Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Insecure vehicles should be banned, not security tools like the Flipper Zero

saveflipper.ca

Post reply on HN
Print view View original

71–80 of 916 posts

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#71

Post by whimsicalism »

AYBABTME wrote: post #57
markhahn wrote: post #45

Earlier quoted context omitted.

This logic depends on law-breakers being fully rational agents. Yes, there are some, at least some of the time, but very few.

If they're not rational, they can go to jail? Isn't that the idea of jails: take people out of the system if they refuse to act by the rules of the system at other people's detriment.

Think there is not a clear ‘idea of jails’.

To me, the length of sentences in the US suggest that a primary purpose is deterrence, not merely keeping dangerous people off the street.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#72

Post by sidewndr46 »

ngetchell wrote: post #56
sidewndr46 wrote: post #10

This has to be one of the dumbest things I've read in a while. All vehicles are insecure. I can hook a tow truck to almost any vehicle, including an 80,000 lbs tractor trailer and drive off with it. That'd actually attract less attention that outright hotwiring a vehicle. The solution is to identify, arrest, and prosecute criminals. Which the government is not obligated to do in the US.

What do you mean they are not obligated?

At least in the US the role and responsibilities of the police is to protect the government. They may protect the citizens, but they can never be held liable for a failure to protect the citizens.

You'll have to ask a Canadian about the specifics of the various provinces.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#73

Post by InitialLastName »

stainablesteel wrote: post #35

how are major car manufacturers so far behind in security? and why can't they go back to the old solutions that didn't have these problems? its just such a stupid thing to watch IF these fancy keys that let you start your car without inserting anything cause your car to become extremely vulnerable THEN maybe its a bad idea, jesus christ

Because whenever it's even vaguely cold outside, my neighbor likes to be able to start and idle her giant truck in her driveway without leaving her house (for 40 minutes before she drives a mile to work).

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#74

Post by adolph »

markhahn wrote: post #29
hoofhearted wrote: post #21

Sooo they have been stealing Infiniti's from my area recently with relative ease allegedly by using a Bluetooth obd2 reader connected to an android tablet running a pirated copy of some Nissan service tech software. Nobody from any of the Infiniti groups is 100% certain how they are doing it, but the best theory out there is above. Just the other night, a crew of dudes stole 3 Q50’s from my neighborhood with relative…

Obviously, we want owners to have full access to their car's CANBUS. So the question is: how should the OBD-2 plug (or wiring) be protected?

As I understand it, CANBUS is a message network among relatively low-power devices. There are two ways of doing this:

  + Some credential exchange between devices to establish a web of trust
  + Devices are locked similar to Apple parts

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#75

Post by acdha »

raizer88 wrote: post #47
markhahn wrote: post #29

Earlier quoted context omitted.

Obviously, we want owners to have full access to their car's CANBUS. So the question is: how should the OBD-2 plug (or wiring) be protected?

All CANBUS packages that are useful to drive a car should be encrypted using a public/private key that is in the owner key. Decryption chips are cheap and fast.

Maintenance is a big key management problem though: if only the owner has it, there will be problems when people inevitably lose it. If there are shared keys for service departments or databases, thieves will get access to them.

Things like time-limited on-demand keys can limit those problems but now you can’t get your car serviced when Toyota’s servers go down and they need to commit to not breaking API compatibility for multiple decades.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#76

Post by ceejayoz »

jonhohle wrote: post #51
drdaeman wrote: post #19

Earlier quoted context omitted.

This penalizes unaware pre-existing car owners. Not only they got a crappy car, they now have to pay more for it - all because the vendor was sloppy. Doesn’t seem fair to me. The responsible party should be the automaker that built or installed the security system, not the person who was sold a lie.

Or, you know, the people _stealing_ cars. I feel like this is bizarro world where what was previously accepted as adequate deterrence is now penalized because actual criminals have fewer and fewer incentives to follow established normal behaviors. “Maybe your face shouldn’t have been so punchable” is not a reasonable position to take, imho. Flipper, lock picks, bolt cutters, etc. are all reasonable tools. So is the e…

Kia and Hyundai saved like $20/car by skimping on a part that all the other major manufacturers include by default, leading to cars that were insecure by design. That's negligent.

Punishing people for taking advantage of that vulnerability is certainly warranted, but it's also closing the barn door after the horse has already bolted.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#77

Post by sidewndr46 »

eli wrote: post #53
sidewndr46 wrote: post #10

This has to be one of the dumbest things I've read in a while. All vehicles are insecure. I can hook a tow truck to almost any vehicle, including an 80,000 lbs tractor trailer and drive off with it. That'd actually attract less attention that outright hotwiring a vehicle. The solution is to identify, arrest, and prosecute criminals. Which the government is not obligated to do in the US.

These cars are being sold with defective security measures. They don't work the way manufactures promise or customers expect. It shouldn't be any different than a car sold with headlights that are too dim

But that is my point. All security measures are defective. I can always tie a chain to your vehicle and leave with it. Security measures deter criminals, they can never stop them. Only the government can do that. The government is not obliged to do that in the US. Thus, no one can stop criminals

To metaphorically put it: no matter how good your 2FA is, I can always get around it if I can torture you or threaten your loved ones.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#78

Post by hcfman »

gchamonlive wrote: post #17

Security flaws are not born equal. I think there is supposed to be a clear distinction between flaws inherent in technology -- since you only know what you know nobody should be expected to develop impenetrable digital fortresses since that doesn't exist and would actually be harmful for the consumer -- and those flaws born out of neglect. The latter should be specified and treated accordingly, because it isn't a val…

Europe expects you to. Otherwise you will be fined 15,000,000 euros. Thank you cyber resilience act.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#79

Post by 01HNNWZ0MV43FF »

hackernewds wrote: post #69
ngetchell wrote: post #56

Earlier quoted context omitted.

What do you mean they are not obligated?

The govt actively chooses which individuals violating the law to prosecute and not especially in progressive cities like San Francisco and Seattle, based on a set of their own principles vs the constitution written by their elected representatives.

Ah great, I'll simply caucus with That Other Party and lose my personal rights as a queer atheist. They'll also deport all my coworkers. Why didn't I think of that? Love it.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#80

Post by jen20 »

whimsicalism wrote: post #54
ceejayoz wrote: post #31

Earlier quoted context omitted.

We tried that sort of approach; it's pretty widely considered a mistake. https://en.wikipedia.org/wiki/Violent_Crime_Control_and_Law_...

I agree that 7 years ago it was widely considered a mistake, but I think we are currently reaching by a new consensus based on the opinions I have been seeing more commonly in the last 3 years. We are in a conservative moment in the US right now.

This story is about Canada, though…
Post reply on HN