None of this needs to happen. Frankly insurance companies need to be holding the car manufacturer’s feet to the fire by not insuring cars that can be trivially stolen like this. If a Flipper Zero can steal a car that is 100% on the car manufacturer.
If a tiny yubikey can generate cryptographically unique keys so can a car key fob.
It would not be that difficult to design a key fob which pairs with the car wirelessly (just like Apple uses for AppleTV and Apple Watch).
Literally all you need is:
- Car has private/public key pair
- Sync keyfob to car – keyfob generates unique key pair, keyfob shares public key with car.
- When the keyfob communicates with the car, all signals to unlock or start are cryptographically signed, then the car sends a token to authenticate and confirm the instruction.
If anyone complains about battery life just make the fob rechargable instead of the annoying shitty battery change process. You can even make a charging port in the car (where they keyhole used to be, or in the wireless charging tray).
Plus this can be extended to phones with zero trust and no need for external infrastructure or violating user privacy.
Broken@lemmy.ml 6 months ago
I agree with the sentiment, but unfortunately that screws over the owners far more and for far longer before it even impacts the car manufacturers.
Maybe a better attack (aside from government regulations) would be banks to not provide financing for loans to buy those cars. In the end, if the car is stolen they are at a loss so that makes sense.
People can’t get loans, so don’t buy the risky vehicle. It hurts a little in the now to direct them towards cars that will not be a problem in the future. And the car companies feel the sting of lost sales right away.