Hacker News

Better locks also increase the time to break them. More time == more chances to be disturbed and have to go away and also an incentive to move on to the next house, bike, etc. In the case of bicycles I also advice to lock them close to much better bikes with similar locks: chances are that the thief will invest those 30 seconds to break the lock of the better looking bike.

This is probably less security theater and more not-getting-sued theater.

This distinction (although I know it) has never made logical sense to me.

I only have four wheels. If all the wheels are driving, and I only have four wheels, then...

Again, I do know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.

Country differences (the writer seems to be Australian), plus some subtle technical differences few people know or care about.

Suffice to say, in British parlance any vehicle with four driven wheels can be called a "4×4"

My first guess was a RAV4 as well from that description

They mean someone who's extremely passionate about this could identify the car brand or exact model in question just by listening to the sound the lock makes from the posted video. You know, like the experts who can identify a wine by smelling it, or a violin just by listening to it.

I'm in Canada and was going to say this as well. Also, the nice thing about a phone vs. key fob for remote start is that with the phone you're less likely to accidentally remote start the car in your garage compared to a key fob. My parents always disabled remote start on their key fobs because they parked in a garage, but having the remote start option on your phone when parked outside at work, etc. is really convenient.

shit remote start doesn't even have to require snow.

i'm in legit cold canada and being able to open my garage remotely and start my car means it's a lot easier to herd small kids into a warm, comfy carseat.

i mean; i like the remote start angle, but that can be done with a key-press on a key. no damn app needed.

as for "I often forget to lock the doors"... why do you often forget to lock the doors?

> What’s more likely, misplacing your car keys, or misplacing your phone?

good question. I don't know? There are three things I carry with me literally everywhere: phone, keys, and wallet. Any one of them missing in the morning means I have to hunt around the house to find them before I can leave for work. This would not change if I could unlock my car with my phone (I still need to be able to lock my front door and/or let myself in when I come home again, requiring keys)

Physically unlocking with NFC could be done without all the security holes.

Modern cars already make it much more difficult to lock your keys in the car than in ye olden days.

And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff. It's not like that "did I lock it" check helps prevent a "someone smashed the window and grabbed something out of it" scenario anyway.

It can be useful if you lost the keys for $REASON while hiking or doing any activity and you can phone somebody else who has access to the API and ask them to unlock and remote start the car. It doesn't happen that often, but it happens, and in the big scheme of things it's more likely to happen [1] that somebody stealing it via a vulnerability in the car maker web services.

Or at least as a car owner, this is my risk assessment exercise output.

[1] Yeah, I just pulled this off my ass, don't think there are trustworthy stats either in one direction or the other.

At least in the old days I could put my car keys into the wash and they'd still work fine. I could go to the local hardware store and get convenient duplicates for almost no money. Losing your car keys in the old days was a very easy situation to remedy.

Meanwhile, if I'm out in public and a bad update bricks my phone (or cell coverage is down?) I can no longer use my car. The idea that consumers would hope for more entrenchment into the phone ecosystem is absolutely baffling.

I think my car key would be the thing in my pockets that I'm the least likely to misplace. It's only ever in like one of three places.

> Do you own a car? What’s more likely, misplacing your car keys, or misplacing your phone?

I do own a car. Keys in home are always in exact same spot. Phone can we literally anywhere, good I have smartwatch and I can trigger "locate my phone" that way.

I just don't get the idea of unlocking car though app via internet. Neither I get the "keyless entry" (meaning I do not even need to touch the key fob to unlock car) and "start button" (well if you place key in ignition switch then you will not lose it!)

The security drawback is not worth, fixing non-existing problem in the first place.

> What’s more likely, misplacing your car keys, or misplacing your phone?

Misplacing the phone actually. Car keys are either in someone's pocket/bag (then you talk to whoever used the car last) or in a set place in my home. The phone might be wherever I used it last.

BYD has NFC unlock, can be paired to your phone or you R smart watch. Very good quality cars, much higher spec, better price etc than a tesla

My wife and I were in her Hyundai Ioniq 6 a couple of months ago, and we both got out of the car. One of our dogs was in the back seat and jumped into the front.

Unfortunately Hyundai decided, in their wisdom, to put the door lock button (to lock all doors) in the console between the front seats. Exactly where Sally stepped when she came from the back.

Both my wife's keys and phone were still in the car.

30 minutes later, a local mechanic showed up. He gently pried the front door open with something like a whoopie cushion, and was able to poke the door lock button and open everything. It took him about 5 minutes.

Hyundai Canada can, of course, open the doors remotely, but when I called them they refused to and only offered to call CAA (the Canadian version of AAA, and the people Hyundia sub-contracts their roadside assistance to). I guess that makes sense considering the liability of remotely unlocking for someone whose identity they can't verify.

"What’s more likely, misplacing your car keys, or misplacing your phone?"

…And what about the many other things one misplaces about the house? For instance, Wireless mice, TV and various other remote controls, etc.

I just cannot understand why the tech crowd hasn't developed a much-needed Missing Objects protocol.

Think of this. When you lose an object you immediately go to a big button that's hidden and securely bolted down (so you can never lose it) then press it. Like your fob key and car, it activates all these easily-lost items and they start beeping madly so you can find them. Lose the mouse in the couch somewhere and the 'couch' starts beeping. Voilà, one found mouse.

It's crazy that a simple concept like this doesn't exist in practice.

Owned a car for 30 years. Have misplaced keys but always had a spare. What's more likely to be stolen, your car keys or your phone? Your question and my question are both facile.

I’m unlikely to lose either. The keys have an AirTag. The phone show up on find my.

unlock with nfc then ? He is pointing out the rediculousness of the design choice of using the web to unlock the car which is at arms reach

Running out of battery on my phone.

What’s more likely, misplacing your car keys, or misplacing your phone?

Are there cars that let you drive them without the key?

My car allows me to unlock it with a phone from the other side of the planet. But to actually drive, it requires the key to be inside.

That's a pretty big stretch to me, especially since key fobs can usually unlock a door from across the parking lot without even leaving the building.

I live in a cold climate. Remote start isn't even necessary much less very necessary. I start the car, then clean off all the snow and leave. Running the engine isn't going to remove a foot of snow off the windshield and it definitely won't off the roof or hood.

Regardless remote starters do not need the web or a phone, they existed in the 1990s.

> remote start which is very necessary in cold climates

Not just necessary, but very necessary? I understand it's convenient, but I think you've overstated it a bit. You can always start your car and then go back in the house for a few.

We used (until Subaru said 'fuck you, pay us') the mobile access so that I could unlock my family member's vehicle when I rode along with them or remote start it ahead of them while we're out and about. It's nice to be able to get back into the car and sit and wait without having to grab the key out of their purse.

They hook a lot of people now with the first couple years free, then spin around and go for a $150+ a year whammy. We gave up.

I had a 2007 Chevy HHR. It had remote start/unlock. When I lived in Denver, I used the remote start during winter to warm the car up before getting in.

Also, there was something sticky with the door lock. If I used the key instead of the fob, sometimes the anti-theft system would not disarm and the only way I found to disarm it was to use the fob to turn that alarm off. Grrrr. Fobs lasted about 3 years and cost $100 to replace/reprogram.

My current car (a Miata) has a key only to unlock the door in the event of a dead battery. It has a pushbutton instead of the traditional ignition key, so the key is pretty useless outside of a dead battery.

The problem is no one can control this remotely. Some people would prefer your access to the vehicle be conditional.

Enterprise compliance confuses people. The problems are all simple in principle, but there are so many of them and they cost so much that nearly no enterprise seems to be able to manage the basics. It'd say the more HN comment here is one who misunderstands that complex problems cannot be solved by technical solutions alone.

Not sure the reliability risks are that mild in this case. Phones can run out of battery. I would not want to be locked out of my car in the winter because I ran out of batteries and looking at my car which both can charge it and save me from the elements.

I mean that is not what they argued, what they argued was

> So you can be just a little bit more lazy

Which:

> i can either go back inside to get the keys, or just open the car from the app

I think qualifies, personally. Your house might be way bigger than mine though

Usually the most practical thing to do is to remove the antenna. The car just thinks it can't get a signal, instead of missing one of its radios if you unplugged the cellular module.

In a few years, new cars probably won’t pass inspection or be allowed insurance if their internet access is disabled and not fixed by an authorized technician in a timely manner.

Samsug definitely was (is) trying to slowly replace google. A lot of there stuff runs Tizen but yeah they now more about security than a car maker at least.

I do realise. That by itself is worrysome. But now car manufacturers tie legallly required functions like the enmergency buttons with bloated platforms of "convenience" functions that users can not disable completely.

Correct me if I'm wrong, but I think I've read somewhere that it can be a SIM-less phone that abuses emergency call flow in 3GPP. GSM specs have special accomodations for 911/112 type calls that don't require a SIM(that sometimes ironically lead to normal calls working fine and just emergency calls failing).

Hah not only same message from me but exact same year too, end of the GMT800 and the TJ. Probably other stuff I’m forgetting.

Why 2006 specifically?

They had other issues. SQLI, XSS and XSRF were rampant in those days.

I've pondered how "secure" the old OnStar system was. It was apparently just some level of in-band signalling/modem communication on top of AMPS (or CDMA).

I figure someone out there could dump the firmware off an old OnStar module these days and have an AI RE it - we do have open-source cellular SDR stacks that could handle both the analog and digital voice calls on old vehicles.

I can't play the video at all in firefox desktop because the video is encoded as h265 which firefox won't play unless specific extensions are installed.

h264 is the better choice for short progressive download clips on websites if compatibility matters.

God.. Nice write-up, horrible video.. "oh let's go from portrait to landscape in the middle of the recording!".

It's a one minute video, would it have been so hard to redo it.

Edit: raining downvotes, well fuck me, I guess you all prefer sloppy shit.

> Even more consequential and terrifying is to check how quickly and easily you can rake or bump the lock on your home door

or sometimes, even just shim it open.

>only attempt if you know that you're doing, so as to avoid damaging it

If you mess with your front door lock, make sure to do it with the door open, to prevent locking yourself inside when the pins get jammed into the keyway as you turn the lock 180° (don't ask me how I know this).

Makes me think of Max Fisher's latest video where he makes the case that the 'domestication' that ancient human-to-human trust provided is what allowed us to genetically adapt to spend less energy on survival and more on brain-power.

Literally all of civilization is built on the back of that, and if it erodes then We're doomed.

Are door locks actually intended to deter professional thieves though? I thought they were intended to add enough friction to deter crimes of opportunity.

The lock on my front door merited a 15 minute video from the LockPickingLawyer. He could pick it, but it required some time and tools that the average lock picker wouldn't have available. 15 minutes has to be a record for him, but still it's only 15 minutes.

> nicest (and second most expensive) place I have lived at had the worst locks

Did it have an alarm system?

> Why is he protecting the car company

He is not protecting the a car company. He is protecting himself.

I think it's because it critically was missing context. So you're constantly trying to frame and reconcile it while reading. When first reading I thought there was actually a car brand named X -- and it doesn't seem out of the question.

But it makes the content seem awkward and clunky. So a reader going in with the correct context has a very different experience.

I didn't find this hard to read or understand, though perhaps his writing style just aligns with my own and I do have experience in the methods being used.

What a ludicrous complaint. It's perfectly readable. What possible motivation does one have to broadly proclaim something is "badly" done from an armchair without a modicum of justification? And then follow it up with an AI-whine. It's roiling to me.

I received an email from Toyota asking me to connect to a newly-purchased vehicle in their app. I hadn't actually purchased a Toyota, but I went ahead and installed the app to see what it would do, and I ended up having full access to someone's car. I could see the car's location, lock/unlock it, and even start the engine remotely. I did try to contact Toyota about the issue through various channels and never got a response.

If they can't get the simple parts of security right, like verifying a user's email before creating an account and linking it to a vehicle, then I have little confidence in the security of other parts of their systems.

Yes the car in the video looks like an RX350

Looks like the XA50 AFAICT

Isuzu doesn't really sell passenger cars in Australia, only trucks, pickups, and for some reason a single SUV (MU-X) I'd never heard of before looking this up just now.

Because its fun?

Combined with the "across both of their brands" comment, and we're restricted to cars available new in Australia in 2023, I'm guessing Toyota/Lexus. Could be Land Rover/Jaguar too.

Why would they be so circumspect? Presumably the automaker has fixed this by now.

Connected cars are very useful for end-users. I use my car's app to remote-start, lock/unlock, check diagnostics, etc all the time. If for some reason my car was stolen, I could track it remotely. If I got in a crash and was unresponsive, the car calls for help. I want all those features.

The problem isn't being connected, any more than your smartphone being connected is a problem. The problem is control. Who has control of what, when? It should be us in control of what data is used, when, for what purposes. If companies won't voluntarily put control in our hands, we need the government to mandate it.

The need isn't for the user, it's for government surveillance and corporate data collection. I hate to say it but this trend seems inevitable. Wherever corporate and government interests align, it's practically impossible for the people to fight.

considering cybercab and waymo . That trend is going nowhere

Yeah, the problem isn't a dearth of technical security expertise, the problem is turning that technical expertise into meaningful organizational changes, which requires a rather different skillset (as far as I can tell: people-skills and managing/navigating bureaucracy). And, further, getting anything done is going to be a constant uphill battle in most organizations because, as you point out, paying for security doesn't [directly] contribute to quarterly revenue targets, and even worse, often times puts you in direct opposition with the people who do contribute [directly] to those targets.

More generally, the vast majority of companies consider IT to be a cost center which means cutting costs (and the corners along with them) and going with the cheapest bidder is just Standard Business Practice(TM).

Of course, this means the security is going to be a shit-show and there is financial incentive to delay improving things for as long as possible; the recent discussions about "cyber-attack insurance" in response to the attack against retailer fridges sort of epitomises the problem: even when the nightmare scenario happens the suits refuse to see that the root cause of the problem was the application of Standard Business Practices(TM).

>>and you can just steal all the cars from the brand without it being obvious that you’re doing anything wrong

I don't see any indication here that's the case - opening the doors is very different than being able to start the engine and drive off.

High end luxury car lifts to order are sometimes literally that- a target car is tracked and when parked and left for some short period it gets lifted up into a truck with a Faraday cage and driven away.

Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.

  Brown said everyone needed a better stereo in the 1990s. Factory radios were lousy. But the aftermarket stereos that people bought to replace the factory-issued ones could easily transfer from one car to the next. For example, if thieves steal the factory stereo from a Volkswagen Jetta, they're going to need a buyer with a Volkswagen Jetta, and all a thief can offer is the stereo the owner had to begin with.

Factory stereos got good (and complicated). Aftermarkets got cheap.

Exactly. Someone like the author isn't going to steal my car, so unless I'm targeted by a three letter agency it's not something worth worrying about.

I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.

Car thieves destroy undrivable cars and just sell parts and scrap metals.

The initial cost they pay for the car is the cost associated with stealing it, nowhere near the actual value of the car. It doesn't matter how little is recovered relative to the total cost of the car, so long that their losses are negative or at least minimal.

> Has a Tesla or Rivian ever been stolen without the owner leaving their phone or keycard in the car?

"tesla relay attack"

I mean, it's probably possible, but it's well above the "just have to outrun the bear" bar: Towing it and/or just buying a car for yourself.

Tesla? They aren't exactly known for their security. [0]

[0] https://www.wired.com/story/tesla-ultra-wideband-radio-relay...