our problem to clean up, when its really caused by banks poor security practices.

Could simply putting the thing in a foil/metal lined drawer in your entryway do the trick?

I do exactly this. I lined a cookie tin with foil, and tested it by holding the closed box (with the keys inside) next to the car. It didn’t unlock. Then I opened the box, and it did unlock. The box has to be closed (lid fully on, no gaps) or the car will still unlock.

Of course this only foils overnight theft. I imagine it would be trivial for someone to follow me from a car park to a public location and sit next to me to get the key signal from my pocket.

I would imagine the signal emmitted from the fob is time sensitive. The codes should be invalid within a few seconds. If not, shame on them for such a terrible step backwards in security.

Does an unlined cookie tin not work? Does having the lid mostly closed (but with some small gaps) at least cut the effective range?

I’m wondering if a tin facing away from the door may be sufficient since the signal will be reflecting in the wrong direction.

Then just a metallized flap for extra protection.

Leakage is fine. As long as it’s in the right direction.

I didn’t test rigorously but an unlined tin did not block the signal when the tin was right next to the car. Maybe it still reduces the range.

I've watched some DIY videos and am considering doing just this. I'm not sure how tight a seal you need though (one video said you want overlap from lid to sides/bottom), and the draws we have there aren't super tight. Maybe we'd make an enclosure within the drawer and be able to line that sufficiently?

If anyone knows how much leakage there would be for fobs/phones, and whether it makes a difference for this application (where the sniffer/attacker would be 10+ feet away), I'd love to know it!

Would be easy to test what is needed. Wrap up your keys and take them to the vehicle.

I just completely wrapped my remote with one layer of aluminum foil and that was enough. A small gap on side was enough for the car to detect it.

What strange is, I can see unlocking the car and even starting it with this attack -- but do the cars not continually (or at least every minute or two) revalidate the presence of the key?

Once they got very far away from the house, the car should shut off. Or so I would think.

> but do the cars not continually (or at least every minute or two) revalidate the presence of the key?

Mine will beep for a bit if I leave the car with the key. But the vehicle also works when the fob's battery is depleted (it has an RFID tag and an embedded physical key for the door). Having the car randomly shut off based on something so potentially flakey seems like a worse idea.

> Once they got very far away from the house, the car should shut off. Or so I would think.

In the event that the actual owner of the car left their fob at their previous stop and discovers this fact 40 miles down the highway later, if the car were to stop, the driver is now stranded with a car that won't start. As it is now, as long as there is enough gas in the tank, the owner can just drive back and get it.

That's why the car should stop after less than a mile, or even not go into drive at all, rather than driving 40 miles. In your scenario, how will the driver discover that the key is missing without turning the car off and then finding herself unable to turn it back on?

So if you accidentally drop your keys while entering, or your passenger departs with your key, the car should lock itself 2 minutes later while you are driving?

Yeah, sounds reasonable to me. Either of those situations should already be solved. My car at least yells if the key goes away when the car is on and if you’re dumb enough to keep driving and that’s kinda on you.

No, it is not reasonable for the car to stop suddenly without the key. Even if it stops by going into an emergency limp mode, this could seriously endanger the occupants by leaving them in a dangerous traffic situation, a dangerous location, or with other issues.

This is why every car company has examined it and chosen to not do it.

This feature actually saved huge inconvenience for us once. While visiting the other coast for wife's mom in the hospital, we used one of her parent's cars to drive to the airport with her brother to drive it back. We get out at the airport, get luggage, hugs, bye, head into terminal -- with the key still in her purse. Car running, doesn't notify him until too late to chase. If it stopped after 2min, he'd be stuck somewhere outside an airport 100mi away from anyone he knew. Instead, he just drove it home, got & used the other key for a few days, and we mailed back the first key when we arrived.

Things that seem reasonable at first....

Well, it means that a simple presence of a key in the vicinity of a car isn’t enough to answer the question of “will this key be present there” by the ene of the journey.

It means the key has to he inserted somewhere. That makes it both safe and predictable.

As someone who turns their car on by inserting their key into a slot in it, all this seems quite convoluted just for the convenience of pushing a button. I don't understand why the car would even let you accelerate at all if the key isn't inside the actual car (even if it's just in your pocket, if you insist on pressing a button).

The key has to be in it to start it, but once started, the key can go away and it will continue to run.

(& yes, I still start my car with a key that is inserted, and mine also has a clutch & manual H-pattern 5-speed)

Sorry, perhaps I should've put my commment higher up. I was referring to the general problem of the article, which I understood to be enabled (among other things) by the possibility of unlocking, turning on, and driving a car without the car having a means of verifying the key is inside/very close to the car.

I got myself in a bad situation where I set my key fob on the top of my car after a run, changed, jumped into the car, and got onto the highway before realizing my mistake. The fob fell onto the road and was run over and destroyed before I could get to it. Thankfully I left my car running during this time and was still able to get home.

The way it works is reasonable. Maybe tighten up the proximity. But honestly, I miss my classic keys.

Or drop to 5MPH and flash the lights and horn.

In the article, the first car mentioned the car was found in a parking lot, contents emptied. If they wanted to take it to a chop shop, easy enough to take it far enough to put on a flatbed.

Maybe they came across a better car?

That seems pretty dangerous. Why not just have the car beep at you?

> Better to pay out for a vehicle theft, vs. actual injuries from a collision.

What do you mean? It's not as if anyone will be driving less... the insurance company will pay for a new car, the family will buy a new car (presumably they need it), and still be just as statistically likely to collide with the new car.

Insurance companies have more of an incentive to make cars safer because of the larger liabilities of injury.

That's no problem for the insurance company. Everybody has to pay a bit more, problem solved.

Sure, if a car theft for one car spread the cost to _all_ insurance companies, but it doesn't. So to stay competitive, companies have to 1) insure good drivers so the rates stay low and 2) invest in customers who have good car security (note the discount one gets for having their car garaged).

> If I were the insurance companies, I'd be putting pressure on the car companies

Oh please, this is Ontario. The auto insurance companies main innovations have been:

1) getting caps on benefits

2) creating new driving violations to jack up your premiums (eg: non-criminally blowing over 0.05, but less than 0.08)

Neither resulted in lower premiums for anyone else.

Sounds like a great opportunity to increase the theft premiums for people owning fobbed cars.

Insurance companies pressure drivers who have these misfeatures, drivers pressure car manufactures. See also: discounts for anti-theft tech and airbags.

The latest insurance "incentive" is a tracking device in your car that tracks when and where you drive, how fast, how hard you corner and stop, etc.

I've declined this but expect that insurers will push for it to become mandatory. They would love to be able to charge unsafe drivers more money, and in the abstract I don't have a problem with that, but the tracking is creepy.

No no no, they would love to charge everyone more until they prove to be safe drivers — ready to withdraw the discount at the first doubt.

This is why I am not going to get one, nor a “smart” water or electricity meter: give more data to corporations, and you can be sure that they will use it against you.

Or to put a combative point on it: "How much money do I get when you abuse this data for any purpose other than your exclusive safety metrics?"

This is an idea that I do not see getting enough attention. “Big Data” has a lot of possible benefits but only if companies collect limited and relevant data. I’m comfortable telling my insurance company where and how I drive as long as they cannot share that or combine it with any other data.

Wait until your insurance suspends their coverage for 24 hours because the road conditions aren’t meeting their requirements, or you didn’t evacuate quickly enough, or there’s a forest fire nearby.

I think in California it's illegal for insurance to put in a black box that measures anything other than total # of miles driven.

Does the mileage number have to be accurate in terms of wheel rotations? Can a hard braking event add miles? Is miles just an abstract representation of risk?

So...

Free cars?

Whats the yield on the secondary markets for these hot vehicles since the VIN is compromised, a new license plate is needed and a thorough scrubbing has to happen

In some countries, they’re worth more than American MSRP.

Some luxury sellers are actively making it difficult to buy for export to arbitrage this.

Get it to a chop shop for parts and/or get it out of the country and I can imagine it's pretty high.

Insurance companies will just raise rates and be done with it.

What are the thief's doing with these cars?

Selling parts. Usually chop shops, then to shady body shops and mechanics. With exotics, many are exported to less principled markets, with minimal vin mitigation needed. Notice how the top stolen cars on every annual list are always ones with popular body styles (accord, etc), it is no accident. The parts are often worth more than the car, and can be sold at full market value, unlike a stolen car.