Hacker News Reader

Comment by 29athrowaway | Hacker News Reader

What kind of garage opener do you have? I thought the Flipper zero won't provide that functionality unless you flash the firmware.

View on HN

Not the person you are replying to, but I use my flipper for the exact same purpose.

Not sure which specific garage opener my apartment building has. But the fob controller the leasing office gave out is way too weak, so i have to sometimes press it many many times and wiggle it in multiple ways until it triggers the garage door. With flipper, it works on the first try.

A funny anecdote: after using my flipper for about a year, I encountered another flipper user in my apartment elevator (the elevator requires a keyfob to go to any floor except the ground floor). I talked to him for a bit. Turns out, he manages a bunch of boat storage units here (in Seattle) that all use different keyfobs. So for him, it is just pure convenience to carry a single flipper device as opposed to always having a lot of different physical keyfobs on him, and then shuffling through them in his bag to get the right one.

The part I don't get is even if you flash the firmware, does that mean you can make sure it doesn't make all other remotes fail? My understanding of the whole rolling code system was that you could get a few uses and then you were screwed.

If that's not the case I really need to do this because having it handle my tv's, ceiling fans, and garage door would be a nice trick.

If you have control of the opener, couldn’t you use the door’s learning mode and make it into a real opener?

I thought so at first by my initial reading left me somewhat confused on if there's a private key that only certain remotes have or something like that?

It's less of a private key and more a random per-remote prng seed that gets set both on the remote and the door controller when they are paired. When you press the button, remote increments its sequence number and send this number, its ID and a hash of all that and the seed to the controller. Controller checks the hash, then checks that seq number is more than last seen for this remote and opens the door. This protects against replay attacks and fairly uncomplicated to implement.

This sounds a lot like the KeeLoq algorithm [0] (minus the hashing part). From my research into the rolling code space, I think most remotes don't quite have the CPU/featureset to support a real, secure crypto system with things like SHA, AES, and RSA/ECC. Would love to see one though!

[0] https://en.wikipedia.org/wiki/KeeLoq

For Chamberlain brands [0] there is some research that shows that their rolling code system (Security+ and Security+ 2.0) is quite easy to decode/decrypt [1]. This feature is supported in the flipper firmware, but is restricted (you can't create a custom remote, only clone is supported) without custom firmware. However, I'm sure you could decode a raw capture file if needed in a pinch.

[0] https://chamberlaingroup.com/our-brands

[1] https://github.com/argilo/secplus

Many rolling door openers don’t use rolling code. Never heard of tvs or ceiling fans using rolling code either

For the record the point was it already handled the fans and tvs fine, but having it store garage codes as well would make it that much more useful

Not terribly difficult to flash the firmware.

But now you have to trust some random person from GitHub.

Almost all software supply chains rely on random persons at some point.

Reply on news.ycombinator.com