Hacker News Reader

Comment by tyho | Hacker News Reader

BMW is also massively insecure. My "secret token" I had to enter on my phone to link it with the car was the VIN number. That number is physically stamped into the engine block and chassis so obviously cannot be changed, even after I sell the car. I also suspect these numbers are sequential. Till this car is scrapped I will be able to locate it, turn on the AC, unlock the doors etc.

View on HN

On many (all?) modern cars it's also visible at the bottom of driver's side of the windshield. A car's VIN is public information.

I have a small piece of black paper over mine. I am happy to let a law enforcement officer view it if they ask.

Not a bad idea. As far as I know it's not required to be visible

Not illegal per se, but you're handing cops PC to enter your car to move the paper and any further evidence of "crime" they can see while doing that is fair game.

I thought about doing that, but if someone wants my VIN, they just have to squat down and look at the VIN that's punched in the frame of my truck.

I haven't checked other vehicles, but I imagine they also have their VINs punched in the frame where it's easily visible.

I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it.

> I imagine they also have their VINs punched in the frame where it's easily visible.

It's not always easily visible, but the VIN must be stamped on the major components of the car by law. I believe this means visible from the driver's side windshield, stamped on the frame, and stamped on the major drivetrain components.

> I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it.

In my state, it's illegal to do either of those things, but I don't believe it's illegal to obstruct the view of the VIN in a less permanent way.

> I don't know if it's against the law to grind that off, but it's probably not against the law to weld a metal plate over it.

My Jeep has added "frame rust protection" from the factory (Canadian-spec) and I've never been able to find a VIN stamped anywhere on the frame. Apparently the coating covered it. It was a pain in the ass crossing borders in Africa when they didn't want to use the VIN at the base on the windshield.

What about parking tickets? Do they just leave the VIN# empty or impound your car?

Parking tickets usually go off the license plate, last I checked.

In fact, so do normal tickets, last I checked. My first job was punching in traffic ticket info for the CHP, and I don't recall ever seeing a VIN; just the LP and DL.

This is in the US, though. Other places might have different information tracked on citations.

LA parking tickets have VIN. You obviously cannot have DL on a parking ticket. Here is an example image: https://pci.etimspayments.com/pbw/include/la_sheriff/images/...

> LA parking tickets have VIN.

Noted.

> You obviously cannot have DL on a parking ticket.

Well yeah, obviously. I was talking about tickets in a broader sense, going by forms CHP 215 ("Notice to Appear", i.e. normal traffic tickets) and CHP 281 ("Notice to Correct Violation", i.e. "fix-it" tickets).

Also in the various databases? How does that work?

I believe this is not quite correct, there is an additional step. Once you enter the VIN BMW ConnectedDrive will send a message to the car which you have to retrieve through the iDrive interface before it will 'pair' with online services or the app. You need to have physical access to the car.

And if you sell the car and it is added to another ConnectedDrive account (or BMW mark it as sold) it disappears from your dashboard and you need physical access again to add it.

It's not strictly sequential, but it is easily guessed if not sequential. The first portion is manufacturer's information, and then the last 6 are a serial number of final assembly (generally speaking)

VIN Card [big pdf]: https://www.genuinegmparts.com/src/pdf/resources/1960-2020_V...

I'm curious, would it be possible for a malicious person to create a bunch of VMs running the app and brute force VINs to get access to thousands of vehicles and do things all at the same time?

As it is, it already sounds like a theif's dream: no special, suspicious tools required: just a burner phone with an app, walk up to a car, enter the VIN, unlock doors, steal stuff.

No, it’s not possible: https://news.ycombinator.com/item?id=22259046

VINs roughly follow patterns, so if you know one, you can figure out many other cars with very little brute force effort.

vinwiki probably has a guide explaining them somewhere if you search

Yes, but:

- at least in Germany, you have to give physical signature at the dealer to sign up for CarData

- you need to give consent to every third party in order for them to access the data

- to have the car linked to CarData, you have to get in the car, turn the ignition on, receive activation code displayed which is displayed on the infotainment, type the code back into the CarData platform

Also visible through the windshield from the outside.

>Can unlock the door.

>Visible through the windshield

Interesting.

In my area, the VIN is also easy to find with just a name from the public-facing tax property website.

So wait if I see a new bmw, all I need to do to break in is download the app and put in the VIN?

Reply on news.ycombinator.com