“Thanks for the nice write-up. Gotta admit the video still irks me. Like, portrait to landscape mid-recording… Since it was only a minute, think re-recording would be well worth it.”

h264 is the better choice for short progressive download clips on websites if compatibility matters.

>Firefox enables HEVC on:

>Windows from Firefox 134 using either hardware (on devices that support it, where the range is the same as Edge) or software (on Windows the user must pay for and install an extension)

>macOS from Firefox 136 using either hardware or software.

>Linux from Firefox 137 using either hardware or software (via the system ffmpeg).

>Android from Firefox 137 using hardware only.

https://developer.mozilla.org/en-US/docs/Web/Media/Guides/Fo...

...and even if this wasn't the case, FF has 2.5% market share. Using a 20 year old codec for 2.5% would be insane. If anything, he should be using a newer codec like AV1 that's also widely supported.

Surprisingly, in my experience h264 produces higher quality (better VMAF) for the same bitrate.

My theory is all the codec-optimisation attention went to h264 because of the crazy licensing situation of h265

You probably used the wrong settings. Netflix said "AV1 streaming sessions achieve VMAF scores that are 4.3 points higher than AVC and 0.9 points higher than HEVC sessions" 9 months ago: https://netflixtechblog.com/av1-now-powering-30-of-netflix-s...

Allow me to rephrase: "I can understand why an open source developer, when considering what codec to contribute their time to optimising, might not choose the one that has four required rival patent pools waiting to get rich from their unpaid work"

I don't think that's accurate, since the first Apple processors with AV1 support only came out in late 2023 (A17 Pro, M3).

No it isn't. I am running Windoze 10 which doesn't have the h265 codec Firefox needs.

I can play h265 fine in PotPlayer which uses its own decoder. Firefox depends on the OS.

You have the choice to use highly compatible video formats on the web, or shrug and put a single h265 file in your video tag like OP did.

He is not protecting the car company. He is protecting himself.

But it makes the content seem awkward and clunky. So a reader going in with the correct context has a very different experience.

  In the past few years, we'd found ways to remotely control vehicles from Honda, Acura, Nissan, Infiniti, Hyundai, Genesis, Ford, Porsche, Kia, and Subaru, but we'd never found a vulnerability that enabled remote access to either an Automaker #1 or Automaker #2 vehicle.

Why would they be so circumspect? Presumably the automaker has fixed this by now.

Often when the situation is "Most makers are 1/10, but we're 0/10" a small amount of effort can get you to 4/10 and until the attackers up their game you look stellar, even though in reality you're still doing a poor job, everybody else was worse.

  After we reported the vulnerability, both automakers fixed it within about two hours and rotated the affected credentials. The affected systems served customers in multiple regions; we tested the complete chain only with US accounts and vehicles.

The Holden Piazza, Holden Gemini, Holden Rodeo and Holden Jackaroo were all Isuzus. The rodeo and jackaroo were the earlier incarnations of the Ute and SUV they sell now directly as Isuzus.

Also, fun fact, years ago Isuzu sold the Isuzu MU Wizard. MU is an abbreviation. The full name is Isuzu Mysterious Utility Wizard which has to be the best name for a car of all time.

A cursory glance seems to suggest it’s right and it took less than 2 mins to both ask and check its answer, which is a little scary.

[1] https://github.com/ide/lexy/blob/main/docs/vehicle-status-an...

[1]: https://transconnect.com/en/blog/car-theft-in-europe-popular...

If they can't get the simple parts of security right, like verifying a user's email before creating an account and linking it to a vehicle, then I have little confidence in the security of other parts of their systems.

https://en.wikipedia.org/wiki/Kia_Challenge

IMO the practical solution to this problem - because telling companies "just do security better" works as much as telling fat people "just eat less" - would be some kind of central registry of car parts. This was already implemented in iPhones back in the day that if a repair wasn't signed off by Apple, you couldn't install a new part to your iPhone. I imagine that if the government had a similar thing but for cars, then thieves would stop stealing cars because each stolen part would eventually be flagged somewhere and the end customer would be upset, never coming back.

I say "government" because companies cannot be trusted to make a simple interface "log in -> enter part number and car license plate -> ready to install". I assume that outside of the US the "log into government website" part is already solved in one way or another. On the privacy side, it really shouldn't be controversial, assuming that people are already used to the VIN having a repair history tied to it.

Not that I expect the argument to go anywhere.

- Never hard-code credentials (especially in front-end exposed code) - Never share credentials between environments (especially between prod and non-prod)

And that first rule, in particular, you can (and should) very easily enforce with static analysis tools. If they had just made it harder to shoot themselves in the foot, with basic checks like that, this hack would probably not have been possible.

It's not that difficult. If your security is bad, somebody finds and tells you. Then you have five options: (a) attempt to prosecute them, (b) thank them for their volunteer work and tell them to fuck off, (c) give them some loose pocket change for their help, (d) actually pay them a real bounty, (e) offer to hire them. ~0% pick E, ~10% pick D. The people who can help them literally come to their door with hard proof of their ability to help, voluntarily, and 90% of the industry snubs their nose at the very people who can take advantage of bad security. This problem is entirely self-inflicted.

Also worried in 50 years reviving old cars would be tough because some servers were down. Maybe a maker goes under and stops signing their parts?

Sure it could be implemented intelligently instead though. But maybe better to ensure all have superb education and employment opportunities at wonderful wages.

Is it so hard to just offer said hackers a boatload of cash to switch sides?

I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.

1. Enough computer control for reasonable efficiency

2. Largely independent computers

3. No centralized infotainment that controls the entire car (you can swap the radio)

4. Still lots of knobs and dials, no touchscreens

5. Enough computers to get pretty good diagnostics if/when something goes wrong

6. Most of them have lock clickers, maybe trunk, almost nothing else

7. Engines are older, built "heavily" and don't suffer from too much boost / high bearing load

I think the last one is a big one that the closer a car gets to say 2020ish the more you really have to look at how it was built to know what you're getting. It's great to have a two-stage oil pump to reduce pumping losses when an engine doesn't REALLY need 60psi of oil pressure at all times. But GM 6.2L V8s are grenading all over the place to save less than 1mpg and over 100kmi at say 18mpg vs 17mpg that's 5555 gallons of gas vs 5882 gallons or 350 gallons. Even at $5/gallon that's only $1750 in gas vs $10-$20k for a new engine and I can't imagine it's net-reduced emissions as there's absolutely a bunch of emissions encapsulated in that at least $10k price. This is just one example.

BTW I'm not advocating for any policy or that anyone should be forced to do anything. I'm just personally more excited about keeping older (fuel injected, computer controlled, efficient) cars running well than I am about spending a bunch of money on a new car that's got a lot of engine "innovation" in it where all the kinks haven't been worked out yet.

If you a “burn anything”, no emissions junk to fail diesel, stick to pre 2006

Sales also plummeted at major European and Japanese automakers during this period - Toyota recorded its first loss in decades etc.

White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...

Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.

I miss the web being less career focused and more crazy

I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.

But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.

It's almost like something is happening to make sure this happens endlessly. It's probably nothing

ultimately, nearly everything can be destroyed in such a way as to gain whatever access to anything that you want.

A trustless society is a pipedream, but security theater creates an emphasis that limits plausible deniability. an attacker can no longer claim they targeted something they believed no one cared about, or that wasnt a big deal. For example, the level of theater involved in the TSA does not exist to catch every possible threat to aircraft. It exists so if anyone is dumb enough to smuggle a weapon through it and get caught then security can arguably gun them down on the spot. without the theater, the social contract is less obvious, and the plausible deniability for the attacker is stronger

I'm assuming he means AWD.

Suffice to say, in British parlance any vehicle with four driven wheels can be called a "4×4"

I only have four wheels. If all the wheels are driving, and I only have four wheels, then...

Again, I do know what the conventional difference is, but it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, or which name maps to which mechanism.

4WD is for off-road use. All tires rotate at the same speed.

At this point, the distinction is gone, because car bards marketing.

(AI something lies)

Re: the 3 locking mechanisms comment, in typical 4WD configurations the transfer case in 4H/4L is essentially locked (which is what makes the above sum front == sum rear condition). AWD transfer cases can be more flexible there; some essentially act as a 3rd differential and result in all four wheel speeds being essentially decoupled (for better or worse, easier to get stuck) while others actively control the front/back locking with clutches or hydraulics or whatever.

The "locking mechanism" known as traction works pretty well most of the time and has the nice side effect that it only wears an easily replaceable consumable when you break it.

Think of it more like it's going to be 2WD most of the time, but when there is low traction (such as ice) the 4WD will engage.

4WD is a permanent thing, or at least always on when you engage it.

Some AWD systems might intelligently change power to different wheels (or front and back) and that might vary per brand and model. 4WD could also do this. Usually with 4WD you might also have a 4 lo and 4 hi gear as well.

Then there's also various types of differentials and locks and whatnot which is a whole more detailed discussion.

https://en.wikipedia.org/wiki/Six-wheel_drive

So nwheels x n driven wheels.

But 6x4 notation is handy when you have six wheels, sure.

AWD: All wheels can get power and differentials are used for turning, etc. Therefore, if one wheel has no traction (snow / mud / ice) and slips, it draws all the power and you can't move without restoring traction.

4WD means all wheels spin at equal rates; there are no differentials. Therefore even if one wheel slips, the other three will pull you forward. Great for off-road but sucks for higher speed driving with turns.

4WD vehicles are often part-time 4WD, meaning they can be switched between 4WD and RWD or FWD.

AWD vehicles are full-time AWD because part-time AWD is unnecessary given that the drivetrain delivers power where it's most needed.

The clearer distinction is that a 4WD has a second gearbox (aka a transfer case) that either manually or automatically engages the front wheels, the Jeep Wrangler /TJ being the architype.

AIUI, you lose energy because the power/torque has to go through an extra differential, transfer case, etc, before reaching the rear wheels.

Going from the engine through the transmission to the front wheels is already a 'fixed cost', but the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay if you don't need to.

True for a FWD v RWD car decisions, but in an AWD are not the rear differential and driveshaft still turning whenever the rear wheels are turning? Even the clutch packs should still be rotating even if disengaged. The fact that there is no power through them doesn't mean they aren't generating losses.

It sounds like the savings are more in construction costs than fuel savings.

If your back wheels are rotating at the same speed as the front wheels while you turn, then you'll induce wheelspin on the rear and potentially lose control, or damage your tyres, drivetrain, or engine.

Full-time 4WD and AWD cars have three diffs, one on each axle, and one between the two.

Others have mentioned the RAV4 which actually has two separate drivetrains, which is a different implementation all together.

Most RWD and 4wd vehicles are longitudally mounted, allowing for easier packaging of power to the rear of the car.

The transverse packaging works much better in FWD configuration as

1. Packaging; the relation of the "AWD" (mostly FWD) transmission and a tranvserve engine is naturally a smaller form factor than other combos. Plus, the lack of traditional diff/transfer case is tons of weight savings.

2. Average driving; "FWD mode" in AWD vehicle is functionally equivilent to a FWD vehicle. This is ideal for most driving, IE; snow, fuel economy, understeer etc.

AWD - clutch packs. Best for nasty conditions on road, IMHO.

You might have something like a Series Landrover transfer box where in 4WD mode the front and rear axles are locked together and in 2WD mode only the rear axle is driven.

But does that make a Defender, RRC, or Disco with LT230 transfer box which has a lockable diff AWD or 4WD? The centre diff supplies power to both front and rear all the time, but can be locked in slippy conditions otherwise if one wheel spins *none* of the wheels get drive - the axle and centre diff will both spin.

Then what about the later Borg-Warner transfer box in later Range Rovers, where you still have a centre diff and epicyclic gearbox to set high and low range, but there's no diff lock - there's a massive viscous coupling that turns it into a ridiculously stiff LSD.

But in modern times, technology has most definitely blurred the distinction. Higher-end Jeeps also have a “full-time 4WD” that sounds an awful lot like an AWD system that can also do 4WD stuff.

So, eh, it’s probably not a good idea to argue too much about broad categories anymore. Individual systems must be compared

What does this mean?

All the secrecy seems pointless in the age of AI.

It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.

They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.

Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.

I figure someone out there could dump the firmware off an old OnStar module these days and have an AI RE it - we do have open-source cellular SDR stacks that could handle both the analog and digital voice calls on old vehicles.

Literally all of civilization is built on the back of that, and if it erodes then We're doomed.

Did it have an alarm system?

If you mess with your front door lock, make sure to do it with the door open, to prevent locking yourself inside when the pins get jammed into the keyway as you turn the lock 180° (don't ask me how I know this).

or sometimes, even just shim it open.

That's because in nice places, locks are vestigial. There are no criminals around, so they'll never be tested. And few criminals try to pick locks. They just smash a window or kick a back door open.

No wonder the ratbag kids these days are running around with them - they're only like $400 on Aliexpress and Temu. The world of "all keys lost" shenanigans is a wild one. There's cat-and-mouse games between Autel and automakers and users trying to "block" certain regions and users from leveraging the all-keys-lost features to try to cut down on auto theft, but where there's a will, there's a way, and Autel's just running a shitty Android app on an Android 8 tablet...

https://samcurry.net/forgerock?ref=shubs.io

Daybreak red for offensive action is a better trained model of Sol 5.6 for offensive action.

"tesla relay attack"

Read that part.

  Brown said everyone needed a better stereo in the 1990s. Factory radios were lousy. But the aftermarket stereos that people bought to replace the factory-issued ones could easily transfer from one car to the next. For example, if thieves steal the factory stereo from a Volkswagen Jetta, they're going to need a buyer with a Volkswagen Jetta, and all a thief can offer is the stereo the owner had to begin with.

Factory stereos got good (and complicated). Aftermarkets got cheap.

I'd be more concerned about what the author only mentions in passing: They gained access to private customer information relatively easily. This has become such a huge problem in recent years. These sort of hacks and data mining is what the majority of cybercrime is based on these days, other crimes are downstream of it. Companies have too much of our personal information and they're not doing much to protect it.

I'm not so sure about that - I used to have some fancy cars in the past and I've heard many stories from people saying they've been followed to car parks, home, or had only the keys stolen from their home and nothing else - fancy high end cars are almost always stolen "on order" and not by opportunistic thieves. These are the kinds of people who will research what is needed to take your car before they come to your home.

Does anyone know if something like a McLaren or Ferrari have similar systems? I can easily imagine Lamborghini having something like this since they are under the VAG umbrella.

If the author's Subaru project[0] is anything to go by, some automakers have ability to remotely stop and start the car too. I don't see why you would dismiss this

0 - https://samcurry.net/hacking-subaru

Car alarms that go off are soon muffled, and any onlookers that turn see a group of high vis jacket workers, faux company logos, and a bunch of shrugging reactions to the alarm.

One set of "threat actors" that will love being able to bypass remote disabling are the teen joy riding crowd that live to bait police into high speed chases.

In practice, though, they can often be done with a vehicle, having lapped freeways at speed once or twice and torched a wreck before the details are up and action is taken. Disabling remote access would be a boon for taking off in any actively monitored cars, of course - a good security company should flag a car acting out of band and contact the owner pretty quickly.

Or an amateur with a mallet, a key blank, a file, and an o-ring.

https://en.wikipedia.org/wiki/Lock_bumping

As to professionals: from my limited experience when they are dealing with a cylinder lock they will start with a stiff plastic card to push the bolt free, and if that doesn't work, the next thing is a hook tool through the letter box. Attacking the cylinder itself is well down the list.

Also, you got in completely legitimately as far as the car knows, so no need to worry about alarms or anything like it.

I don't see any indication here that's the case - opening the doors is very different than being able to start the engine and drive off.

> At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.

At the end of the day, with both writeups combined, we could send remote commands such as unlocking and turning the engines on, for any of the automaker's vehicles in Australia, the United States, and Canada.

If you have a car with factory remote start, try this yourself -- try remote starting the car, then getting in without the keys and driving away. You can't.

[1]: https://en.wikipedia.org/wiki/Wafer_tumbler_lock

[2]: https://www.youtube.com/watch?v=oztjRNKKTwE

[3]: https://www.youtube.com/watch?v=g0c1UAeuKlw

You will need an online account to use the car, wont be able to repair yourself, etc.

You realise that in the EU cars have a SIM in, and an emergency button? This is since 2018, see: 112 eCall regulation.

I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.

Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do the research.

Somebody make this happen.

I read comments that this may still not be ideal, as when you take it a dealer service (especially during the warranty period), all the collected data is cached locally and may eventually get uploaded to the proverbial mothership at that time. If you can/could tell it to stop collecting generally, then there's nothing to upload, antenna or not.

Not sure how valid this thinking is, but it is worth considering as a 'threat model'.

The trend might even be moving away from some types of inspections.

For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]

[1] https://en.wikipedia.org/wiki/Vehicle_inspection_in_the_Unit...

[2] https://legiscan.com/LA/text/HB1085/2026

Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.

Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.

That's a funny perspective from a hacker. From the other side I'd be incredibly annoyed if my application server was legitimately resolving path directions like "..%2F". That's the kind of "feature" that's been responsible for some of the worst compromises recently. I'd include both *sshole and log4j in that category.

All remote unlock is doing is adding an unnecessary insecure remote layer on top of that for convenience.

Also, there was something sticky with the door lock. If I used the key instead of the fob, sometimes the anti-theft system would not disarm and the only way I found to disarm it was to use the fob to turn that alarm off. Grrrr. Fobs lasted about 3 years and cost $100 to replace/reprogram.

My current car (a Miata) has a key only to unlock the door in the event of a dead battery. It has a pushbutton instead of the traditional ignition key, so the key is pretty useless outside of a dead battery.

They hook a lot of people now with the first couple years free, then spin around and go for a $150+ a year whammy. We gave up.

Not just necessary, but very necessary? I understand it's convenient, but I think you've overstated it a bit. You can always start your car and then go back in the house for a few.

Factory remote start is designed to be operated while unattended, and prevents people from stealing the car, prevents it from running too long, etc.

I live in a cold climate. Remote start isn't even necessary much less very necessary. I start the car, then clean off all the snow and leave. Running the engine isn't going to remove a foot of snow off the windshield and it definitely won't off the roof or hood.

Regardless remote starters do not need the web or a phone, they existed in the 1990s.

you can argue that the security tradeoff is not worth it, but claiming the demand is not there is just silly

> So you can be just a little bit more lazy

Which:

> i can either go back inside to get the keys, or just open the car from the app

I think qualifies, personally. Your house might be way bigger than mine though

Should we get rid of washing machines, dryers, Cuisinarts, in-sink disposals, etc too? They've even killed and injured people all so people could do slightly less work.

Humans love convenience, our entire modern life is oriented around technology created to serve those motivations. An extra way to unlock something with a single point of failure is clearly going to appeal to that same instinct.

That's the thing, the lazyness actually doesn't improve the daily life because all those steps saved end up having to be done in a gym.

I’m not saying physical keys are not needed, but a nice digital solution is one of the things I really wish I had a Tesla. I wish the other car manufacturers would actually invest in good mobile experiences, they’re all such ass.

Seems like a real problem with actually addressing

However there are some edge cases where these systems do not always lock when walking away, if you're opening other doors, the trunk, etc.

Not a good assumption from what I've experienced. It seems quite the opposite to me. Even limiting it to the past decade of model year most cars I've driven do not do this, only a few do.

good question. I don't know? There are three things I carry with me literally everywhere: phone, keys, and wallet. Any one of them missing in the morning means I have to hunt around the house to find them before I can leave for work. This would not change if I could unlock my car with my phone (I still need to be able to lock my front door and/or let myself in when I come home again, requiring keys)

That's not to say they make sense. The total amount I spent on having the locksmith let me back in to my apartment that year was significantly less than the cost of putting in a combination lock.

Unlike say etcd where three improves reliability to the best of the three, three locks would decrease reliability to the worst among them.

Then tying that in to be managed by a computer makes it even more handy. When I have family coming over, they can just use their own PINs to get in instead of having to manage yet another physical key. If its an even more one-off allowance to let someone in, I can easily just unlock from my phone. It also makes it easy to have doors automatically lock on a schedule.

I wouldn't want to have to go back to a world where I have to carry house keys with me every time I leave the house. It sounds way less convenient day to day, for the minor effort of swapping some AA's every six months or so for frequently used doors.

So many of my trips I leave with just my phone. Its my car keys. Its my transit pass. Its my money. Its my map. Normally I wouldn't want to take so much extra junk with me every time I'm just going to grab some groceries or getting lunch with a friend or going to the library.

Modern cars already make it much more difficult to lock your keys in the car than in ye olden days.

And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff. It's not like that "did I lock it" check helps prevent a "someone smashed the window and grabbed something out of it" scenario anyway.

It's completely unnecessary.

Modern cars automatically lock themselves when they sense there are no keys nearby, nobody in the seats, and the doors are closed for x minutes.

Neither of my modern cars have that behavior.

There are plenty of 2026 and if not already soon to be model year 2027 cars which do not have this feature available at any trim level.

That some cars have it does not mean "modern cars" as a whole category have them.

Are there cars that let you drive them without the key?

My car allows me to unlock it with a phone from the other side of the planet. But to actually drive, it requires the key to be inside.

But the previous comment seemed to be about driving a car with no key.

Misplacing the phone actually. Car keys are either in someone's pocket/bag (then you talk to whoever used the car last) or in a set place in my home. The phone might be wherever I used it last.

So, while I misplace my phone more often, I also find it with less difficulty.

And so can the police, and so can DHS, and so can ICE, and so can Google ad services, and so can the last 50 highest bidders, and so can ...

Hmm? As in which room? What if it accidentally slid under the bed sheets, or someone put a piece of clothing over it? True stories.

Doesn't work with anything else.

I do own a car. Keys in home are always in exact same spot. Phone can we literally anywhere, good I have smartwatch and I can trigger "locate my phone" that way.

I just don't get the idea of unlocking car though app via internet. Neither I get the "keyless entry" (meaning I do not even need to touch the key fob to unlock car) and "start button" (well if you place key in ignition switch then you will not lose it!)

The security drawback is not worth, fixing non-existing problem in the first place.

…And what about the many other things one misplaces about the house? For instance, Wireless mice, TV and various other remote controls, etc.

I just cannot understand why the tech crowd hasn't developed a much-needed Missing Objects protocol.

Think of this. When you lose an object you immediately go to a big button that's hidden and securely bolted down (so you can never lose it) then press it. Like your fob key and car, it activates all these easily-lost items and they start beeping madly so you can find them. Lose the mouse in the couch somewhere and and the 'couch' starts beeping. Voilà, one found mouse.

It's crazy that a simple concept like this doesn't exist in practice.

Meanwhile, if I'm out in public and a bad update bricks my phone (or cell coverage is down?) I can no longer use my car. The idea that consumers would hope for more entrenchment into the phone ecosystem is absolutely baffling.

Or at least as a car owner, this is my risk assessment exercise output.

[1] Yeah, I just pulled this off my ass, don't think there are trustworthy stats either in one direction or the other.

My 2012 Chrysler certainly does.

Unfortunately Hyundai decided, in their wisdom, to put the door lock button (to lock all doors) in the console between the front seats. Exactly where Sally stepped when she came from the back.

Both my wife's keys and phone were still in the car.

30 minutes later, a local mechanic showed up. He gently pried the front door open with something like a whoopie cushion, and was able to poke the door lock button and open everything. It took him about 5 minutes.

Hyundai Canada can, of course, open the doors remotely, but when I called them they refused to and only offered to call CAA (the Canadian version of AAA, and the people Hyundia sub-contracts their roadside assistance to). I guess that makes sense considering the liability of remotely unlocking for someone whose identity they can't verify.

That said, the digital key is much more finicky/failure prone than my Tesla's implementation, and has a backup keycard I keep in my wallet (but have never had to use). Generally, rebooting the phone fixes it for some amount of time, until it stops working again with no indication until I try to unlock her car.

I'm not convinced it is even lazy to use a phone to unlock a car.

Mazda charges $10-15/month for their remote unlock/start app.

https://mymazda.com/MyMazda/mazdaConnectedServices.action

Remote start is huge where I live. When it's -10C and there's a foot of snow you have to dig out in the morning, you can start your car from the app and then start shovelling. The alternative is a hokey pokey of shovelling yourself a path to the car, getting in, starting it, getting out, resuming shovelling. Not the end of the world but it's very nice. Even if there's no snow it's nice to get the cabin above freezing while you're eating breakfast.

as for "I often forget to lock the doors"... why do you often forget to lock the doors?

Luckily the other car will at least notify me if I leave it unlocked and can lock it through my phone. Would be nice if it just also auto-locked.

Only if you're like right next to the car. I prefer to remote start my car when I'm more than a few minute walk away from it so it actually has a chance to warm up or cool down. Starting it ten seconds before I get to the car is practically worthless.

i'm in legit cold canada and being able to open my garage remotely and start my car means it's a lot easier to herd small kids into a warm, comfy carseat.

It's effective law enforcement that removes such people from society, and renders your neighborhood safe.

You can never have 100% perfect physical safety.

And reaching near-perfect physical safety requires that the state becomes extremely authoritarian.

You instead want good physical safety and effective law enforcement, and then you add on other mitigations for when those fail. "Defense in depth" - locks for your doors, anti-theft features for your car, firearms for your home.

And even the deterrence of a locked door helps cut down on some crime. People are less willing to rob a car if it means (or even they just think it means) getting cut and bleeding, or getting caught on video.

Let's say you're not at home, well, (1) neither is your car and/or (2) it's still unlocked for however long it took you to remember.

Most new cars automatically lock the doors when you walk away from them anyway.

I'm just not seeing the benefit here.

I really like using my phone as my key for my car. It's nice having less stuff in my pockets.

Clearly, not a critical use case but it is handy.

Remote locking and remote start are much more useful.

It also, as a side benefit, allows the app to send the same commands – or at least an authorised subset – over Bluetooth, rather than via the internet; allowing control in underground car parks, etc.

I've heard so many horror stories starting like this.

I do understand that selling your customers' data is lucrative, but of all the car makers, not a single one thinks there's a market for an alternative?!! I don't understand.

Car ignitions, actually starting a car a driving it away, are a totally different thing.

Most of the newer EV brands (at least in North America, e.g. Tesla, Rivian, Lucid) are very sensitive to automotive telemetry security. AFAIK, they are built by software engineers in house and operating like a software company than a traditional automaker whose software are NOT made by themselves but by 3rd party OEM auto suppliers who may or may not have the security mind when they release their product. In general automotive industry did not have the foresight in security engineering and neither did they do that when it was heavily mechanical and local systems instead of IoTs and electronics when they started.

So the author exaggerates their claim of their work can affect any car in United States.

Every telsa API calls are using the latest TLS 1.3 with X.509 for key card access. Their software updates VERY FREQUENTLY. And they don't use the *-telemetry.com domain that was demonstrated in their hack.