Hacker News Reader

The key fob does use challenge-response, the thief just uses a glorified range-extender to get the car started with the key normally out of range. The car stays on once started. There's no MITM involved.

Huh? The diagram in the article shows two men ("Thief 1", "Thief 2") between the fob and the car, with arrows showing communications going from fob to thief to car. According to the first sentence of the Wikipedia MITM article, that's the very definition.

the relay is of the radio signal, there is no inspection or tampering of the relayed messages. basically, the extender tricks the car into thinking the fob is closer than it is.

In other words, there's identification, there's authentication, but authorization is replaced by "if in range, then authorized." Two out of three is still game over.

That's exactly what I'm wondering.

Maybe it has something to do with the additional battery consumption that doing this incurs, probably something like double/triple consumption, with the hashing.

All the thief does is amplify. Good luck!

Challenge response prevents replay attacks, not real time MITM.

This is not even MITM, the thief just blindly proxies traffic.