Hacker News Reader

Comment by BrandoElFollito | Hacker News Reader

My brother had his car (a sleek AUDI) stolen in front of his house. He left the key in the entry hall, and someone extended the range.

Are current electronics (the consumer ones) good enough at scale to limit the time the round-trip car-key-car takes?

View on HN

I am curious if any Teslas have ever been stolen by being able to duplicate the Tesla key.

Is app + Bluetooth or the NFC cards inherently more secure than traditional key fobs?

An app can embark all modern authentication and encryption systems. You can easily secure the exchange, like we do for web today.

I imagine that the car companies either had strong hardware constraints in the key fob, or no security competency, or no interest in investing there.

UWB, used by CCC keys (iOS and Android; UWB might be optional for Android?) definitely is — TOF distance precision in the inches.

FYI - the inclusion of UWB (specifically the FiRa consortium secure ranging standard) was not part of the CCC Digital Key specification until v4.0.0, which only left its draft state very recently, at least in terms of automotive security standards.

I think a fundamental problem is that keys aren’t security forward compatible - break the keys and you’ve broken an entire generation (or more) of cars.

The only solutions I can see are software based keying and a mobile app or legally enforced security guarantees.

But the car manufacturers don’t give a fuck if your 3 years and one day old car gets stolen. You move to the next competitor, only for the same to happen in just over three years time. Repeat. Repeat. Repeat.

>The only solutions I can see are software based keying and a mobile app or legally enforced security guarantees.

Wouldn't this require the phone to be trusted and not run unsigned software?

The software part is a solved problem - this is how the web is secured. There would be an exchange of keys with the car, and done.

This does not solve the problem of the timing (but the sibling comment explained that this one has a solution)

I think the problem here is that traditional keys expect physical security, and this expectation is broken because key fobs are now wireless and thieves have range extenders. I thought the best practice here is to store the wireless capable key fobs inside Faraday cages when they are not in use to restore physical security.

How does that work?

Once they have driven 100m what happens?

They can keep driving until they switch the car off. Some systems switch off gradually after a longer way.

There are two main reasons for that. Over use that if your key dies, you do not want your car to stop immediately, this is not safe. The second one is carjacking: you want the thieves to have a useless car further from you (that one is I belive just a collateral or a secon thought)

Usually it’s just to gain entry without setting off the alarm. Then a keyfob is made using OBD. Either in the driveway or 100m away if the vehicle so permits without an existing key.

Electric cars are theft proof. No car thief would steal an electric car.

Why wouldn't they steal an electric car? The batteries are valuable, the electric motors are valuable, body panels and other parts are valuable. Most stolen cars aren't sold as-is, they are chopped up for parts and sold as pieces.

I don't understand the downvotes. I am just curious about whats the rationale. If there is a counterpoint, please downvote by all means, but make the point so I learn how to think better!

No explanation or elaboration on your claim that electric vehicles are theft-proof

I thought it was obvious. Charging (scoping just to US) has some difficulties. First, you need to know how charging works (110V vs 240V vs DC fast charging) and also understand what kind of charging the car you are stealing supports: https://www.power-sonic.com/ev-charging-connector-types. Also understand the various apps that are needed for different cars and how they work. The thief most likely may not have charging at home or at work (if they have a place of work, I'd assume they are not working at FAANGs, which have 2 - 3 EV chargers at each location). Then, when they are chased by cops, etc, they will eventually run out of charge. They can't do a quick pitstop. When they are charging, lets say at a Tesla station, the car may be electronically identified. But, most importantly, the media instills a fear of electricity (you can't find electricity anywhere except these things called EV charging stations and there are very few charging stations) and electric cars. Everyone is worried about range (range anxiety).

You're assuming so much that is wrong. Thieves don't know how to use technology?

They can't use a charger? (I imagine they'd wire one to an also stolen generator)

Then you assume they're gonna be in a car chase? That's not how most stolen vehicles end up.

Afaik most stolen vehicles either get quickly parted out at a chop shop, or are sent across a border (driven across borders or container shipped to another country), or used for other crimes, or they're joy rided around then abandoned. Basically all things you could easily do on a partial charge with a modern car mechanics skills.

Reply on news.ycombinator.com