The article is giving automotive companies too much credit. Sophisticated anti-theft technologies don’t translate to high manufacturing cost, especially given that car keys are a very high volume item, typically two are produced per car.
Your iPhone has more sophisticated security measures inside of it along with an entire computer capable of playing relatively recent AAA games and it costs less than some of these keys.
The actual answer is that dealerships make their money on service and demand that the manufacturers throw them bones like this.
One other option not mentioned in the article: Replacing the key shell and moving the guts from the old key.
Obviously not an option if you lost the key, but when my Toyota keyfobs got really worn (button membranes breaking and exposing the underlying microswitch), I discovered that you can avoid the fuss and/or expense of reprogramming the keys by buying replacement key fob shells and moving the circuit board from the old key. Wasn't any harder than changing the key fob battery..
Tesla is all the way on the easy and cheap end of the scale. It's $40 for two new key cards or $175 for a new key fob, and as long as you don't lose all of your existing keys at once, you can program new ones and deactivate lost ones yourself in about a minute with no extra tools or software. And using their phone app as a Bluetooth key is free forever.
Needing to have all keys present to program a new one yourself is often a security feature. Otherwise someone borrowing your car or getting ahold of one of your keys could possibly make their own.
I just made two additional keys for my 10 year old Toyota which only came with one (bought it used), and it cost me just over $200. And that is aftermarket keys with an aftermarket programmer. The keys are also fobs, which does account for $100 of the cost. $40 for a pair of key cards is a bargain by comparison.
What are you talking about? Most people just use their phone for their Tesla. Most carry they $40 credit card style key in their wallet just in case, but rarely use it. The $175 fob is just a kind of collectors item nobody has except for people who are really into Tesla and buy all the merch.
You get two for $40, and also worth noting is that you can use that on any number of Teslas. I carry one card that works on any of three cars.
Beats the heck out of paying hundreds of dollars to leave the car at a dealership for a few days to get a new key. And as you said: even then, this is just for the key that I need to use if my phone died or I just bought a new one.
I love it, so many things just make sense on my Tesla, which is why I have two. It's really a step backwards getting into any other car at this point. I just walk up to it, it unlocks automatically (because it senses my phone). I fasten my seatbelt, touch one button on the screen, and it then drives me to me to work (through busy city and highway roads). I don't have to do anything, I don't even have to drive it.
It's an NFC card, $5 should still leave them decent margin (bulk price should easily come to ~$2).
It's nice more cars just let you use your phone in the first place but like you say most want that physical backup and then get gouged replacing it even by the example of "great" pricing that does everything right. This is "how much could a bananna cost, $10?" except we're fine with it because it's for one of the most expensive things you own and nobody is going to not get a car because keys are marked up.
Rivian requires a service center to pair a key? That’s a surprise, I would’ve thought they would use the Tesla method of allowing the owner to pair it themselves with a couple taps.
Tesla is shockingly customer friendly with many services. I’ve received many new feature updates that would have been an upsell with BMW. “Premium Connectivity” is only $99 / year, and would be 5x with another vendor. The free connectivity provides gps . FSD is only $100 per month. BMW charges way more than that for petty suspension features.
A new key for my 2004 Suzuki Grand Vitara costs $685 in Sweden.
Insurance company offers a new key for $100.
I said I lost it and paid $100.
I considered buying a Chinese key programmer on aliexpress for $200, or going to a black market key programmer that would do it for $100 but I was lazy.
Looking forward to having a car that only needs Apple Car Key in the future.
Honestly I'll take that over the shit we have today. The ignition key had a resistor whose value was keyed to the ecm and it wouldn't start if it was wrong (which was why at least the Camaros and Corvettes had separate keys). It was enough of a hurdle that I still think it would deter anyone who didn't have both time and really wanted your car, and if they have both they're probably getting it anyway.
Buying fobs online is a gamble. I got one for an older Kia Rio recently for some $40 plus shipping. Very good fob with a flip key and all the remote buttons. Unfortunately, the shady vendor did not mention that it does not include the transponder, which is some kind of RFID tag type thing that is sensed by the vehicle in order to start the engine, in addition to the key having to be cut correctly to turn the ignition.
I had to pay additional money to the automotive locksmith to put that in, on top of the $120 CAD base rate.
And, less than two months later, the new fob's battery died! I had a bunch of CR2032's around, which I had gotten cheaply; but insult to injury, you know?
Not just a missing transponder, but a shitty old/used battery on its last legs.
Like others have said it's a revenue stream for the automotive company and the dealerships. The actual software/security side of car keys is "cat & mouse" game because automotive companies either outsourced the design or picked the cheapest/logistically easiest to implement.
The dealerships like making $200+ per fob program and the automotive companies like selling $$$ hardware + software licenses to be able to do so.
It's also likely that a processor that can only do rolling codes but no RNG or AES operations is cheaper and has longer battery life. Car model lifecycles are very long so the choice of components even for ~2018 cars might be using parts form 2013 (my guess). And auto companies are probably only considering parts purpose built for their industry due to supply and price guarantees.
If it wasn't for insurance companies refusing to insure some models with insecure fobs, the issue would likely be much worse today.
> A growing number of manufacturers now offer mobile apps, some of which serve as fully functioning car keys by adding a key to your phone’s digital wallet alongside credit cards and boarding passes.
This was a funny sentence to read. I'm reading this article to kill time while, in another window, I'm on a chat with customer service for my credit card because my credit card stopped working in my digital wallet. I've been trying to resolve the issue for weeks.
So I'm glad my car doesn't require anything like that.
PS: it's $20 per key. Because that $40 buys you a pair of key cards. I learned that when I wanted to buy two of these and was surprised to see they shipped me four card. The product name doesn't make it obvious that it's a pair...
Not all of them are that expensive. From memory, I paid AU$200 for a genuine Toyota RAV4 key at the dealership (including cutting and reprogramming), which is about US$140.
For whatever it's worth, both the common Chinese models and frontier American models are remarkably good at uh...rapidly reversing a lot of electronics and peripheral tools around many or most automobiles on the road, and if you're clever or maybe bad, the uplift from the models has enabled a lot of both good and absurd shit like being able to rapidly reprogram a key with under a $100 in hardware. It's certainly nice not needing to fight VIDA just because Volvo is a company that hates their customers and just generally sucks post Ford, but I presume this also makes everything recent easier to steal.
On the latest models, yes. 2023+ Chrysler vehicles have a "rolling pin code" that the immobilizer requires before it allows enrolling fobs. Chrysler will only hand these out to registered locksmiths (and they charge a fee for doing so).
Now, people have been hacking the RFHUB for a while but it's been a fairly exclusive thing. I also doubt that software updates to the RFHUB are actually signed. I suspect that the next couple of years will see any remaining nonsense worked around by LLM-aided reverse engineering.
What grieves me is that, if I don't fancy these fancy fobs, and want an old-school key with a traditional ignition, our purportedly capitalist system doesn't quite have the marketplace to support me.
This is also true for a manual transmission and no-chip design. I basically want a freshly manufactured old-school Jeep.
Honestly I think if someone restarted production of the Jeep XJ as it was towards the end of its run they would probably outsell almost everything you could buy today.
You could restart it, but it would not be as profitable as whatever they're doing now and it would eat into the market share of the rest of jeep's lineup. Even if you made a competitor, you're competing with a product that has better margins than you and more access to capital. It's competitive in terms of consumer demand, not in aggregate profit.
Company A netting $1 from 50 happy customers is nowhere near as profitiable as Company B netting $10 from 10 miserable customers. Consider that Company A and B also compete for capital and manufacturing capability and such, not just customers. The market has chosen Company B as the most efficient vehicle to extract wealth from customers.
In fact the more Company B (and companies like it) succeed, the more capital they collectively soak up and the fewer competitors they'll have. The less leverage these miserable customers will have.
It's like the market-driven spread of some technology, like shipping containers. Except instead of a cost-cutting technology it's a price-inflating technology. Like movie theaters choosing to add massive markups to their snack bar. If you're a movie theater and you don't extort your customers for snacks, you have to raise ticket prices or lower profitability and you can't make ends meet or be as capital efficient as competitors.
I think there is some solution to this that isn't just heavy-handed regulation that companies will shoot loopholes in and run laps around. Maybe some type of stakeholder capitalism where consumers have more power than shareholders. Crowdsupply is one such example.
The programming step seems to be the real cost driver here, more than the fob hardware. Losing all keys at once is the worst case, since there is no working key to copy from. It is worth checking the cost of a spare while you still have one, as part of the total cost of owning a car.
They should be a $5 piece of machined metal. I don’t know how we let car keys turn into computers. Not everything has to be a goddamned computer. If your car requires a computerized remote control to open, it’s defective and should be returned.
It's a mistake to assume that the security must be embedded in the key.
It would be reasonable to have something like key and pin (similar to chip and pin[1]), where you have to enter a PIN and have the physical key to start the car. Or have a fingerprint reader. Or use the alertness camera for face authentication.
Since nearly everyone has a phone, and that phone is likely paired to the car, it should also be sufficient to sense that the bluetooth of the phone has paired to the car and at a sufficiently strong signal strength (and is not a new pairing).
The idea that the key itself must embed cryptographic hardware is a historical assumption that should be reconsidered.
> It would be reasonable to have something like key and pin (similar to chip and pin[1]), where you have to enter a PIN and have the physical key to start the car
Lol no it wouldn't. That's not making it to production any more than BMW's heated seats subscription charge.
You're just moving the expensive part around for all these things. And something tells me someone who rails against a "computerized remote control" won't be thrilled with an app being required.
Also your steps are about starting the car, but entering the car itself usually needs security too. And since people like unlocking cars remotely that leaves us with either the current RFID keyfob, or some app over Bluetooth or mobile data. The app is great but it requires a phone and is easier to put behind a subscription.
A car key having a RFID transponder in addition to correctly cut teeth to turn the ignition is a good additional security layer though.
If I were to guess, how we let cars turn into computers probably started with fuel injection. The same embedded system that controls the timing of injectors (in response to numerous sensors) and variable valve timing and whatnot.
From there, feature creep.
Next thing you know, you're getting an engine code due to forgetting to put the gas cap back on at the pump (paying money to reset that because it's still years before consumer OBD2 dongles become available) and it goes downhill from there.
I had a car with a pure metal key, and even with 30 years in the city, it never got stolen. I knew a single person who had their car stolen, and it was at gunpoint. I really don't think lock-picking or hot-wiring really existed outside of movies. It always felt like a scare tactic to sell more insurance.
In the old mechanical-keys-only days without ECUs, there was no lock picking; thieves just went behind the steering wheel and connected two wires together. Starting a stolen car without a key was called "hotwiring".
They would get into the car via various means: find a car left unlocked; use coat-hanger wire to pull up a window-side lock peg; break a window.
not much different nowadays, one just roots the car then drives away. usually no coathangering the doors needed: access is either wireless or in some conviently accessible place
The article is giving automotive companies too much credit. Sophisticated anti-theft technologies don’t translate to high manufacturing cost, especially given that car keys are a very high volume item, typically two are produced per car.
Your iPhone has more sophisticated security measures inside of it along with an entire computer capable of playing relatively recent AAA games and it costs less than some of these keys.
The actual answer is that dealerships make their money on service and demand that the manufacturers throw them bones like this.
One other option not mentioned in the article: Replacing the key shell and moving the guts from the old key.
Obviously not an option if you lost the key, but when my Toyota keyfobs got really worn (button membranes breaking and exposing the underlying microswitch), I discovered that you can avoid the fuss and/or expense of reprogramming the keys by buying replacement key fob shells and moving the circuit board from the old key. Wasn't any harder than changing the key fob battery..
Tesla is all the way on the easy and cheap end of the scale. It's $40 for two new key cards or $175 for a new key fob, and as long as you don't lose all of your existing keys at once, you can program new ones and deactivate lost ones yourself in about a minute with no extra tools or software. And using their phone app as a Bluetooth key is free forever.
I think "easy and cheap" was when a new key cost a couple bucks at any nearby hardware store.
That said, the increased security of modern keys plus the remote control capabilities definitely adds some value.
Needing to have all keys present to program a new one yourself is often a security feature. Otherwise someone borrowing your car or getting ahold of one of your keys could possibly make their own.
> It's $40 for two new key cards or $175 for a new key fob
The scale starts at crazytown prices and just gets increasingly insane from there.
I just made two additional keys for my 10 year old Toyota which only came with one (bought it used), and it cost me just over $200. And that is aftermarket keys with an aftermarket programmer. The keys are also fobs, which does account for $100 of the cost. $40 for a pair of key cards is a bargain by comparison.
What are you talking about? Most people just use their phone for their Tesla. Most carry they $40 credit card style key in their wallet just in case, but rarely use it. The $175 fob is just a kind of collectors item nobody has except for people who are really into Tesla and buy all the merch.
You get two for $40, and also worth noting is that you can use that on any number of Teslas. I carry one card that works on any of three cars.
Beats the heck out of paying hundreds of dollars to leave the car at a dealership for a few days to get a new key. And as you said: even then, this is just for the key that I need to use if my phone died or I just bought a new one.
I love it, so many things just make sense on my Tesla, which is why I have two. It's really a step backwards getting into any other car at this point. I just walk up to it, it unlocks automatically (because it senses my phone). I fasten my seatbelt, touch one button on the screen, and it then drives me to me to work (through busy city and highway roads). I don't have to do anything, I don't even have to drive it.
It's an NFC card, $5 should still leave them decent margin (bulk price should easily come to ~$2).
It's nice more cars just let you use your phone in the first place but like you say most want that physical backup and then get gouged replacing it even by the example of "great" pricing that does everything right. This is "how much could a bananna cost, $10?" except we're fine with it because it's for one of the most expensive things you own and nobody is going to not get a car because keys are marked up.
Wait until you hear about Rivian. $75 or so, including the labor you have to pay to the service center to get the key paired to your car.
Rivian requires a service center to pair a key? That’s a surprise, I would’ve thought they would use the Tesla method of allowing the owner to pair it themselves with a couple taps.
Tesla is shockingly customer friendly with many services. I’ve received many new feature updates that would have been an upsell with BMW. “Premium Connectivity” is only $99 / year, and would be 5x with another vendor. The free connectivity provides gps . FSD is only $100 per month. BMW charges way more than that for petty suspension features.
A new key for my 2004 Suzuki Grand Vitara costs $685 in Sweden.
Insurance company offers a new key for $100.
I said I lost it and paid $100.
I considered buying a Chinese key programmer on aliexpress for $200, or going to a black market key programmer that would do it for $100 but I was lazy.
Looking forward to having a car that only needs Apple Car Key in the future.
I'm so old, I remember having separate ignition and door keys on our ridiculous GM vehicles.
Do we still have the separate key so the valet can't unlock the glove compartment?
Honestly I'll take that over the shit we have today. The ignition key had a resistor whose value was keyed to the ecm and it wouldn't start if it was wrong (which was why at least the Camaros and Corvettes had separate keys). It was enough of a hurdle that I still think it would deter anyone who didn't have both time and really wanted your car, and if they have both they're probably getting it anyway.
Yes the square and the round ones! I think t tops were a different key that only had a couple possible combinations.
Buying fobs online is a gamble. I got one for an older Kia Rio recently for some $40 plus shipping. Very good fob with a flip key and all the remote buttons. Unfortunately, the shady vendor did not mention that it does not include the transponder, which is some kind of RFID tag type thing that is sensed by the vehicle in order to start the engine, in addition to the key having to be cut correctly to turn the ignition.
I had to pay additional money to the automotive locksmith to put that in, on top of the $120 CAD base rate.
And, less than two months later, the new fob's battery died! I had a bunch of CR2032's around, which I had gotten cheaply; but insult to injury, you know?
Not just a missing transponder, but a shitty old/used battery on its last legs.
> Not just a missing transponder, but a shitty old/used battery on its last legs.
It'll be "fun" if your replacement battery also lasts under two months.
Like others have said it's a revenue stream for the automotive company and the dealerships. The actual software/security side of car keys is "cat & mouse" game because automotive companies either outsourced the design or picked the cheapest/logistically easiest to implement.
The dealerships like making $200+ per fob program and the automotive companies like selling $$$ hardware + software licenses to be able to do so.
It's also likely that a processor that can only do rolling codes but no RNG or AES operations is cheaper and has longer battery life. Car model lifecycles are very long so the choice of components even for ~2018 cars might be using parts form 2013 (my guess). And auto companies are probably only considering parts purpose built for their industry due to supply and price guarantees.
If it wasn't for insurance companies refusing to insure some models with insecure fobs, the issue would likely be much worse today.
> A growing number of manufacturers now offer mobile apps, some of which serve as fully functioning car keys by adding a key to your phone’s digital wallet alongside credit cards and boarding passes.
This was a funny sentence to read. I'm reading this article to kill time while, in another window, I'm on a chat with customer service for my credit card because my credit card stopped working in my digital wallet. I've been trying to resolve the issue for weeks.
So I'm glad my car doesn't require anything like that.
For my Tesla, I don't even have a key, I just use my phone.
But, I can use a credit card style key if I want. They are only $40 for a pair. I can program them in various ways. https://shop.tesla.com/product/key-card
PS: it's $20 per key. Because that $40 buys you a pair of key cards. I learned that when I wanted to buy two of these and was surprised to see they shipped me four card. The product name doesn't make it obvious that it's a pair...
Cynic: because when you need one, you'll pay through the nose for it.
Not all of them are that expensive. From memory, I paid AU$200 for a genuine Toyota RAV4 key at the dealership (including cutting and reprogramming), which is about US$140.
It was sort of funny in a twisted way when I bought my $20K car from Carmax and they handed me one key. Still haven't managed to get a replacement...
For whatever it's worth, both the common Chinese models and frontier American models are remarkably good at uh...rapidly reversing a lot of electronics and peripheral tools around many or most automobiles on the road, and if you're clever or maybe bad, the uplift from the models has enabled a lot of both good and absurd shit like being able to rapidly reprogram a key with under a $100 in hardware. It's certainly nice not needing to fight VIDA just because Volvo is a company that hates their customers and just generally sucks post Ford, but I presume this also makes everything recent easier to steal.
Interesting topic, boring article
Reprogramming/repairing/recoding the gateway and/or the immobilizer/anti-theft-relevant parts is like... super exclusive?
On the latest models, yes. 2023+ Chrysler vehicles have a "rolling pin code" that the immobilizer requires before it allows enrolling fobs. Chrysler will only hand these out to registered locksmiths (and they charge a fee for doing so).
Now, people have been hacking the RFHUB for a while but it's been a fairly exclusive thing. I also doubt that software updates to the RFHUB are actually signed. I suspect that the next couple of years will see any remaining nonsense worked around by LLM-aided reverse engineering.
What grieves me is that, if I don't fancy these fancy fobs, and want an old-school key with a traditional ignition, our purportedly capitalist system doesn't quite have the marketplace to support me.
This is also true for a manual transmission and no-chip design. I basically want a freshly manufactured old-school Jeep.
Capitalist fail!
Honestly I think if someone restarted production of the Jeep XJ as it was towards the end of its run they would probably outsell almost everything you could buy today.
You could restart it, but it would not be as profitable as whatever they're doing now and it would eat into the market share of the rest of jeep's lineup. Even if you made a competitor, you're competing with a product that has better margins than you and more access to capital. It's competitive in terms of consumer demand, not in aggregate profit.
Company A netting $1 from 50 happy customers is nowhere near as profitiable as Company B netting $10 from 10 miserable customers. Consider that Company A and B also compete for capital and manufacturing capability and such, not just customers. The market has chosen Company B as the most efficient vehicle to extract wealth from customers.
In fact the more Company B (and companies like it) succeed, the more capital they collectively soak up and the fewer competitors they'll have. The less leverage these miserable customers will have.
It's like the market-driven spread of some technology, like shipping containers. Except instead of a cost-cutting technology it's a price-inflating technology. Like movie theaters choosing to add massive markups to their snack bar. If you're a movie theater and you don't extort your customers for snacks, you have to raise ticket prices or lower profitability and you can't make ends meet or be as capital efficient as competitors.
I think there is some solution to this that isn't just heavy-handed regulation that companies will shoot loopholes in and run laps around. Maybe some type of stakeholder capitalism where consumers have more power than shareholders. Crowdsupply is one such example.
The programming step seems to be the real cost driver here, more than the fob hardware. Losing all keys at once is the worst case, since there is no working key to copy from. It is worth checking the cost of a spare while you still have one, as part of the total cost of owning a car.
They should be a $5 piece of machined metal. I don’t know how we let car keys turn into computers. Not everything has to be a goddamned computer. If your car requires a computerized remote control to open, it’s defective and should be returned.
Because mechanical keys are not a good enough security measure.
See: https://en.wikipedia.org/wiki/Kia_Challenge for what happens if you skip the immobilizer
It's a mistake to assume that the security must be embedded in the key.
It would be reasonable to have something like key and pin (similar to chip and pin[1]), where you have to enter a PIN and have the physical key to start the car. Or have a fingerprint reader. Or use the alertness camera for face authentication.
Since nearly everyone has a phone, and that phone is likely paired to the car, it should also be sufficient to sense that the bluetooth of the phone has paired to the car and at a sufficiently strong signal strength (and is not a new pairing).
The idea that the key itself must embed cryptographic hardware is a historical assumption that should be reconsidered.
[1] https://en.wikipedia.org/wiki/EMV#Chip_and_PIN_versus_chip_a...
> It would be reasonable to have something like key and pin (similar to chip and pin[1]), where you have to enter a PIN and have the physical key to start the car
Lol no it wouldn't. That's not making it to production any more than BMW's heated seats subscription charge.
You're just moving the expensive part around for all these things. And something tells me someone who rails against a "computerized remote control" won't be thrilled with an app being required.
Also your steps are about starting the car, but entering the car itself usually needs security too. And since people like unlocking cars remotely that leaves us with either the current RFID keyfob, or some app over Bluetooth or mobile data. The app is great but it requires a phone and is easier to put behind a subscription.
[dead]
A car key having a RFID transponder in addition to correctly cut teeth to turn the ignition is a good additional security layer though.
If I were to guess, how we let cars turn into computers probably started with fuel injection. The same embedded system that controls the timing of injectors (in response to numerous sensors) and variable valve timing and whatnot.
From there, feature creep.
Next thing you know, you're getting an engine code due to forgetting to put the gas cap back on at the pump (paying money to reset that because it's still years before consumer OBD2 dongles become available) and it goes downhill from there.
:)
> If I were to guess, how we let cars turn into computers probably started with fuel injection.
I don't recall the exact answer, but Technology Connections did a video on this very question 2 months ago.
Engines haven't been fully mechanical in decades - and that's good! 2.4M 1mo ago 58:45 https://www.youtube.com/watch?v=0KoeY54M5VA
Did you read the article?
Are you familiar with lock-picking?
I had a car with a pure metal key, and even with 30 years in the city, it never got stolen. I knew a single person who had their car stolen, and it was at gunpoint. I really don't think lock-picking or hot-wiring really existed outside of movies. It always felt like a scare tactic to sell more insurance.
In the old mechanical-keys-only days without ECUs, there was no lock picking; thieves just went behind the steering wheel and connected two wires together. Starting a stolen car without a key was called "hotwiring". They would get into the car via various means: find a car left unlocked; use coat-hanger wire to pull up a window-side lock peg; break a window.
not much different nowadays, one just roots the car then drives away. usually no coathangering the doors needed: access is either wireless or in some conviently accessible place