PSA: Phone-as-a-Key Security Issue

[Taco]

This is why we need PIN to drive.

Sponsored

 

[Scoiatael]

This is why we need PIN to drive.

Agreed. Love pin to drive on my Tesla. Just adds another needed level of security.

 

[NY_Rob]

I had brought up the need for PIN to Drive months ago, even sending an email to Rivian and they agreed it's something the vehicle should have. They said they will try to incorporate it ASAP for whatever that's worth....

I had PIN to Drive enabled on my Model Y and currently have it on our Model 3... it gives up peace of mind kind of like two-factor authentication for online dealings.

 

[battincd]

If the security system locks the door if the phone is left inside and ignores it until unlocked by another device, does that mean you'd need to always carry a fob?

What do you do if you're wiping down your truck at a car wash or run into a 7-11 and inadvertently leave your phone in the car? Does that mean you always need to always carry a fob in case you lock yourself out?

 

[godfodder0901]

If the security system locks the door if the phone is left inside and ignores it until unlocked by another device, does that mean you'd need to always carry a fob?

What do you do if you're wiping down your truck at a car wash or run into a 7-11 and inadvertently leave your phone in the car? Does that mean you always need to always carry a fob in case you lock yourself out?

I think you have this mixed up a little. The truck will not lock the Phone-as-a-Key (PaaK) IN the truck, it will UNKLOCK the truck if the PaaK is intentionally locked in the truck using the FOB or NFC tag.

 

[DuckTruck]

I think occupancy detection is as simple as the "seat occupancy sensor" that all modern vehicles have... literally just "I see weight in the passenger seat" (already used for airbags).

When my R1T was having PPF applied, the app showed the temp was high in the cabin (the shop was curing the Exoshield). Then the app asked if I wanted to cool the cabin. I thought I'd try it for a minute, in that it was late at night. When I said "yes", it advised "occupant detected". The PPF guy told me the next day he was there late finalizing the interior tint.

The same thing happened again with only a light jacket and a hat on the rear passenger seat.

 

[battincd]

I think you have this mixed up a little. The truck will not lock the Phone-as-a-Key (PaaK) IN the truck, it will UNKLOCK the truck if the PaaK is intentionally locked in the truck using the FOB or NFC tag.

Apologies, I did have it mixed up.

Conversely, I have an EV with proximity fobs and had to take both fobs on a recent road trip. The first night at a hotel I realized "Keep both fobs in your pocket!" I'd left one in a bag in the car and found it unlocked when I returned. Arg.

 

[godfodder0901]

Apologies, I did have it mixed up.

Conversely, I have an EV with proximity fobs and had to take both fobs on a recent road trip. The first night at a hotel I realized "Keep both fobs in your pocket!" I'd left one in a bag in the car and found it unlocked when I returned. Arg.

I have a Toyota with proximity FOBs and don't really have this issue. If I leave one FOB in the car and attempt to use the capacitive touch sensor to lock the car, it won't lock and gives audible feedback. If I press the button on the FOB itself, it happily locks the car, and it will not unlock using the touch sensors even though a FOB is in the car.

 

[SeaGeo]

Thanks for sharing @godfodder0901. I had wondered about leaving a phone in the gear tunnel on a hike or something, and the ability to lock the truck given PAAK. This answers this question.

To your point @kanundrum I've literally never considered leaving a key in a car, but providing the wristband as a waterproof solution for say.... going to the beach, definitely leads people to think that it's appropriate to leave your phone in the car at least. The behavior is not consistent with what Rivian has advertised. Whether it's a smart decision or not is a different discussion. For someone like @godfodder0901 it's basically required.

 

[AllInev]

What about turning off your phone, not really using it anyway if it's sitting in the truck.

[edit] as a stopgap of course

Wait, what? There's a way to turn off my iPhone?

JK, but I think I've turned off my iPhone maybe once or twice in the past 10 years.

 

[AllInev]

I have a Toyota with proximity FOBs and don't really have this issue. If I leave one FOB in the car and attempt to use the capacitive touch sensor to lock the car, it won't lock and gives audible feedback. If I press the button on the FOB itself, it happily locks the car, and it will not unlock using the touch sensors even though a FOB is in the car.

Same for my Prius V. Well done Toyota.

I've never been a "car" guy, but after spending the past year obsessing over this stupid and awesome R1T machine, I'm really starting to appreciate the Toyota I own. The Prius V is ugly as hell, but only now do I appreciate how well designed, built, and reliable it is. 100% reliable for the past 5 years and 63,403 miles. Instantly starts every time, 450 mile range, no battery drain, no panel gaps, great paint job, no software bugs, no wind noise, etc.

That said, I'm looking forward to the "adventure" of owning an early Rivian model. But... I'm not sure about the rest of my family? For them, a car is for getting from point A to point B. So I'm going to have a lot of explaining and rationalizing to do when things go south on this $80k auto.

 

[RayzorBEV]

What they do at a lot of such sites is buy up a set of old mail boxes and install them just inside the secure area. When you come in in the AM you find a box that has its key, put your phone in, lock it and take the key. That way your phone is safe from theft and the ravages of the sun beating down on your vehicle and security is happy.

We have similar setup for employees to lock up their valuables temporarily, while working, no over-nighters. Security will come and unlock any locked lockers during after hours and you'll have to claim it from them and possibly looses privilege to use them in the future.

 

[No.92]

Odd I have had keys left in and it let me open the door a few min after because it was in the right spot to detect the signal. Regardless I wouldn't trust an app update period even if they did disable Bluetooth PAAK unless there was a special button they selected on the app that says I'm leaving my phone in the car you basically wouldn't know what it will do and then it becomes a game of having the phone work or not as a key.

I think this is something that as a user ( you're the 2nd person to mention this) a bit of common sense would say turn off the phone and or disable the app if you really need to leave your phone in the car.

Agreed. At least until there is an update, an easy workaround is turning off Bluetooth

 

[lefkonj]

These phone based systems should require you to actively use them, not passively like leaving it in a car. I can't get into my Venmo unless I use faceID or a PIN, same with Disney+ or Amazon, why should a car key be any different. Not saying make it required but make it optional.

With regards to proximity what is close to the vehicle. My home office is on the other wall from the garage. If I pickup my phone the car will unlock? That is just stupid.

 

[frostbit3]

In case anyone hasn't seen it, there's also a security issue with using a bluetooth phone as a key:

https://jalopnik.com/researchers-break-into-a-tesla-and-drive-away-using-blu-1848938417

TL;DR BLE wasn't intended to be used this way, so the car can easily be tricked into using a phone that isn't yours.

Looks like I'll be disabling that feature entirely, which is unfortunate since that's the only proximity key that I'm aware of. All the other keys you have to place on the door to get it to unlock.

Sponsored