Sure but there must be a way for mechanics/dealerships to work around issues with lost keys.
"Oh sorry, you lost your key the car is bricked" is not an acceptable answer for a car owner.
"Oh sorry, you lost your key the car is bricked" is not an acceptable answer for a car owner.
When I noticed this, many days later (!), I had to take the car and both keys back for them to reprogram. I expect the car was programmed to accept the keys, and not the other way round.
So, somehow dealers need the ability to reset keys. This means there are devices are kind that can do this. And with a device at every dealer, a few going missing isn’t going to uncommon.
But, to me, this is the more interesting device. Using trackers (Apple or tile or whatever) isn’t what is making this possible. They might make it easier to find a target car when it’s more secluded, but a tracker isn’t the primary tech that makes the theft possible.
They might be able to lookup the key codes from the manufacturer to be able to either (a) fabricate a physical key and/or (b) program a new key fob. This would make more sense because then, at least, the manufacturer would have a record of who requested the information. And if a car was stolen, they’d know who to go back to. Also, the manufacturer would know of a particular dealer was making too many requests that something could be fishy.
They can either make it a fairly easy and flexible process online--in which case it's also fairly easy to game--or they can tell you to show up in Mountain View with multiple forms of identification during office hours on every other Friday.
And of course just like any backdoor, the thieves seems to have managed to exploit it so they can steal the car without having the owner's key.
What I'm thinking is that if a car's backdoor becomes a mental concept for the general public, it might help popularize the concept of how backdoors in general can be abused. Probably acceptable for a car but not for one's life information.
As of now, anytime backdoors to encryption are being "sold" by politicians, there's a messaging that goes along about how the backdoor is ultra-secure, similar to a military complex or a pile of gold in some fort. Of course it's not reality but it's the mental image many non-technical people have.
So once there are a few stories about famous people (or relatives) who got their car's system backdoored, it will help raise public awareness of how inappropriate it is for things more important than cars.
Maybe.
I hope…
While I agree about encryption generally, I'd say it depends and it depends on your definition of a backdoor.
Probably the most straightforward question for which there is not a universal answer is whether you want the entity storing that (encrypted) information to be able to provide you with access to it if you have lost access to your password and standard recovery mechanisms.
Yeah, right. How would you do that? Have you ever bought a car?
When I had to get a new key for my friends car, I just quickly printed a sales contract and faked his signature.
Title must be signed at sale. Registration is for on-road use and can be expired for race cars (I trailer mine to tracks).
I bricked the ECU on my car while tuning and it was part of the three module handshake for the key authentication. Replacement unit from dealer required sending to BMW corporate - valid title, drivers license and proof of address. I received the ECU and dealer had to program/pair the CAS and keys I had with the new ECU.
Even then this seems like a pretty pointless exercise, titles aren't particularly difficult to forge (assuming you don't just find it in the glovebox).
Without cryptographic signatures or a mandatory online ownership registry this quickly devolves into meaningless security theatre. But I suppose that's really the point, they ask for the title in order to make their customers feel safe, not to prevent crime.
And even if you find one in the glovebox, there is a pretty good system in place for the justice system to decide if that transfer was fraudulent (was due consideration exchanged in terms of fair market value of the vehicle or relationship between the "new" and previous owner).
If the vehicle was reported stolen, when they call to verify the title provided - the dealer will be warned as such.
To produce even somewhat convincing cash, you will have to invest hundreds of thousands to procure a Heidelberg offset printing machine and learn how to operate it (and fix it, because presumably your forgery operation will not be able to take advantage of support contracts). This isn't a simple task, and banks will still catch your fake money.
This is the kind of equipment you'd be looking at to produce fake currency (at the low end) https://www.bloomberg.com/features/2016-counterfeit-money/im...
>And even if you find one in the glovebox, there is a pretty good system in place for the justice system to decide if that transfer was fraudulent (was due consideration exchanged in terms of fair market value of the vehicle or relationship between the "new" and previous owner).
Of course, but the question at hand is whether or not the dealer asking for a title before providing new keys actually offers any meaningful security benefits or not. I believe that this is just security theatre.
>If the vehicle was reported stolen, when they call to verify the title provided - the dealer will be warned as such.
Presumably the title doesn't play any meaningful part here. They could just call in with the VIN, no?