Insecure vehicles should be banned, not security tools like the Flipper Zero (2024)

> Security tools like Flipper Zero are essentially programmable radios, known as Software Defined Radios (SDRs)

The Flipper Zero is not a SDR, it is less capable than that.

That's the ironic part, the Flipper Zero is a rather weak hacking tool.

It can open car doors, but it is so impractical that it is not much more than a party trick. You have to record the code by pressing the button on the keyfob out of range of the car and in range of the Flipper. You can then open the door to the car, once, and only if the owner didn't open it first. There is a more advanced and maybe practical attack called rolljam, but I don't think the Flipper is capable enough to do that.

The only thing is that the Flipper Zero is fun, cheap(ish), and popular, but real thieves already have better tools for their job.

I have a similar story! Locked out of my car. Bikers park next to me.

"You locked out? Hang on a moment"

Goes into a Subway, comes back with a coat hanger.

Less than a minute later the car is unlocked.

"Wow you're pretty good at that"

"I literally just got out of prison today... for car theft."

Laughter all around

There is (was?) a tool called a slim Jim that was basically a purpose-built coathanger for unlocking doors.

There was some talk of banning them in some areas, because people love treating symptoms rather than causes.

Nowadays the tow truck drivers have a little inflatable bag they slide into the top of the door and inflate so they can press the unlock button from the inside. Quite effective!

Intentions sometimes matter. There is a South African shotgun aspirationally named Street Sweeper, and it's famously classified as a Destructive Device in the US, which is two levels more strictly controlled category, AIUI, IANAL, than a manually operated Gatling gun.

FZ is intended to clone keys and bypass security, I suppose in significant part for users' lawful convenience, but is kind of intended to do what it should not.

Coat hangers aren't engineered with intent to be shoved into the weather seal on a door.

You can literally order lock picks on Amazon in Canada[1].

Which were absolutely engineered with Internet to be shoved into locks to open them without a key.

To be clear: purchasing ans owning lockpicks is perfectly legal in Canada [2].

I don't think your logic applies to why that legislation was introduced. They're treating Flipper as a lockpick, but legislate it differently nevertheless.

Cheap, misguided hype seems to be a more plausible explanation.

[1] https://www.amazon.ca/Professional-Accessories-Suitable-Hand...

[2] http://lockking.ca/can-i-buy-lock-picks-in-canada/

> FZ is intended to clone keys and bypass security

I'd say it's more of an educational/'hacker' toy than it is a useful security bypasser/key cloner.

Purpose built(and better aot their job) those things cost significantly less. The flipper zero is a toy that the Canadian government are about to misclasify.

sounds rather complicated. You would have to scan the entire spectrum (not the entire, but like certain bands) and detect if there is someone sending power on there.

But modern vehicles detect these relay attacks and drop your message when you are too far away (ToF Measurement), you could maybe instrument that. But then when you walk to your car on an open field, you may also trigger the alarm because your key is out of range for a short time.

Not a great analogy though, since a coat hanger’s primary use is not to break into cars.

Note: I’m not advocating banning the flipper zero anymore than I’d advocate banning lock picks. I just don’t think the analogy is apt.

Actually, there may be something here. Politicians seem to be blathering on about "prepackaged" hacking tools, and similar terms. They obviously aren't going to ban ICs, or breadboards, so in their minds I think it's all about "Tools that are designed for non-hackers to use, in ways we don't like".

Right or wrong re: Flipper's uses, the "just take this and go" is part of it.

I do wonder, right now lockpick tools are banned, unless you are a locksmith. I wonder if one day, you'll be charged with "hacking tools", because you have some hobby project in your backpack.

A very, very bad one that might only work with Lego locks.

Let me double down…

https://ideas.lego.com/projects/40434532-eaa1-4926-8621-3629...

> but real thieves already have better tools for their job.

there you go, letting logic get in the way of a politician looking to score points

Sooo they have been stealing Infiniti's from my area recently with relative ease allegedly by using a Bluetooth obd2 reader connected to an android tablet running a pirated copy of some Nissan service tech software.

Nobody from any of the Infiniti groups is 100% certain how they are doing it, but the best theory out there is above.

Just the other night, a crew of dudes stole 3 Q50’s from my neighborhood with relative ease.

Here is the ring cam video my neighbor posted:

https://video.nest.com/clip/8ef4d060588d4c7289f87cccb00cb55a...

Well for one thing the OBD port shouldn’t be designed so that it has direct access to any useful CAN bus. It should go to a gateway that requires authentication to do anything except read OBD, and all of the IDs that you are allowed to send should be whitelisted.

The issue people are mentioning with the headlights is easily solved by just moving the starter CAN to its own CAN bus between the immobiliser and the ECU (physically isolating the headlights), which costs about $5 total and requires no crypto unless thief is willing to cut the car nearly completely in half.

(The problem with crypto is the $10 safety MCUs used all throughout cars are only like 20MHz and they can’t really do the 2000+ crypto ops/sec on top of their current workload. Also the tooling support for crypto ATM is really poor in the model based design tools that are used for this safety relevant SW)

BTW I personally don’t believe that anything that involves cutting into a vehicle is negligence of anyone. I mean, from my perspective, anyone can just pop the hood and drive the car with their own BYO ECU. It’s just a hunk of metal and once you start cutting it up you can make it do whatever you want.

I am an automotive systems engineer.

Infinite Infinity car hack, came with two, left with three Q50s.

They do crouch an awful lot near front wheel well. Reminds me of this Toyota hack where thieves plug into headlight canbus wiring thru wheel arch https://kentindell.github.io/2023/04/03/can-injection/

Obviously, we want owners to have full access to their car's CANBUS.

So the question is: how should the OBD-2 plug (or wiring) be protected?

Maintenance is a big key management problem though: if only the owner has it, there will be problems when people inevitably lose it. If there are shared keys for service departments or databases, thieves will get access to them.

Things like time-limited on-demand keys can limit those problems but now you can’t get your car serviced when Toyota’s servers go down and they need to commit to not breaking API compatibility for multiple decades.

In the old days, most or all car companies had the ability to look up the bitting code to cut a replacement key (the mechanical kind) from the car's VIN. There's no reason they can't do the same with an encryption key.

Of course they'd need to do a good job securing that database since inappropriate access to it would make stealing cars very easy.

There is a very good reason that isn't possible/analagous to traditional rekeying.

Mechanical keys are not secure. They can be reproduced with basic skills. That's why there used to be a giant key cutting industry where much of the business was car keys (Thanks, GM.)

The whole idea of CA PKI and all modern TPM architecture on devices is that they CAN'T be reproduced or replaced in context without massive effort that would make the intended use moot; IE replacing the TPM and associated on both the key and car. This would require some bureaucratic pointless process to prove your identity, and it would be very expensive and frustrating, and completely at the manufacturers will.

Further, if the car CPU could allow this, it would be >.0001 second before theives use the same exact tools that the manufacturers use. This is basically what's happening now with current NFC/Radio Keyfobs. Basic access to existing cpu through canbus makes NFC/Radio moot.

> If I left a million dollars out on my front porch, and someone stole it, that would not be my fault in any sort of way

Pretty much all of human history to this point says that this is a practical impossibility. If there is such a database/secret, it will get out.

Just make it so the key has to match cryptography with a device that is wedged deep within the vehicle in a hard to access way.

The dealer can spend the two hours necessary to replace the encryption module, but thieves would have to also spend that same two hours.

Most modern keys already have cryptographic rfid transponders which must be in place to turn off the Immobilizer system.

Unfortunately, Immo can be trivially disabled/bypassed/reprogrammed on many cars using the canbus or odb2 interface.

Also trivially editable in many ICUs is the mileage, airbag (crash) history, etc.

The main vector is that this data typically exists alongside performance parameters and user data like registered keys and fobs, so is accessible either by catching the ecu in bootup/program mode, by buffer overrun attacks, or often just by asking nicely.

This is basically doable by anyone who can to chip tuning or ECU remaps. It’s technical, but not that technical. Many ECUs require JTAG access inside the ECU housing or even desoldering the serial flash chip, but many do not.

I just bought a whole setup for this from AliExpress for about 100 dollars and it’s worked well for me so far, just a specialised JTAG adapter with some cables really.

Pretty sure if you wrote drivers for chip tuning software to use a buspirate it would work just as well if not better.

To do that, we'd probably need to accept one of these as a consequence:

1. all cars must be internet connected so they can pull CRLs

2. dealers and locksmiths are no longer able to replace keys, you will have to ship the car back to the manufacturer if you lose your keys.

Because there's no secure way to hand out the root cert to the thousands of organizations authorized to replace keys today.

What would that look like in reality? Expecting dealerships to have the same physical security, procedures, and security vetting of a bank? There's already a shortage of workers in these roles, now we want the guys busting their knuckles on vehicle repairs to have a good credit score and good background check and perform elaborate opening and closing procedures with a buddy system? Storing tools in a vault?

I really don't see how any of this is merited or reasonable, especially when the vast majority of the cars being stolen in my neighborhood are either stolen with the keys or with a tow truck.

My prediction:

1. As a result, we'll see costs like losing the keys to a rental car go from a $250-500 fee to a $2500-5000 fee, due to the additional costs to process and the additional loss of use.

2. Criminal rings that steal high value cars will go from often using tow trucks, to exclusively using tow trucks.

3. The number of cars stolen via stolen keys will remain unchanged.

Yes, the key itself will be more secure, but I'm not really sure it will actually improve anything. More security is not better if the costs do not create real-world results.

Your second point is leaving out a lot: there’s no way adding a requirement that you have heavy equipment and a skilled operator isn’t going to reduce the number of thefts, and those trucks are in more limited supply and easier to track than a small tablet. They’re also way less stealthy so there’s a lot more time to get caught.

The third point may be true for classic theft but would not be true for the growing category of thefts caused by abusing wireless keys. If you can’t easily get a new key, the resell value for that car is going down dramatically.

Commercial tow trucks are not hard to get in many places, but it is also not required to tow a car. There are many consumer oriented solutions for towing a car. Tow dollies are about $40 to rent in my city. Or if you're a thief, trailers aren't hard to steal either.

> If you can’t easily get a new key, the resell value for that car is going down dramatically.

Most of the vehicles that are stolen for resale are high value and sent overseas to parts of the world where the labor cheap to do something like entirely rip out all of the security components. I don't really think that these criminals will stuff a G-wagon in a shipping container for $100,000 but they won't do it for $80k or $90k.

> Commercial tow trucks are not hard to get in many places, but it is also not required to tow a car. There are many consumer oriented solutions for towing a car. Tow dollies are about $40 to rent in my city. Or if you're a thief, trailers aren't hard to steal either.

Again, it’s possible but do you really think there isn’t even one thief who lacks easy access to a tow truck or will be caught firing up noisy equipment at 3am but not if they fumble around in their pocket while walking up to a car? Not a single teenager looking to joyride won’t give up if it’s harder than the Kia video they saw on Tik Tok?

Similarly, yes, people will still steal vehicles and ship them overseas but the more work they do the lower the resale market and value will be, and that will make it less tempting since you’d only be able to sell to people who are content never getting service from the manufacturer. Even if we assume that there are countries with skilled technicians and effectively no law enforcement, only something like 10-15% of stolen vehicles are shipped according to U.S. officials so even if you wrote those off entirely you would have plenty of room to improve by reducing the majority of thefts which never leave the country.

There's different categories of criminal here who are willing and able to do different things to different types of cars.

> Again, it’s possible but do you really think there isn’t even one thief who lacks easy access to a tow truck or will be caught firing up noisy equipment at 3am but not if they fumble around in their pocket while walking up to a car?

Canbus attacks, OBDII reprogrammers, and similar are typically pretty intrusive, they require cutting into fender liners, removing lamps, busting a window, or otherwise gaining physical access to the bus. They also require specialized tooling and expertise that are harder to get than the tools which physically move vehicles.

The one that might be an exception, and some savvy street criminal might be able to get their hands on is a tool to do is a relay attack, which is usually good enough to steal belongings from a car, but generally not capable of stealing the car.

> Not a single teenager looking to joyride won’t give up if it’s harder than the Kia video they saw on Tik Tok?

Definitely not. Vehicles with immobilizers are essentially never stolen by joyriders unless they have also stolen the keys.

> Even if we assume that there are countries with skilled technicians and effectively no law enforcement, only something like 10-15% of stolen vehicles are shipped according to U.S. officials

Yes, and almost all of the other ones either just lack immobilizers, or the thief also stole the keys.

e.g https://archive.is/kxXn3

The same problem exist for car keys.

The answer is, when a person "inevitably lose[s] it", they need to pay to get their electronics refit.

The result of that may be that losing a key is financially devastating enough that it totals many vehicles. And/or if the odometer and other local storage is affected, that may cause permanent title issues for the car.

The number of people who lose their keys vastly dwarfs the number of people who are having their car stolen with a flipper zero.

Perhaps, or perhaps not.

It has to be hard enough it can't be done in the street (without getting attention), but maybe it could be easy enough to do in a garage.

But even if it is expensive, the result would be that either people with take more care, or they'll lose their car.

Maybe it's not a bad thing that people who can't manage a key are less likely to be on the roads - or that its more likely they lose access to their car then it ends up in the hands of criminals. A car can be a dangerous thing, even an inexpensive one.

Yes, but this wouldn't prevent dangerous street criminals from stealing cars. Many of them steal the keys with the car. They go down to the gas station, and wait for an old lady with a nice car to pull up to the pump, and when she hops out they hop in.

The criminals doing more skilled attacks typically aren't joyriding or using it to commit other crimes, they typically doing it for financial gain: they want the car, its contents, or its parts.

Ultimately the overlap between the violent street criminals and those skilled at attacking digital security systems is not much.

> But even if it is expensive, the result would be that either people with take more care, or they'll lose their car.

The entire reason keys were explicitly designed with the functionality to program new ones is because that's not considered by most to be an acceptable solution.

That kind of expands the scope of this conversations to mugging/carjacking, which also comes with a higher penalty, and probably higher priority to the police.

And, it involves interacting with someone, who presumably can call the police afterwards, and activate any lojack / immobilisation device before it can be removed. Presumably the appeal of stealing a parked car it may be a while before it has been discovered and reported stolen.

Also, doing such a thing in a gas-station where there are likely cameras and even other people / attendants make it seem pretty risky to me. Are these dudes just hanging around the pumps in masks? What country is this?

> not considered by most to be an acceptable solution

Things change, but also, it's as much up to the government and/or insurance corps what's acceptable.

The only reasonable way to evaluate risk is as a whole. Real world attackers pick whichever realm is easiest to exploit, they aren't going to waste their time doing something difficult when there are easier ways to accomplish their goal.

> who presumably can call the police afterwards, and activate any lojack / immobilisation device before it can be removed.

Yes, people who carjack usually aren't looking for a nice daily driver to hang on to for the next 3 years. Usually they want to joyride, or use the car for some other crime, in the immediate term.

> Also, doing such a thing in a gas-station where there are likely cameras and even other people / attendants make it seem pretty risky to me. Are these dudes just hanging around the pumps in masks?

Stealing a car, and being in possession of a stolen car, is pretty risky already. I think someone who does this type of crime is probably not very risk averse. Wearing masks is a pretty common way to thwart cameras when committing a crime in many places, I don't think this potential security issue is specific to certain countries. I think what you might be hinting at is that fewer people want to do carjackings in different places, but the same applies to canbus exploits. Nor do I think anyone really needs to "hang out" to find a car at a gas station. Many have cars filling up at them regularly throughout business hours.

> Presumably the appeal of stealing a parked car it may be a while before it has been discovered and reported stolen.

Yes, and while there are some instances of this happening electronically, I don't think closing those avenues will change anything, because towing cars is neither difficult nor suspicious in many places. Again, security is only as good as the weakest link. Nearly all criminals cut locks, even ones are very easily picked.

> people who carjack usually..

No idea, but my point stand on how they achieve this in the first place..

> towing cars is neither difficult nor suspicious in many places

because it's not a recognised method of theft. Also, buying a registered tow truck to commit a car theft doesn't sound easy to me.

Buying a tow truck is no different than buying a truck just about anywhere. Or one can simply buy a regular truck and bolt on a towing attachment to make their own tow truck.

e.g. https://liftandtow.com/

One can also purchase, rent, or steal a trailer and attach it to a vehicle. There are several types of trailer which can haul a car, which are all widely available to the public.

Assume that for anything new enough to have keyless entry, the answer is no.

The big switchover was in '96 when OBDII/CAN bus became mandatory. At that point it became pretty cheap to do things electronically, often cheaper than mechanically, so lots of things started switching over around then.

Not fully true. Just as it's not true with non-car keys. Some blanks are heavily protected. Now these days with the dissemination of cheap cnc mills, maybe thats a bit more trivial, but you are paying a lot more for a cnc mill than you pay for a old key grinder.

Same issue we have now with ghost guns honestly. CNC mills are powerful tools, with the right software you can essentially just place the properly sized chunk of metal in the box and hit go.

My Ducati bike had immobilizers that would prevent the bike being started without the key or the per-bike code card. When it was stolen, the thieves tried all manner of things to start it, including drilling through the ignition keyhole. I managed to get it all fixed and the bike still ran. Without the immobilizer, someone else would be riding my bike.

That's no different from this proposal. You just give them the keys, or the key card (or red key) if you've lost the keys.

Some of the tools used to steal cars are the legitimate tools used to repair cars. Key programmers aren't cheap, but at under $5k for decent ones, they aren't crazy expensive either. It pays for itself in one job.

You could make these tools more difficult to obtain, but that won't stop the crime.

Immobilizers and requiring a PIN to start the car are cheap, effective ways of preventing car theft without negatively impacting our ability to repair vehicles. It would behoove government agencies to include a list of anti-theft techniques on the window sticker and it would behoove insurance companies to be very upfront with the anti-theft features they think vehicles need.

I work in CA/PKI, particularly IOT device registration/security via TPM keys.

I cannot imagine a scenario after years working with our own infra and clients where a car manufacturer would restrict access to the vehicle with a private key decryption on the FOB tpm, (that can't be exported or copied.)

Lost/broke fob? 4000 pound paperweight, to no ones benefit. Insurance nightmare that would also be violating right to repair in many states (which is a different issue) .

There SHOULD be a standard like every person has some device or process that is also a CA, who can then generate and dictate what keypairs can access a device, car etc. But we are very very very far away form that.

It's an enormous amount of implementation effort aimed at tampering which, to some approximation, never happens. And as another poster has said elsewhere, partitioning the communications would be cheap.

That they are using the OEM software indicates that there is some authentication going on with the ECU to start the engine anyway. I bet they didn't truly plan for key rotation.

CANbus protocol makes this hard. Payloads are limited to 64 bits, to start with. But the payload for each message could be encrypted, even though secure key exchange would be difficult.

Even so, it would be possible, I think.

It's so hard that (almost) every European manufacturer figured it out.

There is also FlexRay. There is nothing interesting you can do with CANbus on new mercs. Even unencrypted CANbus messages go through gateways that (could) prevent headlights from reporting key presence.

There is a reason that some cars don't have reasonable attack vectors (excluding parachuting the driver out of the car) and some can be started with a screwdriver (or slight more involved way with CANbus). It's not complexity, it's cost.

The people in the Infiniti groups were recommending this obd2 lock haha

https://www.amazon.com/Tune-Saver-OBDII-OBD2-Lock/dp/B0BRF5D...

seems like a sophisticated theft ring would have access to the keys for the most common guards like this, reminds me of the TSA key debacle[1]

[1]: https://github.com/Xyl2k/TSA-Travel-Sentry-master-keys

The TSA locks have widely circulated master keys because that's a basic requirement of the system–every airport has to have some to be able to open bags. I don't know anything about these OBD port locks, but I don't see any reason they'd have a master key, other than laziness on the part of the manufacturer.

Additionally, I'd imagine that such a tiny fraction of a percentage of cars have these kinds of locks that it'd barely be worth it for thieves to figure out how to bypass them, at least until there's more widespread adoption.

> I don't know anything about these OBD port locks, but I don't see any reason they'd have a master key

Look at it in the picture and the review pictures. They're all 'keyed' alike. It's just a single offset pin. Also one review says it just holds on with friction and can be pulled off with force.

Put the powertrain lockout system on a signed and physically protected network segment. Let the headlights, mirrors, etc live on a less secure segment.

This will impose higher costs when replacing these systems, because it will require key management of some kind. Either central cert management (with 20 year expiry?) or local key management. So only impose this on a tiny subnet for the starter/immobilizer.

Sadly, this involves costs, so it'll never happen.

Good take, though.

Perhaps the OBD port should only work when the car is validly unlocked and the engine immobilizer accepts a key? Maybe it could stay unlocked thereafter while a device is connected?

Android (adb) and iOS (iTunes backup) have solved this issueyears ago.

When I installed a remote starter on my old Jeep, I had to also install a CAN interface that would command a door unlock followed by a door lock command.

That was enough to tell the ECM that it was okay to start the car by simulating the key switch closure for “run” and a temporary closure for “start”. Prior to adding the CAN interface, jumping “start” would set off the alarm.

You don't protect the wiring, you protect the start protocol. Similar to asking "Can we protect the internet by protecting the ethernet cables?"

Put a public key on the engine controller, have it challenge the key with a random start number, have the key respond with the signature of that number, engine starts.

You can do that challenge over the can bus.

Start by not allowing thieves connect thru wheel well https://kentindell.github.io/2023/04/03/can-injection/

The CAN+ and CAN- wires run around the car in, well, a bus and tapping into them anywhere is enough to inject CAN messages onto the bus.

It makes it less plug-n-play than the OBD2 connector, but thieves will still be able to do it.

As I understand it, CANBUS is a message network among relatively low-power devices. There are two ways of doing this:

 + Some credential exchange between devices to establish a web of trust + Devices are locked similar to Apple parts

It was easy enough to do with https://www.uprev.com/.

We had a specialist shop in the same area. You can disable Security+ with uprev.

Hell we would even use it to remove engines from nissans to make them run in whatever we put them in without the ignition. I can make the start signal just come from a momentary push button.

I don't know if I have a clip of it still but that was nowhere near as fast as my neighbor's range rover being stolen during pandemic, broad daylight, four hoodies walk into our car park (flats) and walk out of camera view, 30 seconds later they're driving the range rover past the camera view and presumably rammed the gate we have (since it was broken).

Both car manufacturers and police are useless and it's f*cking inexcusable, imo.

Fix the cars.

A brand new $60,000 car shouldn’t be so simple to swipe.

They probably spent less time stealing my neighbors car than he did waiting on the credit check to buy the car lol… it’s crazy these days with cars.

Cars are computers now.

What do we know about computer security and physical access? If I can touch the machine, I can hack and own it.

No level of technology will stop this.

But cutting off the profit motive by making it very hard to export cars will have a massive impact on these crimes, and for old and new cars.

> What do we know about computer security and physical access? If I can touch the machine, I can hack and own it.

It’s not the 2000s any more. Even national security agencies have trouble with phone decryption, and that suggests a path forward for cars using a tamper-resistant secure element since car thieves won’t spend more money attacking something than they can resell it for. Cars need service regularly you can have a way to replace a damaged SE which is more restricted so a legitimate owner can regain control of their stolen property - if you required, say, a government photo ID check for the owner on the title to reset the encryption keys, car thieves are highly unlikely to spend time getting high-quality fake ID since the odds of getting caught would go up dramatically, and you could deter shady auto shops by requiring them to submit proof of their ID verification for that service.

They get exported overseas and any technology lock or security device gets ripped out and replaced.

This isn’t about extracting encrypted data, but bypassing systems to start a car.

Again, all of those lower the value to the thieves. If they need to create a custom engine controller, they’re going to need to pay a lot more than the $0 they currently spend. If they need to replace the entertainment system, the cost of doing so will cut into their margin.

Don’t make the mistake of thinking that a system needs to be perfect to be worthwhile.

I think you're in a desktop computer "whole product is one computer" moddel. A car is a set of computers, almost nothing in a car is central to itself.

There's probably a body controller ECU that ties into engine ECU and driver's key systems. So theives would just generate and flash a new key/cert, that'll be certainly possible.

Infotainment? That's almost literally an aftermarket parts. American reviewers tend to see it as integral part of a car or even a central computer, surely it's important in terms of product experience but architecturally it's more like a printer over Ethernet than a laptop integrated display.

> There's probably a body controller ECU that ties into engine ECU and driver's key systems. So theives would just generate and flash a new key/cert, that'll be certainly possible.

This sounds like the old desktop mentality you mentioned. You can’t just reflash things to bypass a secure boot process – the entire point is to prevent things like that! You’d design the driver’s key to pair with the various onboard systems and those systems to do a challenge-response cycle during the boot process so someone can’t easily drive away without the key or resell those parts, with both sides using a private key which never leaves that component. Yes, that kind of design can still be attacked but the goal here is to make it more expensive than it’s worth: needing a flatbed to take it somewhere for a rogue EE to work on it, for example, just isn’t going to make sense except for the most expensive luxury vehicles.

This brings me to:

> Infotainment? That's almost literally an aftermarket parts.

Yes, and those cost money. The entire point is that you don’t need to make it perfect, just expensive. If someone has to replace the display and speakers, that means they’re making less profit on the sale and making it more obvious that the vehicle was stolen which increases risk and reduces the number of buyers, especially for the most valuable vehicles.

> This sounds like the old desktop mentality you mentioned. You can’t just reflash things to bypass a secure boot process – the entire point is to prevent things like that!

The actual real problem I failed to explain is manufacturers don't want to deal with networked authentication, broken physical keys, or day-to-day repair shop operations, so they keep most of the processes offline and send out re-pairing tools that leaks. Very few cars require breaking chain of trust to swap out parts which makes "If they need to create a custom engine controller, ..." part unrealistic as of now. It takes few more years before Apple starts delivering cars.

> No level of technology will stop this.

Tell that to the FDA.

I work in medical devices. It's no longer sufficient to throw up your hands and assume "well, they have their hands on the device, we can't stop them from doing anything." The new cybersecurity guidance anticipates an attacker having physical access to your Device and you are expected to understand and mitigate any impact that can have.

Cars shouldn't be any different.

I'd bite that bullet.

The FDA should be less strict with their cybersecurity stuff. The amount of lives lost to the increased cost of care is not worth the increase in cybersecurity.

If medical devices have just enough security to stop people who don't have physical access to the device, just enough to make attacks at scale unfeasible, then that should be good enough IMO.

> What do we know about computer security and physical access? If I can touch the machine, I can hack and own it.

Can you hack and own my fully patched Pixel phone? Or my GF's iPhone? Sure, sophisticated state-sponsored actors can sometimes do it by burning several million dollars worth of 0days in the process, but some two-digit IQ riff-raffs? Probably not so much.

EDIT: just to be clear - by "two-digit IQ riff-raff" I meant OP's neighborhood car thieves, not you :)

Phone thieves will watch over peoples shoulders for them to input a passcode, which isn't that dissimilar to a lot of the replay/signal extension attacks.

A lot of damage can be done and things successfully owned without needing to hack or exploit the device (car/phone).

> Phone thieves will watch over peoples shoulders for them to input a passcode, which isn't that dissimilar to a lot of the replay/signal extension attacks.

You have any reference regarding how prevalent that is? Everyone I know switched to biometrics a decade ago.

Economic incentives.

People will buy a $150,000 SUV for 50k and they can still make money. Phones have less incentive and Apple is going to be better at bricking the phones than carmakers will.

Apple and Google don't sell insecure cheap phones, but lots of other manufacturers do.

I suppose organized crime doesn't systematically take advantage of that because cheap phones are cheap, and the people who own them are poor. You don't get that much benefit from pwning them.

Alternatively, maybe organized crime does take advantage of them but we haven't heard about it. They could have a giant botnet of them for all we know.

a couple of years ago it wasn’t uncommon for victims of phone theft in the UK to end up flooded with iCloud phishing messages to try gain access to their iCloud account and unblock the device so it wasn’t totally worthless for resale.

I still see a lot of iCloud phishing messages, but also understand that Apple has made this vector harder.

> No level of technology will stop this.

Why does no one steal Teslas?

> What do we know about computer security and physical access? If I can touch the machine, I can hack and own it.

You are damn good then :)

One can protect against such that's by using well placed cryptography.

> No level of technology will stop this.

Except for you know, the technology of a physical car keys and an immobilizer. There's a reason it's the keyless entry start/stop button cars that are being targeted by thieves, it's simply so much easier.

The frustrating thing is that new cars are being produced that _only_ offer keyless entry, and so eventually the choice is taken away or you have to drive a very old car.

The level of technology that stops this is cars not being computers.

Every piece of tech has tradeoffs, and for cars this one is just not worth it.

"Kill all humans!" ~ Bender B. Rodriguez

Headline the next day: "Crime rate on Earth now at an all-time low of zero percent!"

> How do you calculate this value of zero percent?

This gets messy for obvious topological/continuity reasons, but a shocking number of applications are both correct and simple to reason about if you choose to define 0/0 == 0 (kind of like how if you choose to universally define sum(empty_set) == 0 and product(empty_set) == 1 then tons of higher-level formulae just work and don't have to special-case a base case).

In context, there's no good reason to pick that definition of 0/0 per se (other than my prior that 0/0 == 0 probably simplifies some downstream math), but it's kind of nice to see that if crime is at 0% then there is also zero crime.

> And who wrote the headline?

Now we're asking the real questions ;)

> "And who wrote the headline?"

Probably a "NewsBot" of some sort?

I will never, ever keep a car I care about outside anywhere near the city.

I know everyone doesn't have the funds for that, but I'm sorry, we all know how rampant car thefts have gotten since before those 3 Q50s in this video were even purchased. I live in the busiest neighborhood in downtown Denver with which has rampant property theft, cats cut out etc non-stop.

I own 2 vehicles and neither of them are ever parked outside if I can help it. It means I have to pay pretty much twice for rent because now I need a 1-2 car private garage, which means I'm probably now in a condo or townhouse so every expense just gets higher and higher.

But you're in the bracket of living downtown with a brand new Q50. So I don't care what your excuse is, buying a luxury/attention-getter car and parking it outside in cities with rampant car thefts is just absolutely stupid.

Especially the people who buy the $80k luxu-box with the $5k 22" wheel add-on that gets ripped out of their mid-rise apartment parking garage a day later.

I've had a car stolen and insurance does NOT treat you well when it happens and I never, ever want to deal with having a car stolen again no matter how much gaap/etc. I have.

> I know everyone doesn't have the funds for that

Its actually a fair bit cheaper to buy a $25k car than a $250k car.

Some of the issue here is that it’s actually a pretty nice area here in Baltimore, but our police force is currently understaffed and overworked.

One big issue here regarding policing is that our city elected officials can’t tell the city police force what to do.

You see, when the civil war broke out, the state took control of the police force so that the mayor couldn’t lead a confederate coup.

Flash forward to today, and those powers still have never been returned to the city. The mayor and city council set the police budget, but the chief of police takes direction from a state run board.

So there is a big disconnect between citizens voicing concerns to city council members, and those members only ability is to “talk to the major”.

When the cats away, the mice will play off with some stolen cars.

If you haven't traveled/lived in many major cities since covid, they are all the exact same now. None of the police are working. I'm in Denver now, previously Austin in 2019, Dallas 2020, Denver 2020+, and Denver banned qualified immunity so the police work even less. Seattle just did the same thing + IIRC king county is doing that "police cant lie on stand" or whatever law. I lived on 2nd and congress in Austin for 12 years until 2016 and the entire downtown has turned to absolute trash.

I'm sure its the same in Chicago, LA, Portland, Tampa, etc and I don't even need to ask.

This sounds like a serious symptom of something being deeply f*cked with policing in America.

Qualified immunity doesn’t exist in other first world countries with effective policing, in fact, the police in America have a lot of latitude to do all kinds of insane sh*tf*ckery that doesn’t fly elsewhere.

Put a kill switch in it they tow it. Put a Club in it they tow it and cut off the steering wheel. Put GPS on it they throw it in a faraday cage paintshop/train. Put a Dronemobile system in it the Police just won't investigate/track it down.

Really just have to not keep property outside anymore. I used to do the "It's not a big deal, i have full coverage" but had a car stolen and they (insurance) treat you like absolute trash when it happens.

So no more outside for my cars as much as I can

> had a car stolen and they (insurance) treat you like absolute trash when it happens.

You've said this twice, but what does it mean? I have had my car stolen twice and the insurance company didn't give me any trouble at all and just paid out.

stupid on stupid.

- it's incredibly stupid to ban the flipper zero because it's factually not even part of the problem

- but it's equally stupid to "ban insecure vehicles". if kia makes a cheap car with crappy locks either don't buy it (because maybe insurance) or add and aftermarket immobilizer or a steering wheel lock. if it was really negligent of kia to "save a couple bucks", then it's equally negligent on you for not spending a couple bucks.

- i also cringe at the idea that we throw the word negligent around when talking about failing to prevent other peoples crimes. i'm not negligent for not doing enough to prevent the crimes of some other asshole. nor is kia. meanwhile, there's sibling threads here that point out that the us is far to hard on the criminals. so wait - kia and me and other law abiding entities are "negligent", but the asshole who stole the car deserves compasion, etc.?

- it's stupid-on-stupid-on-stupid to sit here discussing the problem of car thefts, caused by lack of enforcement of the existing laws against it, and the proposed solutions is making more things illegal (and arguing about which things).

I never understand this arguement. I hear it in the form "we should just regulate cars to be safer", why dont you just buy a safer car? "What do you take me for? I got a mustang GT, the last thing that car is worried about is safety". Interesting, you bought a car because its fast, not paying any consideration to whether it could safely get you from point A to B, and this is what you rely on to get you to work?

Its not social darwinism, the lack of critical thinking skills among the general population is alarming. Americans have apparently been coddled to the point that they arent worried about basic needs; if you go to buy a car you should have some simple considerations, is this car safe? What are the typical maintenance costs? Is it common for this car to be stolen?

Things like, housing, transportation, education, those are really central aspects of peoples lives. Its all well and good that you want to draw symbols on paper and make all these things safe, but it appears to have come at a pretty serious cost. That cost, is the inability for the US population to use critical thinking.

> I never understand this arguement. I hear it in the form "we should just regulate cars to be safer", why dont you just buy a safer car?

I don't understand your argument. Do you expect every potential car buyer regardless of tech literacy to go to a dealership with an SDR setup on-hand, asking if they could test-out the key fobs, capture some signals, try to figure them out and look for common vulnerabilities on the new models? Do you expect the seller to explain the technical details of the key fobs at a depth you can be sure there's no vulnerabilities?

Determining that the key fobs were implemented securely is not something the buyer or even the seller will be able to determine. I would imagine a regulator has the ability to inspect them as they're being designed/built.

> if you go to buy a car you should have some simple considerations [...] Is it common for this car to be stolen?

By the time vulnerabilities are found and people start stealing them, there should already be plenty sold and roaming the streets.

Sure, in the context of broad safety you have a point. Of course, you are more likely to die in places where police are responsible for your protection. The safest places people inhabit are their home, their work, places with private security measures.

The negligence you speak of, how widespread would you say it is? Would you say the EPA dropped the ball preventing the east Palestine Ohio train derailment? Would you say that having some hard cutoff for how many chemical train cars until the train is reclassified? I imagine you would agree, that the chemical company sending 59 (oh w/e) train cars instead of 60 so that they are under easier rules, is kind of bullsh*t.

If the company is following the rules then they can largely get away with it when things go wrong; if that company had actual liability for whats in the train cars, then they would have insurance. That insurance would be prorated on the safety profile of the train, and it would fix the hazzard or pay the claimants their due. These regulations only exist to cement decrepit companies monopoly over you.

I have no faith that "negligence" in the public sector will improve. The roads, the enforcement of driving conduct, that will not improve. The safety, security, and reliability of cars will improve, because there is still competition from self aware drivers.

> The safest places people inhabit are their home, their work, places with private security measures.

Weird takeaway. Those aren't primarily places with security measures, they're places where trusted people outweigh untrusted ones.

I don't have much faith that our regulators are going to get their sh*t together either, but that doesn't mean I can't hold them responsible for the consequences of their negligence. As for the theory that the invisible hand of the market will drive better outcomes in traffic safety, that is obviously not happening in aggregate. It may even be having the opposite effect, given the unchecked proliferation of pickup trucks and large SUVs that are known to be more dangerous to pedestrians and the drivers of other vehicles.

I'm not super familiar with the East Palestine derailment, but based on what I do know about it I think your 59/60 train cars example is sort of disingenuous. American freight rail operators are well known for skimping on safety in multiple dimensions; issues like obsolete brake technology, stretched-thin crews, insufficient maintenance, and excessively long/heavy trains have all been discussed to death before and after that accident. The problem isn't some off-by-one miscalibration, but rather that our regulators (and I'm including lawmakers under that umbrella, especially since they're usually the ones taking the bribes AFAIK) are simply not willing to demand that these industries put public safety over profits in areas where there are well-understood systemic safety problems. AIUI, efforts to improve rail safety during the 2010s and earlier have been largely stillborn, sabotaged by rail company lobbying.

Just to illustrate what I'm talking about via another example: if the MCAS system that killed 346 passengers on two 737 Max aircraft within the span of a few months had been an honest design flaw rather than a hack devised to juice sales by dodging retraining requirements, cheaply and shoddily implemented ignoring the misgivings of Boeing personnel and rubber-stamped by the FAA, then it would have been a simple tragedy. As it actually happened, it's an atrocity—a failure on multiple levels by many people who ought to have known better, holes in the Swiss cheese all lining up, 346 lives sacrificed on the altar of avarice. That's where the invisible hand gets you when you let it take the wheel, but I suppose next you'll tell me that those people ought to have done their own safety audits of the aircraft that got them killed.

Depending on the make and model of a car, you might save money because insurance companies have determined those cars to be safer. If you have a lowjack, your location, your history, there are a lot of factors that go into insurance costs. Insurance companies adjust insurance prices based on risk. Why would you assume private insurance wouldnt also price their policies based on how safe a train is, what the risk is that it crashes, etc.?

Its about who is signing off on whats safe. The government has proven that thry are at best incompetent, they do not have the incentive. A private company has to maintain their reputation through quality of service, they dont have the seemingly endless faith of people because they are "government".

> Why would you assume private insurance wouldnt also price their policies based on how safe a train is, what the risk is that it crashes, etc.?

I don't assume this and I don't think I have even slightly implied that I do. It's obviously, trivially, verifiably false.

Your mistake is in assuming that cost is the primary motivating factor for consumers^[1], and that corporations and their stakeholders won't favor paying higher insurance costs (and fines, etc.) today over paying even more toward safety improvements that won't break even wrt. insurance costs for many years. As I mentioned above, the observable state of the real world explicitly disproves the claim that market forces will drive positive trends in safety outcomes.

^[1] Look how many huge, expensive pickup trucks are on the road in America today. Look at the monthly payments their owners are enduring to satisfy their vanity; look at their spotless paintjobs, empty beds (except perhaps the token equally spotless toolbox), and mud-free fenders.

Doing a security analysis of a car is a complex task that most laymen cannot do, so the argument for laws and compliance among specialists is quite reasonable.

Put it another way: if it's all market based, your choices in buying just get 2x more complex. Is this car easily unlocked? Do the brakes often fail? Can it resist a collision?

Or even another thought: since most people don't think about security, companies will flood the market with insecure cars. Want a secure car? That would be niche and cost you double.

if people cared, they would know

i think this issue is overblown and is being used as a smokescreen for the rash of vehicle thefts caused, not by bad kia security, but large-scale organized crime.

The ability to leave your car in a public space while shopping is a major part of their utility. Cars are therefore common, left in the open, and valuable, but not particularly portable without being turned on.

Jewelry, TV’s, bitcoin wallets etc aren’t just left in the open. Your house, front lawn etc is valuable and accessible but not generally mobile.

In the age of information ignorance is no longer an option, Before I buy a car, most often the second largest purchase a person will make in their life next to housing. I do i TON of research, I look at insurance rates, I look at Theft Rates for that model, I look on Car Complaints and other Database for common failure items for that model, I have it inspected by a independent mechanic having them pay extra attention to the common failure items. etc

If you just roll in and let the salesman take you for a ride then you deserve the outcome.

Yes anyone who doesn’t have the knowledge/time/motivation/cynicism to prevent themselves getting taken advantage of is basically asking for it, nay “deserves” it.

/sarcasm

i didn't say they did! i said they need to take responsibility for their own safety/security or suffer the consequences. whether they should be expected to... is totally irrelevant. i'm not stating a preference, i'm stating a fundamental law of nature.

and not knowing even that simple fact is what makes it "deservedly" so.

Regulation can remove those consequences for any chosen safety/security feature by making every choice have it. Fundamental law of nature? You're deluding yourself.

(And if you say you mean outside of regulation, that people need to be responsible in general for other aspects of life, then your argument is no longer connected to the original comment you replied to.)

regulation is part of the universe. to expect that it protects you exactly when you'd want it to, but does not inhibit you want you'd not want it to is stupid. trying to offload your responsibility onto some "them" is not a fix.

i'm definitely not deluding myself. that is life. you need to have both the freedom and the inclination to take care of yourself, if you don't have both you'll suffer.

I do not need the freedom to buy a defective lock.

Mandating basic safety and security features is not always going to protect me, but it will mostly protect me. It's not stupid to want that tradeoff. I don't care if you define "fix" as 100% so therefore it's not a fix. I want the 95%. I want defense in depth, regulation on top of personal investigation.

you are right. you do NOT need the freedom to buy a defective lock.

you need the right to decide for yourself if the lock is defective or not.

if you give that away, you will instantly be given the "freedom" to buy a lock that is defective-by-design. perhaps the lock designer's brother is a friend of the govt. perhaps the govt. agency does not want bad publicity, whatever.

the point is "defense-in-depth" (cliche) or not, you are ultimately responsible for you. there can be no other way.

> you are right. you do NOT need the freedom to buy a defective lock.

> you need the right to decide for yourself if the lock is defective or not.

This sounds like you agree with me. This kind of regulation sets a minimum, not a maximum.

We don't need freedom to buy very bad locks. We do need freedom to buy the best lock we want to buy.

But the rest of your post implies that regulation will change both minimum and maximum and mandate a specific lock. I disagree with that premise.

> (cliche)

Are you trying to imply something there?

> you are ultimately responsible for you. there can be no other way.

I am "ultimately" responsible, but product makers should have responsibilities too. If I fail at something, I should not be 0% safe. The baseline should be pretty high before I apply my own efforts.

Do you look up the software security measures implemented by the keyfob too? That information would be very difficult for a layperson to find and make sense of.

This may be the "age of information", but information is only useful as your ability to find, understand, and evaluate it.

And if you googled that three and a half years ago when you were actually buying the car?

I bet you had to know exactly what to look for, and "problems with kias" wouldn't get the average person there.

Isn't there an aftermarket solution you can buy that would make the kia you bought three years ago more secure?

Sure, it sucks that you have to unexpectedly spend money on it, but when you bought a cheap car you knew you were taking the risk of having to deal with unknown unknowns.

> In the age of information ignorance is no longer an option

The age of information was great.

In the age of misinformation, knowledge outside your specialty is no longer cheap enough to reliably obtain.

> if kia makes a cheap car with crappy locks either don't buy it

Immobilizers were a standard feature on cars for decades. If you went to buy a car, no one was putting immobilizer on the list of features, and they certainly wouldn't let you try breaking the ignition lock on a test drive.

If they had advertised that their vehicles were insecure, then sure, it's on the buyer, but they didn't.

How about Jaguar Land Rover making expensive cars with allegedly crappy locks? https://www.mirror.co.uk/news/uk-news/range-rover-owners-str...

it'd be bad to advertise that they have in immobilizer or anti-theft when providing either nothing or a badly broken implementation (like you often see in IOT).

it's not negligence to simply not provide a feature they didn't promise to provide and weren't required to (in the US). it is simply not their responsibility in any way to ensure your car's safety from theft. if you assumed it was and that they provided a feature you wanted because everybody else usually does, then the negligent party would be you for not RTFM. except that's wrong here too.

nobody is negligent here. you do not have a social responsibility to have an immobilizer on your car to prevent it from being stolen. and neither does the manufacturer. having it locked is plenty to legally make it "breaking-and-entering". and even if you leave the keys in the car and the engine running, it's still grand theft and your insurance will indeed pay out, which they would not do if they could claim negligence. the criminals are 100% at fault here. and bad things can happen without someone being negligent.

arguing about anything beyond that is just a fight about how good that anti-theft system has to be. are you negligent if you don't have an armed guard on your car?

Speaking as an outsider: How are Kias sales going these days? How's their reputation as a result of this?

Imo for removing security for the US market they deserve to be properly thrashed and dragged through the mud, regardless of the fact that they are offering upgrades from free if I read the following correctly.

https://www.nhtsa.gov/press-releases/hyundai-kia-campaign-pr...

It's not exactly an over the air "recall", and I understand a huge number are still out there unprotected.

Same thing in Australia since 2001.

Most cars in are stolen here using key thefts or wireless relay.

The manufacturer is not the victim here, the buyer is. If I pay a contractor to install a new door and lock on my apartment and it turns out they did a terrible job which made it trivial for a thief to break in, the contractor should be liable.

Crime exists, this is the world we live in. Failing to implement even the most basic security measure, which is considered industry standard, in a high-value product that is known to be very attractive to thieves and then selling that product to consumers with no warning that "unlike most other cars on the market, which have many layers of security features, this car can be stolen using a cheap toy" makes the inevitable thefts absolutely Kia's fault.

It's not like people are saying the thieves did nothing wrong, both sides are at fault: the thieves stole people's cars to enrich themselves and Kia secretly omitted a basic security feature which in turn enabled thousands of fully predictable and preventable thefts from their customers, again, to enrich themselves.

"We shouldn't put dumb kids into cages and forever brand them as criminals for making one bad decision" is a far cry from "they are not at fault for what they did".

Also, insert the usual point about how many people are forced into crime by poverty and the complete lack of a social safety net in the US here.

In my left leaning workplace in my left leaning state, most colleagues do not want to assign the thieves any blame or have them face any consequences. These colleagues only want to blame and penalize the manufacturers.

I think the manufacturer should fix things so they are more in line with other manufacturers. But I also want to see some repercussions for the thieves.

That's obviously not the sentence people are disagreeing with.

There is no way your colleagues want the thieves to not face any consequences. It's a completely different thing to not trust the justice system to give an appropriate consequence.

> Failing to implement even the most basic security measure, which is considered industry standard, in a high-value product that is known to be very attractive to thieves and then selling that product to consumers with no warning that "unlike most other cars on the market, which have many layers of security features, this car can be stolen using a cheap toy" makes the inevitable thefts absolutely Kia's fault.

I don't think this logic works. If you buy a classic vehicle, they don't have these kinds of things either. People make replicas that likewise don't. And there is no clear line here. Basically any car can be stolen by, if nothing else, replacing the car's computer with one that accepts the thief's key.

Meanwhile a car is a large purchase where people can reasonably be expected to do some research. If you're about to buy a car you should read some reviews, and the reviewers should tell you if their security is bad. Then you know and can make your decision. People who learn of this may want to buy a different car, or take some other countermeasures if they buy this one.

Kia doesn't have any kind of a monopoly in this market. There are many other carmakers. Maybe you don't care that their security is bad because you always park your car in a garage. Maybe you like the discount you got because other buyers wanted a car with better security. Why does it have to be illegal, instead of letting the market sort it out in the presence of actual competition?

> If you buy a classic vehicle, they don't have these kinds of things either

Not a good analogy, because buying a classic vehicle automatically waives a bunch of safety and other features that are not only expected in modern day, they are straight up legally required.

A car manufacturer cannot remake a classic vehicle from the 80s and release it in the US in 2024. Or, probably, EU too, I cannot speak for that due to my unfamiliarity with vehicle laws there, but afaik they are more strict than the US. It would be just illegal to sell that car. Thin pillars that won’t pass any modern safety tests, no backup camera (which makes it illegal to sell as a new car in the US), not enoug crumple zones, etc.

Those are explicit regulatory requirements and not just "well a lot of cars have this and I didn't bother to check" as in this case.

And if you were going to do that in this case, the thing to require is the ability for third parties to fix the manufacturer's software mistakes. Otherwise the carmaker goes out of business, as happens from time to time when they don't make a decent product, and then you can't go to them to fix something like this when it subsequently comes out even though their cars will be on the road for many more years.

Whereas if anybody could patch the code in their own car, you wouldn't have this situation where Kia ignores the issue, because third parties would have done it already, the same whether they're incompetent as bankrupt.

The standard dodge in the US is to sell “kit cars” which require the buyer to do a bunch of paperwork to get a VIN. I don’t think they can be sold ready-to-drive but I think there are dodges there too (owner tightens last bolt style). The details vary by state.

Looking for details, I found that there have also been recent changes to ease requirements for small-batch (< 325/year) turn-key replica manufacturers.

> Kia doesn't have any kind of a monopoly in this market

No need for a monopoly, just bad incentives. All manufacturers could just decide that it's better to save more money and omit basic security features across the entire industry, making it impossible to buy a new car with certain standards. What are people going to do, not drive any cars? That's why it's near impossible to find a printer that's not garbage.

> What are people going to do, not drive any cars?

They're going to buy a car and then pay someone to install an aftermarket immobilizer.

> That's why it's near impossible to find a printer that's not garbage.

Brother laser printers are widely regarded as decent. You're also legally permitted to buy cheap garbage for low prices. It will be cheap garbage, so maybe don't buy it.

This all assumes the "perfect information, even playing field" theory that capitalists love to use but is completely unrealistic.

Reviews rarely talk about things like this, this information is not explicitly given to reviewers or customers and neither can be expected to find out on their own (i.e. by trying to hack the car themselves), the car manufacturer spends insane amounts of money advertising to the buyer using every psychological trick in the book, the buyer is often under time pressure, the savings from cost-cutting are rarely passed down to the consumer...

Buying things in the current market landscape is a battle, not an optimization problem.

> this information is not explicitly given to reviewers or customers and neither can be expected to find out on their own (i.e. by trying to hack the car themselves)

Reviewers don't get the information by penetration testing the car themselves. They get the information because their profession is reviewing cars, so when they hear of this through their high contact surface area with industry news, they add it to their review on their website.

> the car manufacturer spends insane amounts of money advertising to the buyer using every psychological trick in the book

Because cars are big ticket items where a single incremental sale can justify a lot of ad spend, not because buyers are incapable of reading a review.

> the buyer is often under time pressure

The buyer is rarely under time pressure. Most people don't wait until their car breaks down to replace it, and even if they did and desperately need to have a car, then they would rent or lease one in the interim while shopping for another one. This is often even covered by insurance. Almost nobody is in the position of having to buy a car immediately without time to do any research, and the percentage of people who are isn't enough to significantly affect which cars or features succeed in the market.

> the savings from cost-cutting are rarely passed down to the consumer

That would imply that all new cars sell for the same price. Clearly they don't, because customers distinguish between them and are willing to pay different amounts.

> Buying things in the current market landscape is a battle, not an optimization problem.

So what you propose is that we reduce the information available to the buyer by requiring cost cutting to be underhanded rather than overt because overt cost cutting is prohibited, or that it not occur and instead prices go up even if you didn't need that feature and then poor people go broke because everything is more expensive.

Just use "passw0rd" everywhere. It's the fault of a hacker who steals your account, not your fault. Every single time.

Especially that no security is absolute. Effort matters.

You are conflating "what's right" and "how the world actually works".

Trust me. I have similar issues, to a clinical level, in fact.

Does this sound familiar?

https://en.wikipedia.org/wiki/Obsessive%E2%80%93compulsive_p...

> If I left a million dollars out on my front porch, and someone stole it, that would not be my fault in any sort of way

It's possible for multiple people to share the blame for something. You _are_ the victim. The person who stole it _is_ the bad guy / criminal. But you _both_ share the blame, because you did something to put yourself at risk when you had better options.

If I'm out late at night, wearing expensive jewelry and have 2 ways home; one longer but down a well lit road, the other shorter but through a dark alley in a crime ridden neighborhood; and I chose the dark alley and got mugged... I would be the victim AND be partially to blame for making a stupid choice.

Making choices that put yourself at risk by ignoring the realities of the world, when you don't need to, mean you share the blame.

I'm saying that it's possible to both be the victim and to have made a stupid choice that made you winding up as the victim more likely.

And, clearly, that it's possible for you to be unable to understand such subtleties.

> responsible for their own actions but not to blame for someone else's.

You're changing the target of the actions mid sentence. Said person is responsible for their own actions _and_ to blame for their own actions. They are not responsible for someone else's actions nor to blame for someone else's actions.

If a person knowingly takes actions that put them at greater risk, then they are to blame for putting themselves at greater risk.

> i'm not negligent for not doing enough to prevent the crimes of some other asshole.

If you entire job is selling locks and they don’t prevent crime, then it’s not negligent, it’s fraudulent.

You want to be in the clear? Sell a car without a lock, see how many people buy that.

> if kia makes a cheap car with crappy locks either don't buy it

And if Boeing makes a cheap, unsafe plane, don’t fly on it

I would be happy to run this experiment if lying to a customer about safety/properties of your product led to capital punishment. But currently companies will simply defraud you by lying about their product, and suffer no consequence

> If you entire job is selling locks and they don’t prevent crime

Does MasterLock making famously easy to pick / rake locks count? I'm sure they reduce crime compared to no lock but they are not as secure as the customer expects.

https://www.art-of-lockpicking.com/how-to-pick-a-master-lock...

> And if Boeing makes a cheap, unsafe plane, don’t fly on it

yes. exactly. if boeing ever makes a cheap plane, i would definitely avoid it.

you are comparing a company that cheated on legally mandated safety requirements with a company that didn't put a non-legally required car immobilizer on a lot of their new cars. and then didn't lie about it.

> But currently companies will simply defraud you

but kia didn't do this

> if boeing ever makes a cheap plane, i would definitely avoid it

You wouldn’t even know that airline is putting you on such a plane

Nobody is mentioning about how this is a social problem with the US that needs fixing, for example I often times forget to lock my car's doors in the Eastern European capital where I'm living and yet I've never had anyone "steal" stuff from it.

But I get it, it's easier to think about applying technological or even legal solutions instead of thinking about how to fix a societal problem.

Thanks for your contribution to the total destruction of outside roaming and play for children.

It is perfectly fine to let an 11 year old walk a couple blocks unsupervised. And if they steal a car at that point, it is not a supervision problem.

dude, i am 100% all for free-range-children.

but, somehow, i manage to ensure that none of them are stealing cars at 11

"it is not a supervision problem"

hmm. maybe i should have said "parenting issue"...

look, i am blessed to have had good kids. but i have had friends with struggles. if i had a kid that somehow stole a car (at 11) and i had to pay for repairs and meet with CPS and deal with courts and fines and maybe even juve and a lost year of school, we'd get through it.

Indeed, it is dumb to ban anything.

A tool is a tool, it doesn't make the product weak, it already was.

Also it is silly to ban insecure cars, that's quite the slippery slope. If the cars are too easy to steal insurance will increase accordingly and that will provide incentives to fix that without banning anything.

Hrmm I wonder what would happen if I made a bank that used an unencrypted website for online banking lol.

The problem with your solution here where the insurance company raises rates... yea they already did that with regards to Kia/Hyundai cars and Kia Boyz thefts. The problem is, well, put it this way...

The last time you bought a car, did you check that the car had immobilizer software/hardware present on it? They don't really advertise that stuff anymore. About the only way you'd know on some brands is a nondescript red dot that shows up for a moment when you start the ignition.

Really, I'd bet a lot of people only found out their car didn't have an immobilizer feature until their insurance company dropped them or jacked their rates up... and that's a problem. See, you can buy a car NOW, and everyone thinks it's a good safe car.. until it turns out it wasn't.

> If the cars are too easy to steal insurance will increase accordingly

that's exactly right. i was somewhat surprised that insurance was outright dropping people instead of simply increasing rates. and by the way, you can get a discount if you add x/y/z security alarm/immobilizer. the public outcry already has forced the issue with kia anyhow.

Let's say a hardware exploit for iPhones becomes obvious and is spread through social media. Something absurd like "attaching a shorted iphone cable".

Are you going to be the first to buy an add-on lock or immobilizer? And everyone should also have to purchase an add-on?

I'd expect Apple to refund the cost of the phone and mail a box to send the faulty device in for recycling.

Making a defective product should not be free.

>And everyone should also have to purchase an add-on?

Yes!

-Apple

They gave everyone a plastic case for free, after the world went nuts over just how stupid that issue was.

Let's not paint Apple with an altruistic brush.

Of course they’re not altruistic, it was a damage limitation PR exercise.

The point was that the didn’t, as you suggested they would, charge people on this occasion.

They cost people a lot of time and grief over a goddamn boutique phone, that they were warned would have antenna issues, by the guy that was...Apple's most senior antenna expert, Rubén Caballero, and he was ignored.

When physics caught up the Apple marketing, it took months for Apple to roll out a cheap bumper guard and acted like they were doing everyone a favor.

They never reimbursed people who bought a case to mitigate the issue. They did reimburse those that did have to purchase a rubber bumper.

While you are technically correct, that's about it. The whole thing was a sh*tshow and Apple acted like the users were the problem until enough of the world mocked them into providing a work-around for a problem that they should have addressed before it was even sold.

It was a feature!

https://osxdaily.com/wp-content/uploads/2010/07/iphone-4-ant...