News for hackers. Stuff that matters.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by dotancohen on Tuesday May 17, 2022 @05:42AM (#31408055)

  > I've never understood car makers obsession with proximity unlock.
The competition has it. Some people like it.

And in Tesla's case, it saves money. There is no cylinder on the steering column, no cylinder in the door, no steel key to manufacture, no rod going to a physical unlock switch, and no physical unlock switch. So we've saved 500 grams in the car and probably a good $20 too, no to mention the room in the door for the rod and the physical switch, which add engineering work.

There is a long tail of removing grams and dollars from the car manufacturing process, and 500 grams and $20 is significant. This long tail is why e.g. the Model 3 uses a touch screen for most controls, why the rear glass extends far into the roof, and many other seemingly-"premium" features of the Model 3. It's actually cheaper to manufacture them this way.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by riffraff on Tuesday May 17, 2022 @05:54AM (#31408152)
but why use _proximity_ ?

You may just as well require a click on the key fob or phone, the cost savings would be exactly the same.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by brianwawok on Tuesday May 17, 2022 @07:18AM (#31408778)
It’s great. Walk up to car get in and push gas. Stop it and walk away. No locks to fiddle with, it just works.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by bjt2n3904 on Tuesday May 17, 2022 @05:59AM (#31408187)
> And in Tesla's case, it saves money. There is no cylinder on the steering column, no cylinder in the door...

This is precisely what I mean by "brain dead". You'll forgive the hostility, but this is exactly what I'm talking about!

Nothing about this list of things REQUIRES proximity unlock. You can still require the user to push a button on their key fob to explicitly unlock the door.

I get the convenience factor, I do. If that's a feature you enjoy, then great! All the happiness for you. But give me the chance to opt out of something that is deeply broken from a security perspective.

Let me press a fscking button to unlock my car, instead of my car deciding I probably want it to unlock.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by diblasio on Tuesday May 17, 2022 @06:44AM (#31408512)
Setting up the proximity unlock is a manual step and decision you make. You can just not do this and use the keycard + pin if you're wanting more security.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by einarfd on Tuesday May 17, 2022 @06:22AM (#31408352)
I believe I've seen a setting to setup a pin code to drive on my Model 3. You can also unlock the car with the cards that came with it instead of setting up the app on your phone and using Bluetooth. It would be a bit clunky, but it would work. There is also a keyfob you can buy (https://shop.tesla.com/product/model-3_y-key-fob), not sure if that uses Bluetooth or not, and is vulnerable though.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by bratwurst3000 on Tuesday May 17, 2022 @06:41AM (#31408499)
Yes opt out is completly missing with electronic cars. I hope some day it will be mandatory. All those „features“ are useless to me and only freaking me out.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by raverbashing on Tuesday May 17, 2022 @06:15AM (#31408300)
Exactly.

Customers "pushing for convenience" are unaware of the possible security implications of it (to put it in a polite way). And it is absolutely the duty of manufacturers to shut them away from stupid crap like that.

Ask any consumer if they want a Pony and they will say yes.

Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by brianwawok on Tuesday May 17, 2022 @08:07AM (#31409265)
Glad you aren’t my car manufacturer.
Re:Bluetooth relay attacks allow Tesla Model 3 / Y to be unl... by raverbashing on Tuesday May 17, 2022 @08:42AM (#31409671)
Sure, you're free to pick the best solution for you. I'd opt for the most reliable one.