Sure, they can steal the car AND the key, but more often, it's the car alone.
This is the fundamental problem with all of this stuff -- nobody wants your app. If you can't make it better than sticking a card in the machine, go away. If you can, prove it, by making it an alternative to sticking a card in the machine instead of the only option.
It is customary when borrowing someone's ICE car to pay for the gas used by returning the car with as much gas as it had when you borrowed it, or even with a full tank. I'd expect people will want to continue that custom when the car is an EV.
Nonetheless with an EV you could just hit a button saying “friend has taken possession” or “loaner mode” similar to valet mode. Upon returning the car and disabling that mode the car could present you with an accurate dollar amount of exactly what to pay your friend.
Hypothetical standard: Charger lets car open a low bandwidth internet connection. Car uses it (or cellular) to open an encrypted channel to a 3rd part service (Tesla/Visa/whatever) saying it’s VIN, password, and the charger’s ID. Charger gets payment from 3rd party.
PS: I would rather chargers just had working credit card readers, but individual chargers don’t do many transactions per day so apps are a cost saving thing.
You're fundamentally trying to transfer your money to the operator of the charger, but they aren't standing around to give cash to, so you want something digital. Alright, so your bank should do this -- you authorize your car's private key to make withdrawals from your bank account at charging points and we're all set. Except that banks suck at this sort of thing, which is why we have the credit/debit network to create some kind of standard. Except the standard is credit cards, not public key cryptography.
You wanted to give your money to the charging point operator but instead you have to give it to your bank to give it to Visa to give it to the charging point operator. Now we're going to add "Tesla/whatever" to the chain? This needs to stop. You stick with the card reader until you figure out how to get banks, using some kind of standard, to support the public/private key thing and we can remove a middle man instead of adding one.
Following a recent trip I had a bunch of ~1€ transactions from buying single bus/metro tickets from machines.
Visa credit 0.65%, debit 1 pence. Mastercard credit 0.80%, debit 1 pence + 0.5%.
https://www.whatdotheyknow.com/request/costs_to_tfl_for_cont...
In Europe, sure because the fees are capped. In the US you pay a fixed fee + x% which makes small transactions like this prohibitively expensive
Worse case, if someone steals that key (or the hardware that stores it), they can steal electricity with it. Which also means they'll be caught approximately tomorrow.
If you have that level of access/capability, there's better things to do than using it to get 50 dollars worth of electricity and probably being picked up by police as you siphon it.
Besides, there's easier and stealthier ways to get free electricity.
If you just send the payment info via the charging plug, now you have to worry about the payment info being stored in the car and potentially stolen if the car has any security vulnerabilities, including in the charging port.
If you use some kind of tokenization or similar then you're inserting third party payment processors into the system and they'll be wanting a cut.
Just put a card reader on the charger and be done with it.