agreed - but they should at least check id to match dmv records - seems a common sense check.

[to the nitpicking gallery: yes - bad guy can use fake id to do this, but any key code pull should be accompanied by a letter to the registered dmv address notifying the pull - all simple checks that would make it harder, costlier and with more points where it could be caught]

Parent to your comment is saying that dealer 1 can provide access to a car in dealer 2's lot. They can each provide service without having access to the other's cars. Therefore, this is a principle of least privilege violation.

My car was purchased at a dealership in central MO. I live in TN now, and there happens to be a dealership about 10 minutes away. If I need something fixed, why should I have to drive all the way back to MO (especially since if I needed something fixed, my car wouldn't be in any condition to drive for 6 hours)?

Fair enough, I can believe that they can provide a secure key scheme, but understand why they don't. The risk/value trade-off in the general case is small for mid-range cars. The article demonstrated that you could make it high value with right circumstances, which is a clever hack. Of course security camera footage at this guys office would show who was sneaking up to unload his trunk when he was at work.