Hacker News Reader

Comment by jamescostian | Hacker News Reader

I'm not sure if this is a joke about old keys being better, but I'd argue you could have the benefits of new keys and old keys combined if you just made it so that new keys have to be inserted into some compartment inside of cars, where they are authenticated by those cars. You can imagine a fob with a USB that has a different authentication code than the wireless one it sends out, and unless the USB is plugged into the car, you can only start the car up but you can't drive it.

In addition, you can make it so that the car doesn't unlock due to proximity with the fob, but rather, it only unlocks if you push the unlock button on the fob.

View on HN

Does this not sound exactly like what I had back in the 90s where my physical key would need to be inserted to start the vehicle and to unlock I'd press the keyfob to activate the unlocking.

I imagine an smartphone with touch sensor + car remote app would be even safer than what we have now.

The difference is that you can start up your engine (read: have AC on so that your car is the right temperature when you get to it) and also unlock the doors for others from far away

If that functionality was encapsulated on a smart phone, that would be fine too.

My 2007 vehicle does this just fine. And any signal from the fob require a press of the button. These key fobs use rolling codes as well. So you would need to capture a button press while the remote is too far away from the car to receive it. Then replay it to the vehicle. Of course you still need the key to unlock the steering wheel and of you touch the break without inserting the key, the ignition cuts off.

I'm not sure why we are going backwards in the security department here. Seems like a lot to give up just to not have to stick the key in or press the unlock button.

Or jam the signal with pseudo-random-noise. Afterwards you can remove the noise again and have the clear signal.

> I'm not sure why we are going backwards in the security department here.

Consumer products nearly always go features that have whizz-bang "it's so convenient" demo value, until a problem like this becomes prevalent enough to end up on everyone's nightly news.

But then my mom would have to dump out her purse every time she wanted to unlock her car.

My mom used to be the same! It would take her 10 minutes to find her fob! But, there are typically ways around this. For example, now my mom has her keyfob in a small pouch of her purse, and she always knows where it is.

How does she unlock her front door?

I imagine a lot of people don't use a key to get in their house, nor do they use the front door. Hit the button on the garage door remote, drive in, walk into house.

When I was in the states we were discussing this with a friend. He idly noted that after a valet gets into your car he can just select "drive home" in the GPS, open the garage with the integrated garage door opener, and just walk into the house.

He then added "It's good that I always lock the door in the garage too".

I also lock that door in case a second garage door is left unlocked. Then again, I lock doors during the day when I'm home out of habit. Did this before a recent break-in attempt, so hardly discouraged by that.

If I ever have a break-in I imagine it will immediately change my habits. Knock-on-wood, has never happened to me yet.

I do have auto-closers on the garage doors, however, because my kids do have a habit of leaving them open otherwise. Of course, they also keep leaving the man-doors unlocked all day as well.

I got a notice in the mail from our county's assessor because they left three door tags at my house. I almost never open the front door. I go in and out of the garage, and let my cat out the back.

My late grandpa would wear his on his belt. Classy.

> How does she unlock her front door?

For many people, there's no need to unlock the front door because it's never locked. Having to lock your door just means you're living in a terrible neighborhood.

Not sure about the US, but in the UK where I have more experience having my stuff stolen, if you rob a house and the door is locked it is a far more serious crime than if the door is unlocked. Big reason people made sure to lock their doors in my neighbourhood growing up since 90% of the yobs would just check if doors were locked, not actually dare to break in.

> in the UK where I have more experience having my stuff stolen, if you rob a house and the door is locked it is a far more serious crime than if the door is unlocked.

This doesn't make much sense from first principles. I assume everyone agrees that theft is equally unwelcome regardless of whether the door was locked. But the additional damages from breaking into a locked home are pretty minor compared to the damages of the theft. Why would there be a large difference in punishment?

Stealing a bike out of your front garden is no where as near a violation as entering your house (castle) and taking it.

So what? The claim is that it's a "far more serious crime" to enter your house and take the bicycle mounted on the wall, when the door was locked, than to enter your house and take the bicycle mounted on the wall, when the door was unlocked.

The bigger issue is insurance. If you have stuff stolen and there's no sign of forced entry (home or vehicle) then your insurance company will likely be asking questions about how exactly the thieves gained access.

I think there is no difference in the US. Either way it's "breaking and entering" if you so much as open the door, if my law school memory serves.

Even if you live in a "good"neighborhood you could still be burgled by someone casing the neighborhood/home. Do people really not lock their houses when they leave? My parents always taught us to lock the house on the way out, even when we lived out in the country.

Our family practice is to lock the house when going on vacation, but not if we're just going out normally for the day.

I often don't lock my house. But when I'm not there, there's a dog on the front porch who doesn't like strangers.

I don't get the downvotes for this. A dog who doesn't like strangers is a pretty traditional security system, and is much, much more secure than a locked door.

It really really isn't. That stranger can become an instant friend with some food. There was a show once where an ex-burglar would break into people's homes to show how easy it was. People would say, "there's no way he's getting past my dog!" and the guy would just open up the fridge and throw all the meat on the floor. End of problem.

That is evidence that it's easy to get past an untrained dog. It's not evidence that it's easier to get past an untrained dog than a locked door.

Very wrong. Criminals travel. Leaving your front door unlocked is madness, just waiting to see who will come.

Statistically, you are by far the most dangerous person in your life. You are far more likely to hurt yourself than a stranger is. Should some ne'er-do-well enter your unlocked door, remind them of this and start giggling. 'We were just waiting to see who will come!', works too though.

> Having to lock your door just means you're living in a terrible neighborhood.

Interesting. Is that an American thing? I do recall that most of my American friends don't lock their doors, whereas I can only think of a handful of people not locking their doors in Europe - and those live in remote outposts, where people are scarce and deer are unlikely to use the door handle.

Growing up, we did not even have a key for our house. Lots of places around the US, there is no need for keys. It is really hard for some people to grasp the idea based on how and where they grew up. My wife grew up in a gang riddled area and will not abide unlocked doors if we are out and about.

My parents never locked the doors growing up, but I still lock the door of my own house. My parents never gave me a key when I was a kid, so it was probably left unlocked so I could always get back in. I'm not sure why they didn't just make sure we all had a key so they could keep it locked. That's what my roommates and I do at our place now and it works fine.

My childhood home’s door didn’t have a lock too. The loan sharks put superglue in the keyholes.

Because of that, we had an additional safety feature, you couldn’t open the door from outside!

She doesn't have her keys on her fob. Heck, last time I took her to get her oil changed, the key fob still had the little plastic removable key tag from the dealer she bought it from.

We use the garage or a key code lock.

Smart door lock?

safety pin near the top + carabiner = instant easy access keys

Lots of purses have clips near the top for this very purpose too.

Genius!

Sounds like she needs a better purse.

Yes, I was making a joke, but I was also semi-serious. I personally wouldn't mind that the car unlocks based on the fob's proximity, but requires insertion of the key for ignition. I currently drive a 2009 car with the usual key fob and my biggest issue with it is not having to insert it to start the car, but unlocking the doors while my hands are full. Once I'm seated in the driver's seat I'm not carrying anything and starting the car is no problem.

My problem with modern cars is that there’s no good place to put the keys. They’re uncomfy in my pocket when sitting down and I’m too warm for a jacket with pockets.

The old ignition hole was the perfect solution. You had a dedicated spot for your keys, you always knew where they are, were unlikely to forget them in the car, and it also happened to start your engine. Perfect

I thought that's what the cup holder is for. Of course, this doesn't solve the forgetting the keys problem.

In the movies they always leave a key behind the visor.

I use a caribiner and a belt loop. I think a bracelet would be a pretty great form factor for a key fob.

> unlocks based on the fob's proximity

Unfortunately, that would be vulnerable to theives unlocking your car and taking everything in it. For me, the biggest convenience of fobs is the ability to start the car and have AC on so that the car isn't burning/freezing when I get to it

And this is probably a more common scenario than stealing the car.

I never like to have the car running when I'm not in it. If it's low on oil, or overheating, etc there's nobody watching the gauges.

Do you have an old car or are you a pilot?

If they're stealing your car like in this article, then that's already happening anyway. At least if it was unlock only and not ignition as well then you'd at least still have your car.

Then the thief could hide in the back, and rob you while you were driving down the interstate (ie. he could hold a knife to your throat and force you to drive to location that was hidden from public view). I don't know how realistic this is, but it is far more dire.

Which the theives in the article could have done anyway.

If the objective is to steal your car, the thief is going to use the least risky way that he can come up with. If you take away his ability to do it without having you start the engine yourself, this is what he's left with.

Toyota Prius does that. (Or at least the 2007 version did) You have the key fob (with emergency key inside). You have to insert the whole fob into a port on the dashboard for it to start.

Not required for the optional smart key system.

Thats essentially how my car works right now, it's push to start, but you've got to have the fob slotted into a thing in the dash for the push to start button to actually work.

What vehicle do you have?

Mine too! But only because the battery on my fob died and I am too poor now to replace it. Frankly I kinda like it that way, it makes me more conscious or the damn fob (I used to just drop it anywhere in the car).I have a Tucson 2011 FWIW

The battery is like $1 on eBay

It’s a 2032. Just snag one from an ewaste computer motherboard. Dollar stores usually have 3 for $1.

A 9 year old BMW without the comfort access package.

My BMW did not come with such a fob slot but still required you to dig the key out to press the (un)lock buttons. Weird transition.

But that's the perfect fob! I keep it in my pocket and it has enough of a distinct shape I can press the buttons from the outside of the pocket. So I lock/unlock and open the trunk with no effort and yet am imune to this attack because a button press is always required. People I've driven were mistified how I was operating things because it's become so second nature you can hardly tell.

BMW late 2000s were like this. Maybe still are.

I have a 2007 BMW. It does have a slot to insert the fob. But it is not required to start or run the car. The slot acts as a charger and holder for the fob. But proximity is all that is actually needed.

Sounds like you've got the comfort access package on your car. Without that tech package (sadly not offered on my make and model year) you've got to actually put the fob into the slot to make the push to start work.

I had a 2011 3-series that required the fob to go into the slot to power or start the car.

My wife's 2014 Mini works this way as well.

I'm not sure why we can't have some sort of challenge response protocol to prevent MITM...

The key fob does use challenge-response, the thief just uses a glorified range-extender to get the car started with the key normally out of range. The car stays on once started. There's no MITM involved.

Huh? The diagram in the article shows two men ("Thief 1", "Thief 2") between the fob and the car, with arrows showing communications going from fob to thief to car. According to the first sentence of the Wikipedia MITM article, that's the very definition.

the relay is of the radio signal, there is no inspection or tampering of the relayed messages. basically, the extender tricks the car into thinking the fob is closer than it is.

In other words, there's identification, there's authentication, but authorization is replaced by "if in range, then authorized." Two out of three is still game over.

That's exactly what I'm wondering.

Maybe it has something to do with the additional battery consumption that doing this incurs, probably something like double/triple consumption, with the hashing.

All the thief does is amplify. Good luck!

Challenge response prevents replay attacks, not real time MITM.

This is not even MITM, the thief just blindly proxies traffic.

Reply on news.ycombinator.com