Hacker News Reader

Comment by gjsman-1000 | Hacker News Reader

Imagine if a city sued homeowners because it’s their fault for calling the police after a break-in, because they used a deadbolt that failed the LockPickingLawyer. This is about equally as sane.

Yes, yes, I know that Hyundai and Kia vehicles are easy pickings, but they talk as though “those vehicles are easy to steal, so those teenagers, they just felt so compelled to…” Nobody forces somebody to steal a car. If anti-theft prevents a car theft, consider that is still someone who had intent to steal a vehicle if it were possible.

View on HN

LockPickingLawyer is highly skilled, and can defeat locks that most others can’t.

This is like selling one of those old Kryptonite locks that could be defeated with a Bic pen. At that point, the lock is truly defective, and should be pulled from the market. Your lock should require something more than a readily-available, vaguely key-shaped object to operate—so if you can operate the lock with a Bic pen (like the old Kryptonite locks) or a USB charging cable (like the new Kias), the lock is defective.

True, I agree, but here is the thing: There is no federal standard requiring fancy anti-theft equipment.

Baltimore is quite literally suing because two manufacturers aren’t doing what other manufacturers do, because it would be more convenient for them, despite there being no rule requiring such technology.

That’s a slippery slope. For heaven’s sake let’s make a rule, but trying to sue a manufacturer for not doing what other manufacturers do in absence of a law seems dangerous.

Let’s say Tesla and Ford start requiring all auto parts to be digitally paired, to “prevent theft,” so parts are not interchangeable. If this case succeeds, any automaker who doesn’t do that could be found liable.

I don’t think we should need to codify every possible problem as a rule. It is enough that Kia knows, or should know, the consequences of their actions, but chose to let somebody else (the owners, the police) deal with the consequences.

Basically, I think mens rea is a much more sound basis for law than rules prescribing specific behavior, in general. Like, if you are an engineer and you design a bridge, and it turns out that the bridge fails and you should have known that it would fail, you bear the liability. This basic doctrine can be augmented with specific rules (like, cars must have back-up cameras and airbags, houses must have three-prong outlets with proper grounds and GFCI in bathrooms & kitchens), but the law should not have to make rules for everything before it happens—as long as you have mens rea (you knew the risks or should have known the risks), you bear some responsibility for your actions.

i deeply disagree with this line of thought. why is the onus on the manufacturer here, instead of going after the thieves?

> why is the onus on the manufacturer here, instead of going after the thieves?

This is a false dilemma. You can go after both.

That is just a false dichotomy. Of course the thieves are at fault, but the manufacturer is also liable because they failed to ensure even the most basic degree of security.

ridiculous. there are already federal standards, that Kia and Hyundai met. Baltimore should sue the government if they want to complain.

should bike manufacturers also be sued for not designing a bicycle in a way that cannot be ridden off by anyone who is not the owner when parked?

idk how people defend these frivolous suits.

I, as a consumer, expect that the car has a key because the key keeps people who don't have the key from starting and operating my car. They sold a product for money that operates so poorly that it fails at one of its basic functions.

Imagine if Google sold a Pixel whose fingerprint sensor could be bypassed if you just licked your finger before pressing the sensor. Suddenly this phone is now the target of thieves because it's easily unlocked and wiped. You're suggesting there's no onus on the manufacturer for that?

the onus is on them in the sense that people will stop buying them. I do not think it is the government's responsibility to micromanage, no.

the scenario you proposed is already possible with face unlock and identical twins and look-alikes. should we sue Apple?

The identical twin thing affects 1 in 250 people, and I think we could reasonably expect an identical twin to know the risks of face unlock without having to spell it out for them. So if you’re an identical twin, and you don’t want your twin accessing your phone, you set a passcode instead.

Kia owners don’t really have an alternative. The car is defective.

People already have the cars. And the 2023 models don't seem to be affected. So getting people to stop buying them is sort of pointless (because the people who already own them are now stuck holding the bag). If the government has no business getting companies who produced a flawed product that—as you suggest—people should stop buying to fix their products, why exactly do we have standards at all? What part of "you have an obligation to issue a recall that fixes the product" is micromanaging? That could be done with a court order.

> the scenario you proposed is already possible with face unlock

I didn't mention face unlock. Any fingerprint sensor that is trivial defeated is fundamentally broken.

> I didn't mention face unlock. Any fingerprint sensor that is trivial defeated is fundamentally broken.

I know you didn't. The point is that your phone can be accessed by those who are not you.

and the standards should be around safety

In every jurisdiction, where they can, police are going after Kia thieves. You can keep throwing people in jail, but more and more jail is obviously not an effective deterrent. This is scientific fact, accepted by the DOJ. [1] It is a simple solution to make the manufacturer fix the car so it is not as easily driven away.

[1] https://www.ojp.gov/pdffiles1/nij/247350.pdf

What are the level of auto theft in Korea? Or Japan? You are insisting on putting law abiding population into a cage because we cannot deal with criminal few.

There is an effectively unlimited supply of kids who believe they have no future and are therefore willing to risk it all. Enforcement can't stop them from stealing a car when it takes a cord everyone has and less than 30 seconds.

This USB nonsense is misleading, it is nothing like the Kryptonite+Bic pen.

You:

1) need to enter the vehicle (lockpick, smashed window, etc.)

2) break the ignition block to remove the key cylinder

3) turn a tab underneath the cylinder with whatever you see fit (pliers)

Only coincidentally the tab fits inside a USB A connector.

Now, that the ignition block may be (or may be not) easier to break than any other one could be debated, but - unlike the Kryptonite locks - you need to break it by force.

This situation is more like a deadbolt with a cover that could be pried off with your fingers, and then could be opened by any key shaped object once the cover is off.

Maybe to put in software terms - a login page that allowed anyone to sign in to any account by viewing source and finding an admin login button sitting there for anyone to see.

It truly is a flawed design. Yes, a design that might not be flawed for many societies around the world, but it's certainly flawed for a product that is sold in the USA.

Of those two the second struck me as an example of someone who should expect to be victimized.

It is funny how conditioned we are to assume people online will be as malicious as we allow them to be.

Mechanical engineers operate under the same assumption, though it's generally a stupidity standard vs a maliciousness standard. In this case, they absolutely should have recognized there was no backup to their (much more affordable) immobilizer design, and caught it in the early design review phases.

No, that is not an apt analogy. Homeowners did not design the lock. Homeowners did not introduce a flaw into the lock to save money.

Think about it this way: no one forces a kid to jump into a pool and drown, but if you have a pool without a fence completely surrounding it and the kid does just that, you are liable for the damages by creating an attractive nuisance. Hyundai created the situation of easily stolen cars by not "building the fence around their pool".

It turns out, people will download a car.

Not the homeowners but the Master Lock. Which when hearing about quality of their products seems exactly same scenario. They do deserve to be sued in similar fashion for producing poor products. Like any pin and tumbler lock makers.

The key difference is that Master Lock is terrible in the same was as nearly every other lock in widespread use by homeowners. If break-ins by lock picking double in my city this year it won't be because an unusual number of people happened to pick Master Lock over Schlage when they were installing locks.

With Kia and Hyundai the cars involved are actually much worse than the comparable alternatives. Several cities are seeing a big increase in car thefts almost entirely due to more Kia and Hyundai thefts using methods that would not have worked on the 96% of cars in the US that have immobilizers.

The answer is enforcement: cars were much easier to steal in the past, and somehow we managed to deter theft anyway. But in many US cities if your car gets stolen the cops won't even pick up the phone. They openly admit there's next to no chance of recovery, and rarely help you even if you have some kind of tracking solution.

If you do manage to track down your car, you won't get a timely enough response from the police to hold folks who stole it accountable. Most of the time they'll simply claim that they procured the car from someone else, and the police don't push the issue. Same with bicycle theft.

Reply on news.ycombinator.com