Live data from Hacker News

Insecure vehicles should be banned, not security tools like the Flipper Zero

saveflipper.ca

881–890 of 916 posts

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#881

Earlier quoted context omitted.

> Failing to implement even the most basic security measure, which is considered industry standard, in a high-value product that is known to be very attractive to thieves and then selling that product to consumers with no warning that "unlike most other cars on the market, which have many layers of security features, this car can be stolen using a cheap toy" makes the inevitable thefts absolutely Kia's fault. I don't…

This all assumes the "perfect information, even playing field" theory that capitalists love to use but is completely unrealistic. Reviews rarely talk about things like this, this information is not explicitly given to reviewers or customers and neither can be expected to find out on their own (i.e. by trying to hack the car themselves), the car manufacturer spends insane amounts of money advertising to the buyer usin…

> this information is not explicitly given to reviewers or customers and neither can be expected to find out on their own (i.e. by trying to hack the car themselves)

Reviewers don't get the information by penetration testing the car themselves. They get the information because their profession is reviewing cars, so when they hear of this through their high contact surface area with industry news, they add it to their review on their website.

> the car manufacturer spends insane amounts of money advertising to the buyer using every psychological trick in the book

Because cars are big ticket items where a single incremental sale can justify a lot of ad spend, not because buyers are incapable of reading a review.

> the buyer is often under time pressure

The buyer is rarely under time pressure. Most people don't wait until their car breaks down to replace it, and even if they did and desperately need to have a car, then they would rent or lease one in the interim while shopping for another one. This is often even covered by insurance. Almost nobody is in the position of having to buy a car immediately without time to do any research, and the percentage of people who are isn't enough to significantly affect which cars or features succeed in the market.

> the savings from cost-cutting are rarely passed down to the consumer

That would imply that all new cars sell for the same price. Clearly they don't, because customers distinguish between them and are willing to pay different amounts.

> Buying things in the current market landscape is a battle, not an optimization problem.

So what you propose is that we reduce the information available to the buyer by requiring cost cutting to be underhanded rather than overt because overt cost cutting is prohibited, or that it not occur and instead prices go up even if you didn't need that feature and then poor people go broke because everything is more expensive.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#882

Earlier quoted context omitted.

[flagged]

I'm saying that it's possible to both be the victim and to have made a stupid choice that made you winding up as the victim more likely. And, clearly, that it's possible for you to be unable to understand such subtleties.

And I'm pointing out that responsibility and blame are not the same things and that conflating the terms leads to positions that are hard to defend. A person may be responsible for their own actions but not to blame for someone else's.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#883

Earlier quoted context omitted.

I'm saying that it's possible to both be the victim and to have made a stupid choice that made you winding up as the victim more likely. And, clearly, that it's possible for you to be unable to understand such subtleties.

And I'm pointing out that responsibility and blame are not the same things and that conflating the terms leads to positions that are hard to defend. A person may be responsible for their own actions but not to blame for someone else's.

> responsible for their own actions but not to blame for someone else's.

You're changing the target of the actions mid sentence. Said person is responsible for their own actions _and_ to blame for their own actions. They are not responsible for someone else's actions nor to blame for someone else's actions.

If a person knowingly takes actions that put them at greater risk, then they are to blame for putting themselves at greater risk.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#884
post #828

Earlier quoted context omitted.

I locked myself out of my car so often I ended up wedging a coat hanger under the rear bumper. You're right: car doors used to be trivial to yank open when you knew the trick. These days I'd love to create a little side project that sets the alarm off on my car any time a relay attack is detected. I'm sure Mark Rober or someone will end up doing it.

what would the alarm do other the annoy a few hundred people. It wouldn't save your car. car alarms should be banned imo. replace them with something that pings your phone maybe but the alarm does nothing

There are alarms with phone messsaging, tracking, remote start and disable. Also relay attacks are easy to prevent, just put your smart key inside a faraday bag or remove the battery.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#885

Sooo they have been stealing Infiniti's from my area recently with relative ease allegedly by using a Bluetooth obd2 reader connected to an android tablet running a pirated copy of some Nissan service tech software. Nobody from any of the Infiniti groups is 100% certain how they are doing it, but the best theory out there is above. Just the other night, a crew of dudes stole 3 Q50’s from my neighborhood with relative…

Well for one thing the OBD port shouldn’t be designed so that it has direct access to any useful CAN bus. It should go to a gateway that requires authentication to do anything except read OBD, and all of the IDs that you are allowed to send should be whitelisted. The issue people are mentioning with the headlights is easily solved by just moving the starter CAN to its own CAN bus between the immobiliser and the ECU (…

The solution is not that complicated, just route the wiring harness on a location not easily accessible from the exterior of the vehicle. There’s nothing that can stop thieves just delay them enough to increase their risk to be discovered.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#886

Earlier quoted context omitted.

I don't have much faith that our regulators are going to get their shit together either, but that doesn't mean I can't hold them responsible for the consequences of their negligence. As for the theory that the invisible hand of the market will drive better outcomes in traffic safety, that is obviously not happening in aggregate. It may even be having the opposite effect, given the unchecked proliferation of pickup tr…

Depending on the make and model of a car, you might save money because insurance companies have determined those cars to be safer. If you have a lowjack, your location, your history, there are a lot of factors that go into insurance costs. Insurance companies adjust insurance prices based on risk. Why would you assume private insurance wouldnt also price their policies based on how safe a train is, what the risk is t…

> Why would you assume private insurance wouldnt also price their policies based on how safe a train is, what the risk is that it crashes, etc.?

I don't assume this and I don't think I have even slightly implied that I do. It's obviously, trivially, verifiably false.

Your mistake is in assuming that cost is the primary motivating factor for consumers^[1], and that corporations and their stakeholders won't favor paying higher insurance costs (and fines, etc.) today over paying even more toward safety improvements that won't break even wrt. insurance costs for many years. As I mentioned above, the observable state of the real world explicitly disproves the claim that market forces will drive positive trends in safety outcomes.

^[1] Look how many huge, expensive pickup trucks are on the road in America today. Look at the monthly payments their owners are enduring to satisfy their vanity; look at their spotless paintjobs, empty beds (except perhaps the token equally spotless toolbox), and mud-free fenders.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#887

Earlier quoted context omitted.

> That'd actually attract less attention that outright hotwiring a vehicle. Disagree. Depending on the approach taken, the theft can look like a legitimate owner getting into a car. Even the break the window and reprogram a key via ODBII port technique takes about a minute to complete. Plenty of people have posted videos of their cars being stolen (I'm part of several Camaro communities, which are big theft targets)…

Yeah, I broke into my own car recently using a coat hanger, nobody cared.

My sister lost the key for her bike lock while her bike was locked.

I pulled up with a grinder and destroyed the lock in a busy downtown district in the middle of the day, loaded the bike into my car, and nobody said a thing. I was actually a little shocked since I had come ready with the receipt for the bike and everything.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#888

The childishness of this headline is something else. People who like 'security tools' feel entitled to demand everyone else exhaust themselves in a never ending security arms race. Here's a compromise; things like Flipper Zero stay legal, but if you get caught with one, you're treated the same way as someone walking around with a crowbar.

This is already the law in many places. This is an article about Canada but, for example California Model Penal Code 466 says that:

Every person having upon him or her in his or her possession a picklock, crow, keybit, crowbar, screwdriver, vise grip pliers, water-pump pliers, slidehammer, slim jim, tension bar, lock pick gun, tubular lock pick, bump key, floor-safe door puller, master key, ceramic or porcelain spark plug chips or pieces, or other instrument or tool with intent feloniously to break or enter... is guilty of a misdemeanor.

Basically, if you are carrying anything that will be used for breaking and entering, with the intent of breaking or entering, that also is a crime.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#889
post #781

Earlier quoted context omitted.

> And if Boeing makes a cheap, unsafe plane, don’t fly on it yes. exactly. if boeing ever makes a cheap plane, i would definitely avoid it. you are comparing a company that cheated on legally mandated safety requirements with a company that didn't put a non-legally required car immobilizer on a lot of their new cars. and then didn't lie about it. > But currently companies will simply defraud you but kia didn't do thi…

> if boeing ever makes a cheap plane, i would definitely avoid it You wouldn’t even know that airline is putting you on such a plane

the point is that boeing might make a good plane or it might make a dangerous plane, but it will never make a cheap plane.

Re: Insecure vehicles should be banned, not security tools like the Flipper Zero

#890
post #540

Earlier quoted context omitted.

A traditional car key can be trivially duplicated at any hardware store. That's the difference. You can make as many spares as you want for a couple bucks a pop. No dependencies. No network.

Do any cars have "traditional keys" anymore? My 15 year old Corolla has an embedded RFID tag in the key, and can only be duplicated at a Toyota dealership.

Assume that for anything new enough to have keyless entry, the answer is no.

The big switchover was in '96 when OBDII/CAN bus became mandatory. At that point it became pretty cheap to do things electronically, often cheaper than mechanically, so lots of things started switching over around then.

Post reply on HN