Car "Keyless-Go" aka RKE - How it Works and Why it's Flawed by Design - Page 1
Forum section: electronics / general

author: Benta
author_rank: Super Contributor
timestamp: August 04, 2024, 12:46:29 am
content: Car theft, especially expensive cars, is at an all-time high because it's just so easy.Edited out, as it seems to divert a technical discussion into an emotional, opinionated one. My mistake."Keyless-Go" systems for unlocking and starting cars (the ones where you can leave the key fob in your pocket at all times) are very popular, and a lot of marketing have been invested in them (foot under the rear of the car to open the trunk etc.).Problem is, they have a catastrophic security flaw by design that can only be addressed by means that eliminate all perceived advantages.The classic remote control key fob is unproblematic, simply due to fact that it needs to be in the hand of the person unlocking the car. He/she needs to press a physical button on the fob. It's a one-way system, where the fob just contains a UHF transmitter and code generator, plus a passive RFID tag for starting the engine.Sniffing and replaying the UHF signal doesn't work, as it's rolling code based. In short, it's very secure.The "Keyless-Go" or RKE system (every car brand has its own name, but they're all the same) is a different story.Why? Because the fob can be activated from a distance. It no longer needs to be in the hand of someone pressing a key.How does RKE work?Architecturally, it's simple.The key fob has a UHF transmitter for sending the authentificaton code, the car has a corresponding receiver (just like the old-fashioned remote fob).New is, that the car has a 125 kHz transmitter for activating/challenging the fob and initiating the unlock process. The fob has an active (battery powered) 125 kHz RFID receiver for receiving the car's challenge. This extends the RFID operating range from a couple of centimeters (1") to a couple of meters (6').The whole process is started by someone touching the door handle (or a certain spot, whatever, depends on car brand) or putting a foot under the trunk, or...Same thing when starting the car. You press the "Start" button, the 125 kHz challenge is sent to the fob with the UHF transmitter responding.Sounds hunky-dory, right? The very limited range of the 125 kHz transmission (it's not really radio, but an electromagnetic field) ensures that the person touching the door handle is also holding the key fob (or someone else standing next to him/her). All within view, nice and secure.So where's the fatal flaw?If the key fob is a distance away from the car, the 125 kHz electromagnetic field is non-existent and everything is fine. Or is it?What happens if you range-extend that signal? You'll need a 125 kHz receiver next to the car (easy). And a 125 kHz power transmitter next to the fob (not quite as easy, and you need to know where the fob is). And you'll need a link between the the two (easy, AM-modulated VHF/UHF Tx/Rx off-the-shelf modules).The UHF signal from the fob also needs to be range-extended, but that's super-easy. Again, off-the-shelf module(s).The attack itself needs two persons: one next to the car with the 125 kHz receiver, grabbing the door handle. And one next to the fob with the 125 kHz power transmitter.Done. The person next to the car jumps in, starts the engine and is gone.Can I protect myself against this?Two options:1: always store the fob in a Faraday pouch when not in use. This does not disable 125 kHz reception, but it will block UHF transmission, which is almost as good.2: some newer cars have an option for turning off 125 kHz reception on the fob. Usually by pressing the "Lock" button three times in quick succession. Unfortunately, the "Look, Mom! I can unlock and start my car without a key!" effect goes away.But both options completely defeat the "comfort" aspect of the dumbest feature ever invented.I attach a Product Brief of the NXP PCF7953 IC for your reference. That's the key fob IC used by most major car manufacturers.

author: ejeffrey
author_rank: Super Contributor
timestamp: August 04, 2024, 03:50:33 am
content: Quote from: Benta on August 04, 2024, 12:46:29 amIt's actually not. Car theft is down significantly since the 90s and early 2000s, at least in the US and Europe. It has risen in the past few years, possibly in part due to RKE, although at least in the US, older cars without RKE are by far the most common to be stolen, but it's still well below the rates of 20 years ago.Everything else you said is fine, RKE is certainly an attack vector that can be used to steal cars, and your suggestions can protect your car. But the premise of the post is not actually correct.

author: Andy Chee
author_rank: Super Contributor
timestamp: August 04, 2024, 04:54:21 am
content: Quote from: Benta on August 04, 2024, 12:46:29 amThe technological attack vector is over-hyped.You are far more likely to have your home burgled and the car keys stolen off the kitchen table, or be car jacked in a parking lot or stopped at the traffic lights.

author: nctnico
author_rank: Super Contributor
timestamp: August 04, 2024, 09:39:36 am
content: Quote from: Andy Chee on August 04, 2024, 04:54:21 amNot always. The repeater trick is being used however, the keyfobs don't use 125kHz as this works only for short distances (less than 1 meter). Keyfobs for cars use the ISM bands with 433MHz being the most likely choice.As a counter measure, modern keyfobs have a motion sensors so they only work when they are in motion.

author: Andy Chee
author_rank: Super Contributor
timestamp: August 04, 2024, 09:50:35 am
content: Although technology has progressed in 8 years, this video is still relevant to vehicle security. In ten words or less, vehicle security is fundamentally flawed because they use one-way communication.Of course the flip side is, does vehicle security even need to be as secure as an internet banking transaction?

author: tszaboo
author_rank: Super Contributor
timestamp: August 04, 2024, 10:44:38 am
content: Quote from: Andy Chee on August 04, 2024, 04:54:21 amNo, because that's violent, and you need to be an entirely different class of criminal to do that.They have been in my car, that's parking in the driveway twice. Once I caught it on camera, they are in and out in like two minutes, throw everything around the car looking for spare cash or anything valuable. I guess a team of 2-3 people can run through an entire neighborhood overnight. They know which cars to target. Police does nothing. Insurance tell you that you probably forgot to lock the car, and "no damage". It's a real issue.

author: Postal2
author_rank: Frequent Contributor
timestamp: August 04, 2024, 11:18:24 am
content: Quote from: Andy Chee on August 04, 2024, 04:54:21 amNot quite. A thief can order a device from Benta that records the request codes of several cars. Then the thief, going around people and locker rooms, can easily see which pocket the key fob is in.

author: themadhippy
author_rank: Super Contributor
timestamp: August 04, 2024, 11:33:12 am
content: much easier in the 80's,all you needed was half a tennis ball.

author: jpanhalt
author_rank: Super Contributor
timestamp: August 04, 2024, 11:42:19 am
content: Here's a chart of car theft in the US per 100,000 (https://www.statista.com/statistics/191216/reported-motor-vehicle-theft-rate-in-the-us-since-1990/):The top visible line is 400/100,000.Note in the period of decline, most new cars still relied on mechanical keys. My 2012 model had remote electric locks, and a mechanical ignition key that required the fob in near proximity. The source gave no reason for the increase in the past 4 years. I suspect some of that is due to lax enforcement and little or no penalty. It is also reported that carjackings have also increased in the past few years.

author: NiHaoMike
author_rank: Super Contributor
timestamp: August 04, 2024, 12:57:26 pm
content: A good part of the recent spike likely has to do with Hyundai/Kia implementing no security.https://www.nhtsa.gov/press-releases/hyundai-kia-campaign-prevent-vehicle-theft

author: coppice
author_rank: Super Contributor
timestamp: August 04, 2024, 01:13:02 pm
content: Quote from: jpanhalt on August 04, 2024, 11:42:19 amIn the early 2000s they got the early flaws of remote entry sorted out (issues like poorly thought out rolling code schemes), and down went the thefts. Then in about 2015 the luxury market started going for completely keyless entry in a big way, and you see an uptick in thefts. I assume if the entire market had gone for it in a big way the uptick would have been more pronounced. Right now Jaguar Land Rover has such a huge problem, owners can't easily get insurance, and their resale values are going downhill fast.

author: Postal2
author_rank: Frequent Contributor
timestamp: August 04, 2024, 01:26:53 pm
content: From the diagram I can see that Benta started his work in 2019.

author: Andy Chee
author_rank: Super Contributor
timestamp: August 04, 2024, 02:11:31 pm
content: Quote from: Postal2 on August 04, 2024, 11:18:24 amIrrelevant.The pertinent question is how many thieves need such sophisticated tools to steal a car. As I suggested, a thief is more likely to steal your keys when breaking into your home/residence/workplace, or carjack you with a 3D printed gun, real gun, or machete knife.

author: Andy Chee
author_rank: Super Contributor
timestamp: August 04, 2024, 02:18:53 pm
content: Quote from: tszaboo on August 04, 2024, 10:44:38 amAnd that's my whole point. If you drew a venn diagram of car thieves and classified them according to theft methodology, technology would probably be less than 10-15% of vehicle thefts.Most criminals are non-professional (i.e. teenagers stealing a car for a joyride)Yes, professional thieves exist and they will use such technological tools to steal cars to order. But as I said, they are over-hyped.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 04, 2024, 02:24:57 pm
content: Quote from: Andy Chee on August 04, 2024, 02:11:31 pmTheft by relay attacks is common in the UK, as well as CAN bus attacks on high-end cars, especially Range Rovers ( where the CAN bus can be accessed by cutting a plastic bumper) , which are all but uninsurable nowI doubt you need anything that sophisticated - I haven't tried it but have a hunch that a 125KHz relay could be as simple as a couple of coils. Even if it did require some amplification, the electronics would be trivially simple and I have no doubt this equipment is readily available if you know where to look.AFAIK even now, few keyfobs have motion sensing to prevent this - this is just ridiculous considering how simple and cheap it is to implement.Car manufacturers have always been criminally negligent on security, the cynical view being that more cars stolen = more cars sold.I was surprised to read about the Kia/Hyundia fiasco in the US, as immobilisers have been mandatory in the EU since 1998. Hard to fathom why the US doesn't have the same requirement.ISTR reading that some recent VW fobs use some sort of UWB thing to make them immune due to increased turnaround time if repeated at a distance .

author: tszaboo
author_rank: Super Contributor
timestamp: August 04, 2024, 03:45:58 pm
content: Quote from: Andy Chee on August 04, 2024, 02:18:53 pmYou were talking about car theft, I was talking about car entry and burglary. While someone getting into your car and grabbing that 50 EUR that you stashed away is not comparable of stealing the car. Trust me it doesn't leave you with good feelings when it happens to you. And getting into your car is very-very low effort because of this keyless entry and technology.

author: Andy Chee
author_rank: Super Contributor
timestamp: August 04, 2024, 04:01:03 pm
content: Quote from: tszaboo on August 04, 2024, 03:45:58 pmAs I said multiple times already, technological tools & hacks are often not required (over-hyped). The thief can easily take the car key fob from inside your house while you are sleeping.

author: mendip_discovery
author_rank: Super Contributor
timestamp: August 04, 2024, 04:09:45 pm
content: I have always had a bit of unease with statistics as they don't lie but they can be misrepresented. I know in the UK that "reported" thefts is funny because for a few years, the Police were actively discouraging people from reporting it as a crime.Keyless entry is a bit of a solution that was looking for a problem and now people need it and the criminals soon learn a way to get into them. I am not sure about the number of cars that are actually stolen this way, sadly the data is limited. I often get told my car is the most stolen car in the UK but that may partly be because there are so many of them around and the criminals love to break them down for parts. But I am also aware of the tree falling in the woods and if you hang around various forums you would be led to believe one is stolen every 60 seconds.I just wish the car manufacturers thought about the security when designing them and if it is found to have a wide-open fault then there should be regulatory pressure to fix it and not leave it to the owners to deal with.

author: HighVoltage
author_rank: Super Contributor
timestamp: August 04, 2024, 04:10:13 pm
content: Quote from: Andy Chee on August 04, 2024, 04:01:03 pmThey are NOT over-hyped at all, they are easy to use for those in the know.Once you have seen such a system, you can only be amazed how simple it is.No need to break in to a house, that is just too much hassle and old school.

author: jpanhalt
author_rank: Super Contributor
timestamp: August 04, 2024, 04:15:31 pm
content: Quote from: mikeselectricstuff on August 04, 2024, 02:24:57 pmI suspect but cannot document that the NTSB is mandated to regulate safety, not thievery, and our law enforcement agencies do not make such mandates either. Thus, such a mandate by the NTSB would likely be challenged as overreach by interested parties. However, insurance companies and publishing the fault certainly had an effect.Personally, I prefer that system. Mandates are slowly, if ever removed entirely even when the need has long passed.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 04, 2024, 04:20:09 pm
content: Quote from: jpanhalt on August 04, 2024, 04:15:31 pmAn easily-stolen car is a very clear safety issue

author: Postal2
author_rank: Frequent Contributor
timestamp: August 04, 2024, 04:33:14 pm
content: Quote from: mikeselectricstuff on August 04, 2024, 04:20:09 pmThe problem is not the ease of theft, but why, with all the modern means, the police can't catch anyone?

author: tszaboo
author_rank: Super Contributor
timestamp: August 04, 2024, 05:42:02 pm
content: Quote from: Andy Chee on August 04, 2024, 04:01:03 pmThe skill required to open a front door is much higher than buying a gadget from silk road or whichever online marketplace, and pressing a button to open a car.And the criminal charge is much more different. And it doesn't matter how many times you say it, because your though process is just wrong.You can steal cryptocurrency by hitting someone with a wrench several times until they give it to you, or through a malicious website. Guess which one is the bigger monetary problem?

author: snarkysparky
author_rank: Frequent Contributor
timestamp: August 04, 2024, 06:25:18 pm
content: I have been thinking of finding a critical circuit in the car and interrupting it with a hidden toggle switch. Maybe the brake switch. Just anything that keeps the car from starting.

author: themadhippy
author_rank: Super Contributor
timestamp: August 04, 2024, 06:42:52 pm
content: Quoteuse a switch that matches those already in the vehicle and hide it in plain sight

author: Siwastaja
author_rank: Super Contributor
timestamp: August 04, 2024, 06:55:47 pm
content: Quote from: ejeffrey on August 04, 2024, 03:50:33 amLet's not ruin the "old men complaining about modern technology" thread with something as boring asfacts. Although, old enough might remember how in 1990's you could get basically in 9 out of 10 cars with any screwdriver, in seconds.

author: TimFox
author_rank: Super Contributor
timestamp: August 04, 2024, 07:30:18 pm
content: Quote from: NiHaoMike on August 04, 2024, 12:57:26 pmAs a result of the surge in Kia/Hyundai thefts (helped by a social-media “challenge”), several cities have filed civil suits against that company. In Chicago, these thefts often result in further serious crimes, followed by abandonment or crashes of the stolen vehicles.

author: Benta
author_rank: Super Contributor
timestamp: August 04, 2024, 08:12:04 pm
content: Quote from: Siwastaja on August 04, 2024, 06:55:47 pmI've edited that sentence out from the OP, as it seems to turn a technical discussion into a more emotional one instead. Mea culpa.

author: Benta
author_rank: Super Contributor
timestamp: August 04, 2024, 08:58:44 pm
content: A comment on the key fob movement-detector "solution" (read: desparate workaround).It only helps when the fob is stationary somewhere.But the "2nd thief" might also be standing next to you in the supermarket queue (he followed you from the car). The whole theft is a matter of seconds.Smearing putty on a flaw only takes you so far.And no, contrary to some Finnish guy's snide remark, I'm not an old Luddite. But I hate designs that are not thought through to the end. Like RKE.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 05, 2024, 07:49:40 am
content: Quote from: Benta on August 04, 2024, 08:58:44 pmWhich it will be in the vast majority of cases - car in driveway, keys left near the doorQuoteMuch more involved as it needs wireless relaying in both directions, and that the car is in range of the fob's UHF transmission. Has this ever actually happenned ?

author: Phil1977
author_rank: Frequent Contributor
timestamp: August 05, 2024, 08:23:48 am
content: What´s really nasty is that the car industry has "improved" a principally very safe system (Rolling-code remote control with RFID transponder for motor start) by replacing it with something quite vulnerable.AFAIK some new cars have a "time of flight"-check in the authentification process. This could fix the main vulnerability.Anyhow, car industry could make cars much more theft proof. You easily could design authentication processes that really are hard to bypass by implementing strong cryptography into the communication between keyfob and ECU. But for some reason the industry also implements lot of bypasses like keyless go, universal backdoor keys for workshops or just unsafe key generation. I´m really not into conspiracies but here it really looks a little bit like theft is seen as a problem that makes you sell more.

author: AVGresponding
author_rank: Super Contributor
timestamp: August 05, 2024, 08:35:31 am
content: Quote from: HighVoltage on August 04, 2024, 04:10:13 pmAnd yet it remains one of the most common methods. It is by no means a "hassle", the methods used are simple, fast, and direct.

author: WatchfulEye
author_rank: Regular Contributor
timestamp: August 05, 2024, 10:46:08 am
content: Quote from: themadhippy on August 04, 2024, 06:42:52 pmThere is a class of aftermarket device that will do something similar.Because the control switches tend to connect via CAN, the device piggy backs on the CAN bus allowing a key sequence to be entered using the car's OEM controls.Some can even immobilise car via CAN message, minimising wiring complexity and allowing flexibility in concealed installation.

author: tom66
author_rank: Super Contributor
timestamp: August 05, 2024, 10:59:10 am
content: My car has keyless entry (VW ID.3) and it is immune to the repeater attack that has plagued many keyless-go entry systems. It uses UWB keys. UWB keyless technology measures the distance to the car's key using the RF delay time. Inserting a repeater into the system - short of breaking the laws of physics - will never make the key look like it is closer than it is. So you cannot steal the car by using a repeater device. You must have the keys yourself.The system is incredibly precise - I can take the key up to the edge of the door frame of my car and the key is seen to be in the car. If I move it just 5cm further, the key is now 'outside' and cannot be used to start the car.None of this technology can protect against an attack on the car's own infrastructure, as has been seen with Toyota and Hyundai/Kia vehicles, of course.Having said all this about how it's quite a clever technology, do I regard keyless entry as important? Not really. I still have to put the key somewhere in the car (the fob is a little too bulky to fit in my pocket comfortably). I still have to remember to take the key out. If I had a choice, I would not pay for the keyless entry system... If it were a cost-free option I'd *probably* go for the mechanical key instead, even though both are just telling a computer to turn on or off. Just because I feel like a mechanical key is less likely to be forgotten. I have also had some issues with one keyfob failing which was replaced under warranty, where the key would be intermittently not detected, this feels like an issue that would not exist with a mechanical key (since the immobiliser is RFID and can be read even with a dead keyfob battery.) There's still a backup mechanical key in the keyfob itself, hidden away, in case you need to get into the car when the battery is dead, so there's no reduction in simplicity there. It does feel a bit like a solution looking for a problem.

author: Halcyon
author_rank: Unknown
timestamp: August 05, 2024, 12:23:48 pm
content: Quote from: HighVoltage on August 04, 2024, 04:10:13 pmYou over-estimate crooks I think.99% of criminals are fucking stupid. Especially those involved in crimes like stealings, break and enters, etc... Half the time their brain is fried from the drugs they smoked that morning.Usually, the simplest is the most effective; Entering in unlocked doors/windows, breaking a window, forcing a lock etc... Most people probably keep their car keys in a predictable place, like a hook or in a bowl by the front door, on the kitchen bench, in their purse, etc...These types of opportunistic criminals aren't carrying around lock picking sets and technology used to steal cars. Largely because they don't have the skills to use them, and that it would be illegal in many parts of the world. Sometimes you get lucky and they might have a decent flat blade screwdriver on them for such purposes.I used to lock these guys up for over 14 years. The percentage of criminals using high-tech means is incredibly small.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 05, 2024, 01:16:50 pm
content: Quote from: Halcyon on August 05, 2024, 12:23:48 pm99% of the ones that get caught are stupid- the smart ones don't get caught so easily.That doesn't mean that there aren't also smarter crooks with the tech, going round targetting certain cars in driveways, with established routes to fence them - a replay attack can be done in a few seconds, so an easy container-load of cars & parts in one night.

author: Marco
author_rank: Super Contributor
timestamp: August 05, 2024, 02:28:32 pm
content: I can't find euphemistically named kits on aliexpress, so it can't be that widespreadDid find a worked out paper to hack ISO/IEC 14443A for an office door.https://eprint.iacr.org/2023/450.pdfSilicon is so cheap, putting a time of flight calculation would be trivial when using a higher frequency carrier. For instance send challenge, dongle computes result and loads into a shift register for very fast on the fly encoding/transmitting of a salt from a second challenge for time of flight calculation.

author: tom66
author_rank: Super Contributor
timestamp: August 05, 2024, 03:03:28 pm
content: Quote from: Marco on August 05, 2024, 02:28:32 pmIf you want to accurately range a device (with, say, 10cm level accuracy), you need a very short pulse. If you don't do that then you have multipath and pulse distortion effects which make it impossible to distinguish your pulses from reflections in the multipath.This is why UWB is used for rangefinder functions on e.g. AirTags, and some car key fobs. The pulses are around 1-2ns long... which requires a very high bandwidth RF transceiver IC.You could argue 5m accuracy is enough for car key fobs... but I wonder what 5m actually looks like in somewhere like a multistorey carpark surrounded by rebar. Could it be that the valid pulse seen actually has a TOF of far more than 5m because other paths are attenuated? So you start to get to thresholds as to exactly where you determine a key to be valid... And then you are not doing much better than RSSI range finding because you could have keys within a valid range in the clear and open, but out of valid range in an obstructed environment. People tend to put their car keys (stupidly, but they do) near their front door, so you might still be able to break such a system with a repeater attack there.

author: HighVoltage
author_rank: Super Contributor
timestamp: August 05, 2024, 03:15:09 pm
content: Quote from: Halcyon on August 05, 2024, 12:23:48 pmMaybe this is different from country to country.We have a family member that is working for the car thief department of the police in a bigger city, here in Germany. And they are very familiar with the tools these crooks are using.So, the stupid crooks are getting caught.But ... the more educated crooks work on a totally different level. They have specialists for every step of the way and they take cars that have been ordered on a sophisticated system and these cars will leave Germany within hours after they have been obtained. There have been cases were car owners of expensive cars have been charged with fraud because the insurance companies could not believe that these sophisticated cars could easily be taken and expected the car owners to be in on the deal.

author: Marco
author_rank: Super Contributor
timestamp: August 05, 2024, 03:22:10 pm
content: Quote from: tom66 on August 05, 2024, 03:03:28 pmSo 10 cents worth of silicon instead of 1 cents.

author: Phil1977
author_rank: Frequent Contributor
timestamp: August 05, 2024, 03:24:13 pm
content: Quote from: tom66 on August 05, 2024, 03:03:28 pmI can't agree. The time-of-flight measurement only needs to verify that the authentic keyfob is inside the car while the engine starts / gets ready to drive.Each repeater also adds many nanoseconds or microseconds to the signal delay. This attack should really be impossible with that measurement.

author: tszaboo
author_rank: Super Contributor
timestamp: August 05, 2024, 04:10:03 pm
content: Quote from: Halcyon on August 05, 2024, 12:23:48 pmThere is a positive correlation between low IQ levels and tendency to commit crime, you are absolutely right about that. I think its about 1 standard deviation, so about 85 for criminals.There is an entirely different class of criminals though, sociopaths and psychopaths, that commit crimes because the lack of any regard for anything other than themselves (zero empathy). There is no correlation between IQ and these personality traits. These two are about 2-3% of the population. They also commit the most crime, and get caught less. Some of them become CEOs like Elizabeth Holmes.

author: tom66
author_rank: Super Contributor
timestamp: August 05, 2024, 04:30:58 pm
content: Quote from: Marco on August 05, 2024, 03:22:10 pmWell sure, UWB keyfobs aren't expensive, probably cost barely any more than standard keyfobs. But it does require a different IC to normal keyfob remote systems which have no pulse time measurement, they are just looking at RSSI meeting a threshold.

author: coppice
author_rank: Super Contributor
timestamp: August 05, 2024, 04:39:58 pm
content: Quote from: tszaboo on August 05, 2024, 04:10:03 pmThat is often stated, but the evidence seems unclear. Its hard to differentiate from studies whether a high IQ makes you less likely to commit a crime, or just way better at avoiding detection and never getting into the statistics.

author: tszaboo
author_rank: Super Contributor
timestamp: August 05, 2024, 04:57:06 pm
content: Quote from: coppice on August 05, 2024, 04:39:58 pmThere are plenty of evidence, but they are "controversial". There are metrics that take an entire country's average IQ (that's also racist according to some people) and compare it to the crime rate, and that shows negative correlation as well. Looked up the number, and a study was showing r=-0.64.

author: coppice
author_rank: Super Contributor
timestamp: August 05, 2024, 05:04:10 pm
content: Quote from: tszaboo on August 05, 2024, 04:57:06 pmThat kind of measure seems to suffer from exactly the vagueness I described. Crimes that go undetected don't appear in the statistics. People of low IQ are so incapable of covering their tracks there is no question that get caught a lot. For high IQ people the jury is out... although the lynch mob may be in.

author: jpanhalt
author_rank: Super Contributor
timestamp: August 05, 2024, 05:11:09 pm
content: Quote from: Benta on August 04, 2024, 08:12:04 pmWe are all guilty of side-tracking a potentially extremely interesting technical discussion. Now 2 pages later, can we please get back to the original purpose? That is something I know nothing about and am eager to learn.

author: tszaboo
author_rank: Super Contributor
timestamp: August 05, 2024, 05:18:46 pm
content: Quote from: coppice on August 05, 2024, 05:04:10 pmAh cool. Let's try this.At what correlation factor do you say: Yeah, actually you are right.Hm? 0.8? 0.9? 1.000?

author: Marco
author_rank: Super Contributor
timestamp: August 05, 2024, 05:36:44 pm
content: Quote from: tom66 on August 05, 2024, 03:03:28 pmNo reason this can't be used with the XOR concept BTW. Challenger sends a bit of the salt by either transmitting or not in a time slot, the dongle XORs and sends a pulse back or not. With 24 GHz (5 GHz bandwidth) a couple ns range round trip delay should be doable.

author: coppice
author_rank: Super Contributor
timestamp: August 05, 2024, 06:02:18 pm
content: Quote from: tszaboo on August 05, 2024, 05:18:46 pmHuh? what are you talking about? The question is not about the level of correlation, but what exactly are you seeing correlate.

author: coppice
author_rank: Super Contributor
timestamp: August 05, 2024, 06:07:29 pm
content: Quote from: tom66 on August 05, 2024, 10:59:10 amGive it some time and we'll see. The car makers have a history of fixing one thing, and creating a fresh vulnerability. Maybe there will turn out to be something about the scan to scan timing that allows some tricks to be played. They really should do this kind of development in public, in the way good new encryption techniques come from an open discussion among experts in the field trying to pick holes in each other's work.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 05, 2024, 06:14:24 pm
content: Quote from: Marco on August 05, 2024, 05:36:44 pmthe actual turnround time isn't that important as long as it is known and consistent, so deviations can be detected.

author: Marco
author_rank: Super Contributor
timestamp: August 05, 2024, 06:19:34 pm
content: I have my doubts whether the current UWB standard is really secure by design, for that the hardware has to be able to encrypt a bit of challenge and return it with negligible delay (which is why I suggest a precomputed code to XOR a challenge with). As soon as the stack has large delays, replay becomes possible again ... and theCCC stackseems huge and full of delays.Otherwise this wouldn't make sense :"15CCC DIGITAL KEY‘Ranging keys’ are derived from CCC DigitalKey authentication handshake and securelystored in the secure element. When in use,ranging keys have a limited 12-hour lifetime toshorten the time window for an attacker."

author: tszaboo
author_rank: Super Contributor
timestamp: August 05, 2024, 06:43:11 pm
content: Quote from: coppice on August 05, 2024, 06:02:18 pmRight. So this is why we are in this terrible situation where we cannot talk about anything anymore. Even people who probably understand statistics are completely oblivious to the implications of that statistics. You can just walk past some inconvenient truth and brush it off, because it is against the programming. If this would be reddit, you would probably be crying to the mods to get me banned, because you don't like the implications.And it's not "exactly are you seeing correlate". It something that is a widely accepted fact in the field of phycology with ample evidence.

author: tom66
author_rank: Super Contributor
timestamp: August 05, 2024, 06:47:56 pm
content: Quote from: Marco on August 05, 2024, 06:19:34 pmIt needn't work that way. Car and key are pre-synchronised, this is part of initial pairing process done at the factory. The key sends a signal whenever a button is pressed, car then acknowledges that, key responds with next sequence value, which will be some internal secret like some 32 bits of a 128-bit PRNG. There may be several rounds of this to get a two-way ranging estimate.This doesn't require a challenge-response mechanism except when key and car get out of sync, when that happens, key will respond with a wrong value, car will do a more thorough challenge, then go back to the normal method to authenticate via time of flight.

author: coppice
author_rank: Super Contributor
timestamp: August 05, 2024, 07:14:59 pm
content: Quote from: tszaboo on August 05, 2024, 06:43:11 pmNow you are projecting. I don't want you banned. I just think you don't seem to be applying any analytical skills, and are rather confused. Just show me some evidence that holds up to scrutiny. I've never seen any. I just see studies with gaping holes in them. There appears a pretty solid correlation between low IQ and crimes the person commits being registered. There appears a pretty solid correlation between low IQ and the person being caught for their crimes which have been registered. These are unsurprising results. Beyond that I see a lot of hand waving.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 05, 2024, 07:25:22 pm
content: Quote from: Marco on August 05, 2024, 06:19:34 pmNot necessarily - the ranging and authentication could be seperate operations.

author: Phil1977
author_rank: Frequent Contributor
timestamp: August 05, 2024, 07:27:16 pm
content: Quote from: Marco on August 05, 2024, 06:19:34 pmA pure XOR would not be sufficient because the attacker could easily catch the XOR-key from the keyfob and use it with little delay at the car-side relay station. You would need a small interactive element, like "XOR it with a secret key and send me only only bytes nr, x1 x2 x3 x4 from the string".

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: August 05, 2024, 08:16:41 pm
content: Another really simple way to avoid the turnround time issue is to use two messages within up to a few tens of mS- the first sends the challenge ( maybe also including a wake-up preamble) for the fob to process, the second requests the fob tp reply quickly and send its stored reply, and does the ranging.

author: Benta
author_rank: Super Contributor
timestamp: August 31, 2024, 09:29:09 pm
content: An update to this theme.ADAC (the German equivalent to AA, AAA etc.) has just published a report on 700 NEW car models having Keyless-Go systems.Only 9% were immune to attacks, all others were simple to steal using an RF relay (range extender).So don't tell me this problem is non-existent.https://www.adac.de/rund-ums-fahrzeug/ausstattung-technik-zubehoer/assistenzsysteme/keyless/It's in German, but a web translator will help.

author: coppice
author_rank: Super Contributor
timestamp: August 31, 2024, 09:46:58 pm
content: Quote from: Benta on August 31, 2024, 09:29:09 pmWhere the 9% of immune cars scattered among the brands, or were there brands taking things really seriously with most of their products immune?

author: Benta
author_rank: Super Contributor
timestamp: August 31, 2024, 11:00:58 pm
content: Quote from: coppice on August 31, 2024, 09:46:58 pmHere's the list:https://assets.adac.de/image/upload/v1724742959/ADAC-eV/KOR/Text/PDF/Keyless-Liste_8_24_acig7v.pdfWhere columns 4 or 5 say "X", the cars are vulnerable. Where it says "nein", they're safe for now.Judge for yourself.PS: column 3 "Erstzulassung" tells you when the car was put on the market. Most are still sold today.

author: tom66
author_rank: Super Contributor
timestamp: September 01, 2024, 09:09:36 am
content: That's a pretty horrid list there isn't it. Wow.

author: Siwastaja
author_rank: Super Contributor
timestamp: September 01, 2024, 09:15:50 am
content: Quote from: tom66 on September 01, 2024, 09:09:36 amIt is, but the 9% is enough to prove it can be designed to work safely, and those 9% are not some kind of NASA secret technology, but similar cars than those that do not pass, just probably newer models(?). Now what kind of motivation manufacturers need to fix their shit is another question.

author: Marco
author_rank: Super Contributor
timestamp: September 01, 2024, 10:39:19 am
content: Quote from: Phil1977 on August 05, 2024, 07:27:16 pmCar sends encrypted XOR key to fobFob decodes and they are both waiting say exactly 100 us (gives fob time to decode the encryption with low power circuitry).Car sends random data and fob "immediately" (say 1.5 bit delay, short enough not to mess with ToF) returns the XOR'd random dataIf the fob is away from the car and the fob side relay tries to send it's own data to the fob to decode the XOR key, the car side relay won't get the XOR key in time AFAICS. The XOR key bits are only valid in a tens of ns timewindow (thanks to the magic of crystal oscillator accuracy).

author: themadhippy
author_rank: Super Contributor
timestamp: September 01, 2024, 11:22:00 am
content: QuoteHang on are you suggesting i cant start my car and turn on the heated seat from the the comfort of my kitchen whilst i finish breakfast? Instead you want me to finish breakfast,and them actually get in the car,sit on a cold seat before i can start it?

author: Marco
author_rank: Super Contributor
timestamp: September 01, 2024, 11:25:32 am
content: Quote from: themadhippy on September 01, 2024, 11:22:00 amOnly for keyless entry/go based on proximity. When you use a phone app to operate car functions that's your own choice. If you unlock it and someone steals everything inside, that's on you.

author: coppice
author_rank: Super Contributor
timestamp: September 01, 2024, 12:31:57 pm
content: Quote from: Siwastaja on September 01, 2024, 09:15:50 amA lot in that 9% group use UWB, which seems to indicate that this is probably a big help with security. As for the others the list doesn't say much at all. It looks really hit and miss among the car makers, like nobody has a really effective solution, except perhaps the use of UWB. It looks more like many of the passes are more luck than good design.As for motivation, the answer is simple. Who is failing to buy a car because of this issue? If it isn't hurting sales it has a low priority. I note that a lot of the models passing in that list are JLR models. This might be because the theft issue has actually blown up in JLR's face, with theft of their cars getting so bad people can't get them insured, and its all over the media.

author: themadhippy
author_rank: Super Contributor
timestamp: September 01, 2024, 01:44:11 pm
content: Quotemight actually be helping sales,your new car gets nicked insurance replace it with an identical model,2 cars sold instead of 1 with decent security

author: tom66
author_rank: Super Contributor
timestamp: September 01, 2024, 06:10:24 pm
content: The big problem with the JLR thefts is the vehicles are becoming uneconomical to insure, or are completely uninsurable in some cases - I've seen £10,000 per year quoted for some Evoque models, and other insurers outright refusing to quote as they don't like the risk.The only way JLR can reasonably fix this is by recalling the vehicles and loading improved software on them; they've announced an update for 2018 models onwards, but it seems earlier model owners are screwed. Funny that UK law has a cut-off of six years to bring a claim for a product being unfit for purpose, I'm sure that hadnothing at allto do with their decision to exclude earlier models.There is no good fix to the repeater problem besides using reliable ToF measurement. If the radio chipsets don't have ToF support then they are screwed in terms of a true solution to relay attacks, but they could still prevent CANbus/OBD-II attacks, and/or offer a feature like PIN-to-drive for free.

author: Siwastaja
author_rank: Super Contributor
timestamp: September 01, 2024, 06:41:27 pm
content: Quote from: tom66 on September 01, 2024, 06:10:24 pmOne of the issues is overcomplexity in modern cars. This causes many problems:* Worse reliability,* Car industry hogging all components like CAN transceiver chips during events like chipageddon* Security issues (CAN attacks through headlamps etc.)* Longer design cycles* More expensive cars* Buggy products hated by the customers* Less innovation because higher fixed cost (10 engineer team working on "left headlight communication specification") forces you to manufacture larger numbers of the same design to get the ROII don't see any upsides to the complexity. It's a bubble. There is a whole lot ofnecessarycomplexity in a modern car, therefore all unnecessary complexity should be cut off.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: September 02, 2024, 03:27:28 pm
content: Quote from: tom66 on September 01, 2024, 06:10:24 pmMotion sensing in the key would make a big improvement, with low cost to replace keys for existing users.

author: Marco
author_rank: Super Contributor
timestamp: September 02, 2024, 03:33:01 pm
content: So they wait till you're getting coffee?

author: tom66
author_rank: Super Contributor
timestamp: September 02, 2024, 03:54:49 pm
content: Quote from: Marco on September 02, 2024, 03:33:01 pmIndeed, there have been thefts of cars from shopping malls using keyless entry systems. One accomplice follows the mark, having parked his flashy Audi up in the parking lot, with half of the piece of kit. Once the mark is away from the car, the cloning device allows the thief with the receiver to drive the car out of the garage.This is not a new attack, people searching for their cars with their fob pressing the lock/unlock button have been targets before (basically, grab the signal before they get to the car and use that with vulnerable immobilisers), but it massively increases the possible window of attack.

author: Benta
author_rank: Super Contributor
timestamp: September 02, 2024, 08:42:44 pm
content: Quote from: tom66 on September 02, 2024, 03:54:49 pmIt'll open the car for content theft, but it won't start the car. And as the owner is on his way to the car, this is a low risk scenario and not really worth the trouble.

author: mendip_discovery
author_rank: Super Contributor
timestamp: September 07, 2024, 07:13:09 am
content: From what I know of the thefts is,They use the relay attack to unlock car and start it and drive off.OrThey use the relay attack unlock the car, then plug into the ECU and then assign a new key to the car. Then drive off.The second option is the more common. The manufacturer's have mentioned a few times that this is becuase the courts forced them to allow 3rd parties to program the ECU with new keys, shocking isn't it. The unlock part of thr key works from larger ranges so the time of flight stuff isn't so handy here.I read that a few are going on about just breaking in to the house and taking the keys. That maybe the case in less developed parts of the world (USA) but some of us have brick buildings with doors that take a fair bit of a beating to get open, they also make unnecessary noise also there is the risk you might get attacked by the house cat. It is still a method of attack but not as common as this new technique that is running around welthly urban areas. Many people are buying these posh cars on lease and filling the drive with 2 of so desirable cars, the housing estate will have many more so in 1 night they can take lots of them and be gone before the owners realise they are missing.Thing is if the criminals want it they will get it. They have time and a single goal. I have heard of cars just getting pinched with a recovery truck while you are in the shops.As I have said before the best security you can use is security you will use. So get a pedal lock, steering lock, GPS tracker, put your car behind bollards, even put a wheel clamp on. Just make sure you use it all the time.5 stolen, 3 I have had back. These days I drive a vehicle that criminals love to steal but I rely on its known unreliability to prevent them from taking it.The Police in they UK at least are a little powerless to do anything but I think that is partly down to a lack of old skool policing and the groups being bigger and better prepared than back in the olden days.

author: Benta
author_rank: Super Contributor
timestamp: September 07, 2024, 10:21:46 pm
content: Quote from: mendip_discovery on September 07, 2024, 07:13:09 amThat one's new to me, but interesting. In fact, it's the original relay trick taken one step further.Needs more equipment (OBD2 programming), but that's no big issue.

author: mendip_discovery
author_rank: Super Contributor
timestamp: September 08, 2024, 08:50:53 am
content: I think that attack was the orignal.The odb2 box would be programmed to set a new keyless starting key.With my car I just moved the odb2 port to another location and 'hid' it so it's not so easy to get to it.It's funny that the removal of the physical key to turn the barrel has made it easier to steal the cars.

author: tom66
author_rank: Super Contributor
timestamp: September 08, 2024, 12:43:17 pm
content: Some people have taken to fitting dummy OBD-II ports or a switch to the port that isolates CANH/L on the connector. Just make sure you tell your mechanic when you take it in for service!

author: tooki
author_rank: Super Contributor
timestamp: September 08, 2024, 01:08:57 pm
content: Quote from: mikeselectricstuff on September 02, 2024, 03:27:28 pmThe PDF from ADAC actually includes a statement from BMW about this. In the models where the upgrade is possible, they do it by replacing all the fobs, with BMW covering 70% of the replacement cost and the customer 30%. Additionally, the customer must pay 150 euros to reprogram the car’s computer. (I assume that info is for Germany only, and that other countries may have other options. Or none. Who knows!)

author: paulca
author_rank: Super Contributor
timestamp: September 08, 2024, 02:26:52 pm
content: There are a bunch of extra security features most of the "burn the strawman" hand wringing articles on this skip over.My sensors do not work in isolation. The car "knows WHERE the key is", not just that it is present. It can, very accurately determine, for example if the key is inside the car in the drivers hand or outside the car in the drivers hand 3 inches away.As an example, on a "normal" car use, if I pull up at the house, turn the car off, open the door ... then without getting out I shut the door and remain in the car with the key... the automatics are predicting that the next thing I will do is lock the car. So it immediately starts beeping gently. If you do try and lock the car while any key is inside it, it will BEEP much louder. "No." is the very clear answer. I have fought this and swore at it. "Lock the car!" and it says, "No." Eventually I end up going, "OH... wait... no... you are right my key is my coat pocket on the passenger seat.To open the door in a passive way you need to be within 1 meter of the door handle. If I stand at 6 ft and ask my daughter to open the door, it will not open. If i close within 1 meter, it will allow her to unlock it.If you accidentally unlock the car by .. say... touching a door handle after locking it, it will automatically lock itself after 5 seconds unless you open a door. Inversely if you look the car and try to open a door within 5 seconds, it will prevent you. Allowing you to confirm the is actually locked. Personally I listen for the mechanism and watch the side indincator flash.Can this be hacked? Probably. Is it going to be a profressional car jacking outfit that does it, very probably.Paranoid? Faraday wallet. Test it. If it fails, by another more expensive one.Personally, on occasion I will put my car key in such a wallet. If I leave it by the back door, there is a farady wallet to hint to me to put it in there. This is not 100% for security, but so that the car can sleep like a baby and not have it and the key wake each other up all night, which does wonders for boths batteries.

author: Marco
author_rank: Super Contributor
timestamp: September 08, 2024, 02:47:12 pm
content: The reliability of signal strength in a non adversarial environment isn't the same as in an adversarial one.

author: MT
author_rank: Super Contributor
timestamp: September 08, 2024, 03:09:25 pm
content: Quote from: mendip_discovery on September 08, 2024, 08:50:53 amVolkswagen group of cars are famous for their door lock mechanism(on all 5 doors) to fail after 4-5 years due to faulty design and plastics making doors unlockedwhen you press the lock button on the key fab.

author: coppice
author_rank: Super Contributor
timestamp: September 08, 2024, 03:22:51 pm
content: Quote from: tooki on September 08, 2024, 01:08:57 pmThat 30%/70% split is amusing. Most car makers charge a crazy price for replacement electronic keys, as the poor sucker generally has no option but to pay. So with that split the customer is still covering far more than 100% of the COST, even though they the may only be paying 30% of the retail price of the key.

author: paulca
author_rank: Super Contributor
timestamp: September 08, 2024, 04:48:54 pm
content: Toyota want £75 to replace the battery in the key fob. There is literally a notch to put the emergency key into and twist to pop it open. Literally the tool is in the key. The battery is a standard coin cell.They charge £300 to reprogram your tire pressure sensors. However, due to EU regulations the "Toyota Tech Stream" laptop software for dealers is available to download and you can update your own sensors codes in 5 minutes. Catch is... at your own risk. If you wipe your fuel map and brick your ECU ... tough.This is why they are generally referred to as "Stealers".

author: themadhippy
author_rank: Super Contributor
timestamp: September 08, 2024, 04:58:28 pm
content: Quotethere vans had a great security feature,lock the cab doors,open the rear doors to unload, cab stays locked.But if you opened the side cargo doors the cab would unlock

author: coppice
author_rank: Super Contributor
timestamp: September 08, 2024, 05:06:24 pm
content: Quote from: paulca on September 08, 2024, 04:48:54 pmHow often do you need to replace that? Most car keys need a new battery every 2 to 3 years. My Volvo's keyless entry gadget came in 2 forms. I got two of a larger design, with some buttons for remote control, and an exchangeable CR2032 cell, and a dsingle "lifestyle" key that is completely sealed, without buttons, so you can go swimming with it. The lifestyle key battery ran down after 3 years, and they want an unreasonable price for a new one. Its not important to me, so I didn't replace it.

author: TimFox
author_rank: Super Contributor
timestamp: September 08, 2024, 05:13:10 pm
content: Quote from: coppice on September 08, 2024, 05:06:24 pmMy Toyota dealer doesn't charge quite that much, but it is still overpriced.I found a website of another dealer that detailed how to change the cell, and it is readily available at retail for a reasonable price.https://www.chicagotoyota.com/toyota-key-replacement.htm

author: Bud
author_rank: Super Contributor
timestamp: September 08, 2024, 06:07:07 pm
content: I drove a Toyota sedan for 13 years (bought it brand new) , fob never needed a new battery. I traded the car in after 13 years with the fob being just fine.

author: tooki
author_rank: Super Contributor
timestamp: September 08, 2024, 06:12:10 pm
content: Quote from: coppice on September 08, 2024, 03:22:51 pmOh, without a doubt!!I’d be surprised if the actual COGS of a fob is more than 20% of what they charge for them, and much of that is likely to be paperwork/logistics, not BOM.

author: coppice
author_rank: Super Contributor
timestamp: September 08, 2024, 06:50:25 pm
content: Quote from: Bud on September 08, 2024, 06:07:07 pmThe older fobs only wake up when someone presses a button, so the batteries last a long time. We have a 12 year old Honda, where I changed a battery a couple of years ago, and I suspect that was its first change. Our Volvo, bought new in 2019, with "keyless" entry gets through a battery in 2-3 years, as its regularly listening for the car to interrogate it.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: September 08, 2024, 07:29:09 pm
content: Quote from: coppice on September 08, 2024, 06:50:25 pmOne of the benefits of using 125kHz is that it is possible it make a receiver that uses very close to zero current, as enough voltage can be developed in the receive antenna coil's tuned circuit to wake up an MCU with no active amplification.

author: mikeselectricstuff
author_rank: Super Contributor
timestamp: September 08, 2024, 07:31:13 pm
content: Quote from: coppice on September 08, 2024, 03:22:51 pmThird-party fobs are available for many (most?) cars from auto locksmiths, way cheaper.

author: tszaboo
author_rank: Super Contributor
timestamp: September 09, 2024, 10:38:35 am
content: Quote from: coppice on September 08, 2024, 06:50:25 pmSame here, 3-4 years battery life on my Toyota. Although I don't know the replacement costs, because I just bough half a dozen CR2010 or whatever is inside for one EUR and replace it when the car tells me to.

author: tom66
author_rank: Super Contributor
timestamp: September 09, 2024, 11:19:16 am
content: Funnily enough I went through 2-3 key fob batteries for my Golf Mk7, which did NOT use keyless technology. Some manufacturers aren't good at low power design it seems.

author: Phil1977
author_rank: Frequent Contributor
timestamp: September 09, 2024, 11:26:21 am
content: The BMW E46 LCI has a really attractively small keyfob with a built in supercap that´s charged while driving by the NFC coils. It´s watertight and didn't need any care in over 20 years of usage.Okay, it didn't feature keyless entry and keyless go - but it was safe and sustainable. Then car manufacturers decided that their customers want big super chunky and obviously unsafe keys that need a new battery each few years.

author: paulca
author_rank: Super Contributor
timestamp: September 09, 2024, 12:14:28 pm
content: I would say, if you have keyless.1. Take the battery out of the spare. That or put one of those plastic insulator strips in.2. Store a spare battery for the key in the same place as the spare and another in the glove box.I recall at least one US owner installing a switch on the back of his key.

author: tom66
author_rank: Super Contributor
timestamp: September 09, 2024, 12:49:15 pm
content: Or just put it in a Faraday-kind of pouch. They are commonly sold nowadays, you can readily test if it will work by trying to unlock the car with it.

author: tszaboo
author_rank: Super Contributor
timestamp: November 08, 2024, 09:24:42 am
content: So someone was in my car again, no damage to the door. Can I just ask one thing? Actually two:Can you please turn off the damn interior lights after you are finished going through my stuff?And you know the second one.

author: BBBbbb
author_rank: Unknown
timestamp: November 08, 2024, 12:04:27 pm
content: Quote from: tooki on September 08, 2024, 06:12:10 pmCOGs is below 10eur, below 5 in some cases. can creep up over 10 (but <15) if it has the UWB chip (needs more passives as well for the power spikes and I think NXP is still charging nicely for the Ranger series UWB uC).This excludes the low volume luxury brands (Maserati, Ferrari) that put expensive materials in the housing (metal, leather).High volume ones are made by injection molding. At high volumes, set up costs become insignificant.also by COGs I mean the price OEMs pay the Tier1 suppliers for the fobs (I honestly don't know any OEM that does that in house, maybe Tesla, but I doubt it).Tier1s don't take much margin on it though, as it is almost always a package deal with the rest of the Access electronics (controller, 5+ antennas...)

author: BBBbbb
author_rank: Unknown
timestamp: November 08, 2024, 12:12:46 pm
content: Quote from: Phil1977 on September 09, 2024, 11:26:21 amNot really.supercap works if you only have an RKE key (no passive features). but then you're getting what - 15ish years of life time on average, after which you have to throw away the key (I know yours was 20years, but the average is at best 15).Meanwhile on the same RKE keys with a CR2032, you replace a battery every 5-7 years, and keep on chugging.Most also provide nice water tightness (there is an actual test done on them called washing machine test, and it is what it sounds like).Sounds more sustainable to me.With LF comm (passive features) imagine how frustrated you would be not being able to use your only-supercap key every third time due to the cap being depleted.Some fobs today do have supercaps, but only to support power spikes on Tx and assist the humble CR2032.

author: coppice
author_rank: Super Contributor
timestamp: November 08, 2024, 12:57:07 pm
content: Quote from: BBBbbb on November 08, 2024, 12:12:46 pmThe big advantage of the supercap approach is you can seal the key to the point where you can drive to the beach and swim with the key. Some cars, like Volvos, come with 2 large keys with buttons and a replaceable CR2032, and a smaller sealed "lifestyle" key you can take swimming. The lifestyle key's battery runs out after 2 years, and goes in the waste bin. Getting a replacement is expensive.

author: BBBbbb
author_rank: Unknown
timestamp: November 08, 2024, 10:41:43 pm
content: Quote from: coppice on November 08, 2024, 12:57:07 pmFirst - those accessory like passive fobs (Volvo tag, Maserati or Jaguar wearable…) are awful solutions, since as you said after 2 years they end up in the bin.But the supercap is not the solution.Quiescent current with passive fobs in combination with the leakage current of the super cap mean that the cap can be depleted in just several days. With the BMW RKE fob mentioned, on each startup you end up recharging it. With passive fobs you would not have that, and basically you end up using it as an NFC tag way too often.You can have battery replaceable fobs that are watertight, it is being made, and so are such phones.But best solution for such occasions (swimming) is probably just a passive solution like NFC (transponder pill)