Hacker News Reader

RSA SecureID has been doing this for decades and decades. They use a not-tremendously-accurate battery backed quartz RTC with some drift compensation built into the server side.

There are a ton of other options though. Atomic clock signals are broadcast nationwide in the US. GPS, Glonass, etc. signals broadcast the time. Cellular networks broadcast the time.

If you can synchronize the clocks in the car and the key fob, it doesn't matter if you know the delta to UTC or not.

Isn't any method of synchronizing clocks likely to be vulnerable to the same sort of counter resynchronization issue that this attack exploits?

Good question.

If you can do that, you probably have two-way communication, and this issue should be moot.

...and doesn't run the battery down in a couple of months