The article is giving automotive companies too much credit. Sophisticated anti-theft technologies don’t translate to high manufacturing cost, especially given that car keys are a very high volume item, typically two are produced per car.
Your iPhone has more sophisticated security measures inside of it along with an entire computer capable of playing relatively recent AAA games and it costs less than some of these keys.
The actual answer is that dealerships make their money on service and demand that the manufacturers throw them bones like this.
> A growing number of manufacturers now offer mobile apps, some of which serve as fully functioning car keys by adding a key to your phone’s digital wallet alongside credit cards and boarding passes.
This was a funny sentence to read. I'm reading this article to kill time while, in another window, I'm on a chat with customer service for my credit card because my credit card stopped working in my digital wallet. I've been trying to resolve the issue for weeks.
So I'm glad my car doesn't require anything like that.
Like others have said it's a revenue stream for the automotive company and the dealerships. The actual software/security side of car keys is "cat & mouse" game because automotive companies either outsourced the design or picked the cheapest/logistically easiest to implement.
The dealerships like making $200+ per fob program and the automotive companies like selling $$$ hardware + software licenses to be able to do so.
It's also likely that a processor that can only do rolling codes but no RNG or AES operations is cheaper and has longer battery life. Car model lifecycles are very long so the choice of components even for ~2018 cars might be using parts form 2013 (my guess). And auto companies are probably only considering parts purpose built for their industry due to supply and price guarantees.
If it wasn't for insurance companies refusing to insure some models with insecure fobs, the issue would likely be much worse today.
One other option not mentioned in the article: Replacing the key shell and moving the guts from the old key.
Obviously not an option if you lost the key, but when my Toyota keyfobs got really worn (button membranes breaking and exposing the underlying microswitch), I discovered that you can avoid the fuss and/or expense of reprogramming the keys by buying replacement key fob shells and moving the circuit board from the old key. Wasn't any harder than changing the key fob battery..
A new key for my 2004 Suzuki Grand Vitara costs $685 in Sweden.
Insurance company offers a new key for $100.
I said I lost it and paid $100.
I considered buying a Chinese key programmer on aliexpress for $200, or going to a black market key programmer that would do it for $100 but I was lazy.
Looking forward to having a car that only needs Apple Car Key in the future.
Tesla is all the way on the easy and cheap end of the scale. It's $40 for two new key cards or $175 for a new key fob, and as long as you don't lose all of your existing keys at once, you can program new ones and deactivate lost ones yourself in about a minute with no extra tools or software. And using their phone app as a Bluetooth key is free forever.
Needing to have all keys present to program a new one yourself is often a security feature. Otherwise someone borrowing your car or getting ahold of one of your keys could possibly make their own.
I just made two additional keys for my 10 year old Toyota which only came with one (bought it used), and it cost me just over $200. And that is aftermarket keys with an aftermarket programmer. The keys are also fobs, which does account for $100 of the cost. $40 for a pair of key cards is a bargain by comparison.
What are you talking about? Most people just use their phone for their Tesla. Most carry they $40 credit card style key in their wallet just in case, but rarely use it. The $175 fob is just a kind of collectors item nobody has except for people who are really into Tesla and buy all the merch.
You get two for $40, and also worth noting is that you can use that on any number of Teslas. I carry one card that works on any of three cars.
Beats the heck out of paying hundreds of dollars to leave the car at a dealership for a few days to get a new key. And as you said: even then, this is just for the key that I need to use if my phone died or I just bought a new one.
I love it, so many things just make sense on my Tesla, which is why I have two. It's really a step backwards getting into any other car at this point. I just walk up to it, it unlocks automatically (because it senses my phone). I fasten my seatbelt, touch one button on the screen, and it then drives me to me to work (through busy city and highway roads). I don't have to do anything, I don't even have to drive it.
It's an NFC card, $5 should still leave them decent margin. Desptite it being nice nice more and more cars just let you use your existing NFC devices it's still starting at crazytown and working your way up from there if you want any sort of physical backup replacement.
Rivian requires a service center to pair a key? That’s a surprise, I would’ve thought they would use the Tesla method of allowing the owner to pair it themselves with a couple taps.
Honestly I'll take that over the shit we have today. The ignition key had a resistor whose value was keyed to the ecm and it wouldn't start if it was wrong (which was why at least the Camaros and Corvettes had separate keys). It was enough of a hurdle that I still think it would deter anyone who didn't have both time and really wanted your car, and if they have both they're probably getting it anyway.
PS: it's $20 per key. Because that $40 buys you a pair of key cards. I learned that when I wanted to buy two of these and was surprised to see they shipped me four card. The product name doesn't make it obvious that it's a pair...
Buying fobs online is a gamble. I got one for an older Kia Rio recently for some $40 plus shipping. Very good fob with a flip key and all the remote buttons. Unfortunately, the shady vendor did not mention that it does not include the transponder, which is some kind of RFID tag type thing that is sensed by the vehicle in order to start the engine, in addition to the key having to be cut correctly to turn the ignition.
I had to pay additional money to the automotive locksmith to put that in, on top of the $120 CAD base rate.
And, less than two months later, the new fob's battery died! I had a bunch of CR2032's around, which I had gotten cheaply; but insult to injury, you know?
Not just a missing transponder, but a shitty old/used battery on its last legs.
For whatever it's worth, both the common Chinese models and frontier American models are remarkably good at uh...rapidly reversing a lot of electronics and peripheral tools around many or most automobiles on the road, and if you're clever or maybe bad, the uplift from the models has enabled a lot of both good and absurd shit like being able to rapidly reprogram a key with under a $100 in hardware. It's certainly nice not needing to fight VIDA just because Volvo is a company that hates their customers and just generally sucks post Ford, but I presume this also makes everything recent easier to steal.
Not all of them are that expensive. From memory, I paid AU$200 for a genuine Toyota RAV4 key at the dealership (including cutting and reprogramming), which is about US$140.
On the latest models, yes. 2023+ Chrysler vehicles have a "rolling pin code" that the immobilizer requires before it allows enrolling fobs. Chrysler will only hand these out to registered locksmiths (and they charge a fee for doing so).
Now, people have been hacking the RFHUB for a while but it's been a fairly exclusive thing. I also doubt that software updates to the RFHUB are actually signed. I suspect that the next couple of years will see any remaining nonsense worked around by LLM-aided reverse engineering.
What grieves me is that, if I don't fancy these fancy fobs, and want an old-school key with a traditional ignition, our purportedly capitalist system doesn't quite have the marketplace to support me.
This is also true for a manual transmission and no-chip design. I basically want a freshly manufactured old-school Jeep.
Honestly I think if someone restarted production of the Jeep XJ as it was towards the end of its run they would probably outsell almost everything you could buy today.
They should be a $5 piece of machined metal. I don’t know how we let car keys turn into computers. Not everything has to be a goddamned computer. If your car requires a computerized remote control to open, it’s defective and should be returned.
It's a mistake to assume that the security must be embedded in the key.
It would be reasonable to have something like key and pin (similar to chip and pin[1]), where you have to enter a PIN and have the physical key to start the car. Or have a fingerprint reader. Or use the alertness camera for face authentication.
Since nearly everyone has a phone, and that phone is likely paired to the car, it should also be sufficient to sense that the bluetooth of the phone has paired to the car and at a sufficiently strong signal strength (and is not a new pairing).
The idea that the key itself must embed cryptographic hardware is a historical assumption that should be reconsidered.
A car key having a RFID transponder in addition to correctly cut teeth to turn the ignition is a good additional security layer though.
If I were to guess, how we let cars turn into computers probably started with fuel injection. The same embedded system that controls the timing of injectors (in response to numerous sensors) and variable valve timing and whatnot.
From there, feature creep.
Next thing you know, you're getting an engine code due to forgetting to put the gas cap back on at the pump (paying money to reset that because it's still years before consumer OBD2 dongles become available) and it goes downhill from there.
I had a car with a pure metal key, and even with 30 years in the city, it never got stolen. I knew a single person who had their car stolen, and it was at gunpoint. I really don't think lock-picking or hot-wiring really existed outside of movies. It always felt like a scare tactic to sell more insurance.
In the old mechanical-keys-only days without ECUs, there was no lock picking; thieves just went behind the steering wheel and connected two wires together. Starting a stolen car without a key was called "hotwiring".
They would get into the car via various means: find a car left unlocked; use coat-hanger wire to pull up a window-side lock peg; break a window.
not much different nowadays, one just roots the car then drives away. usually no coathangering the doors needed: access is either wireless or in some conviently accessible place
Your iPhone has more sophisticated security measures inside of it along with an entire computer capable of playing relatively recent AAA games and it costs less than some of these keys.
The actual answer is that dealerships make their money on service and demand that the manufacturers throw them bones like this.
This was a funny sentence to read. I'm reading this article to kill time while, in another window, I'm on a chat with customer service for my credit card because my credit card stopped working in my digital wallet. I've been trying to resolve the issue for weeks.
So I'm glad my car doesn't require anything like that.
The dealerships like making $200+ per fob program and the automotive companies like selling $$$ hardware + software licenses to be able to do so.
It's also likely that a processor that can only do rolling codes but no RNG or AES operations is cheaper and has longer battery life. Car model lifecycles are very long so the choice of components even for ~2018 cars might be using parts form 2013 (my guess). And auto companies are probably only considering parts purpose built for their industry due to supply and price guarantees.
If it wasn't for insurance companies refusing to insure some models with insecure fobs, the issue would likely be much worse today.
Obviously not an option if you lost the key, but when my Toyota keyfobs got really worn (button membranes breaking and exposing the underlying microswitch), I discovered that you can avoid the fuss and/or expense of reprogramming the keys by buying replacement key fob shells and moving the circuit board from the old key. Wasn't any harder than changing the key fob battery..
Insurance company offers a new key for $100.
I said I lost it and paid $100.
I considered buying a Chinese key programmer on aliexpress for $200, or going to a black market key programmer that would do it for $100 but I was lazy.
Looking forward to having a car that only needs Apple Car Key in the future.
The scale starts at crazytown prices and just gets increasingly insane from there.
Beats the heck out of paying hundreds of dollars to leave the car at a dealership for a few days to get a new key. And as you said: even then, this is just for the key that I need to use if my phone died or I just bought a new one.
But, I can use a credit card style key if I want. They are only $40 for a pair. I can program them in various ways. https://shop.tesla.com/product/key-card
I had to pay additional money to the automotive locksmith to put that in, on top of the $120 CAD base rate.
And, less than two months later, the new fob's battery died! I had a bunch of CR2032's around, which I had gotten cheaply; but insult to injury, you know?
Not just a missing transponder, but a shitty old/used battery on its last legs.
It'll be "fun" if your replacement battery also lasts under two months.
Now, people have been hacking the RFHUB for a while but it's been a fairly exclusive thing. I also doubt that software updates to the RFHUB are actually signed. I suspect that the next couple of years will see any remaining nonsense worked around by LLM-aided reverse engineering.
This is also true for a manual transmission and no-chip design. I basically want a freshly manufactured old-school Jeep.
Capitalist fail!
See: https://en.wikipedia.org/wiki/Kia_Challenge for what happens if you skip the immobilizer
It would be reasonable to have something like key and pin (similar to chip and pin[1]), where you have to enter a PIN and have the physical key to start the car. Or have a fingerprint reader. Or use the alertness camera for face authentication.
Since nearly everyone has a phone, and that phone is likely paired to the car, it should also be sufficient to sense that the bluetooth of the phone has paired to the car and at a sufficiently strong signal strength (and is not a new pairing).
The idea that the key itself must embed cryptographic hardware is a historical assumption that should be reconsidered.
[1] https://en.wikipedia.org/wiki/EMV#Chip_and_PIN_versus_chip_a...
If I were to guess, how we let cars turn into computers probably started with fuel injection. The same embedded system that controls the timing of injectors (in response to numerous sensors) and variable valve timing and whatnot.
From there, feature creep.
Next thing you know, you're getting an engine code due to forgetting to put the gas cap back on at the pump (paying money to reset that because it's still years before consumer OBD2 dongles become available) and it goes downhill from there.
:)
I don't recall the exact answer, but Technology Connections did a video on this very question 2 months ago.
Engines haven't been fully mechanical in decades - and that's good! 2.4M 1mo ago 58:45 https://www.youtube.com/watch?v=0KoeY54M5VA
Are you familiar with lock-picking?