Tesla is all the way on the easy and cheap end of the scale. It's $40 for two new key cards or $175 for a new key fob, and unless you lost all of your existing keys at once, you can program the new ones and deactivate the old ones yourself in about a minute with no extra tools or software. And using their phone app as a Bluetooth key is free forever.
What are you talking about? Most people just use their phone for their Tesla. Most carry they $40 credit card style key in their wallet just in case, but rarely use it. The $175 fob is just a kind of collectors item nobody has except for people who are really into Tesla and buy all the merch.
It's an NFC card, $5 should still leave them decent margin (bulk price should be ~$2 easily).
It's nice more cars just let you use your phone in the first place but like you say most want that physical backup and then get gouged from it even from the examples of "great" pricing.
Let’s not forget what these Tesla RFID cards can’t do, which is basic keyless entry that every key fob has offered since the 1990s. If your phone is dead or you just don’t want to download an app, you have to walk up to the car and physically touch it to unlock it.
Just look at the key fob on a Chrysler Pacifica. Start the engine, open/close the sliding doors, open/close the trunk, set off the car alarm, all from a fob with a battery that lasts years with no internet or Bluetooth required.
We don't care about fobs. It's not a thing we want in a Tesla outside of just having merch. We don't carry keys or fobs or anything. We've moved beyond that. We walk up to our car and it senses our phone and it unlocks.
Which is still crazytown pricing. They should be about $5, even allowing for a reasonable profit margin for Tesla.
But I was not saying that Tesla key replacements were on the expensive side of the scale. I'm saying that the entire pricing scale is insane. That Tesla keys tend toward the less expensive side of that scale in no way means that they're reasonably priced.
I get that you can use a phone app for "free", but I can't be the only one for whom that solution is a nonstarter regardless of price.
Rivian requires a service center to pair a key? That’s a surprise, I would’ve thought they would use the Tesla method of allowing the owner to pair it themselves with a couple taps.
I just made two additional keys for my 10 year old Toyota which only came with one (bought it used), and it cost me just over $200. And that is aftermarket keys with an aftermarket programmer. The keys are also fobs, which does account for $100 of the cost. $40 for a pair of key cards is a bargain by comparison.
Needing to have all keys present to program a new one yourself is often a security feature. Otherwise someone borrowing your car or getting ahold of one of your keys could possibly make their own.
Tesla is shockingly customer friendly with many services. I’ve received many new feature updates that would have been an upsell with BMW. “Premium Connectivity” is only $99 / year, and would be 5x with another vendor. The free connectivity provides gps . FSD is only $100 per month. BMW charges way more than that for petty suspension features.
You're mixing up two different things. One is the Bluetooth key that needs your phone to be close to the car and doesn't go over the Internet. That's what's free forever. The part that goes over the Internet is free for the first 8 years and is then $100/yr thereafter. Also, why do you use the word "unrestricted"?
On the latest models, yes. 2023+ Chrysler vehicles have a "rolling pin code" that the immobilizer requires before it allows enrolling fobs. Chrysler will only hand these out to registered locksmiths (and they charge a fee for doing so).
Now, people have been hacking the RFHUB for a while but it's been a fairly exclusive thing. I also doubt that software updates to the RFHUB are actually signed. I suspect that the next couple of years will see any remaining nonsense worked around by LLM-aided reverse engineering.
They should be a $5 piece of machined metal. I don’t know how we let car keys turn into computers. Not everything has to be a goddamned computer. If your car requires a computerized remote control to open, it’s defective and should be returned.
I had a car with a pure metal key, and even with 30 years in the city, it never got stolen. I knew a single person who had their car stolen, and it was at gunpoint. I really don't think lock-picking or hot-wiring really existed outside of movies. It always felt like a scare tactic to sell more insurance.
It's a mistake to assume that the security must be embedded in the key.
It would be reasonable to have something like key and pin (similar to chip and pin[1]), where you have to enter a PIN and have the physical key to start the car. Or have a fingerprint reader. Or use the alertness camera for face authentication.
Since nearly everyone has a phone, and that phone is likely paired to the car, it should also be sufficient to sense that the bluetooth of the phone has paired to the car and at a sufficiently strong signal strength (and is not a new pairing).
The idea that the key itself must embed cryptographic hardware is a historical assumption that should be reconsidered.
You're just moving the expensive part around for all these things. And something tells me someone who rails against a "computerized remote control" won't be thrilled with an app being required.
Also your steps are about starting the car, but entering the car itself usually needs security too. And since people like unlocking cars remotely that leaves us with either the current RFID keyfob, or some app over Bluetooth or mobile data.
> It would be reasonable to have something like key and pin (similar to chip and pin[1]), where you have to enter a PIN and have the physical key to start the car
Lol no it wouldn't. That's not making it to production any more than BMW's heated seats subscription charge.
A mechanical carburetor is simply a crazy invention: it has to provide fuel stoichiometry under wildly varying conditions. Cold start, hot start, summer, winter, high altitude, low altitude, ... not to mention different RPMs and loads.
In the carburetor era, cars guzzled gas, and you could smell unburned fuel in the exhaust.
There is no way you can optimize the performance and fuel economy without a real time system controlling key variables like injection of fuel, and timing of ignition and valves.
Buying fobs online is a gamble. I got one for an older Kia Rio recently for some $40 plus shipping. Very good fob with a flip key and all the remote buttons. Unfortunately, the shady vendor did not mention that it does not include the transponder, which is some kind of RFID tag type thing that is sensed by the vehicle in order to start the engine, in addition to the key having to be cut correctly to turn the ignition.
I had to pay additional money to the automotive locksmith to put that in, on top of the $120 CAD base rate.
And, less than two months later, the new fob's battery died! I had a bunch of CR2032's around, which I had gotten cheaply; but insult to injury, you know?
Not just a missing transponder, but a shitty old/used battery on its last legs.
Honestly I'll take that over the shit we have today. The ignition key had a resistor whose value was keyed to the ecm and it wouldn't start if it was wrong (which was why at least the Camaros and Corvettes had separate keys). It was enough of a hurdle that I still think it would deter anyone who didn't have both time and really wanted your car, and if they have both they're probably getting it anyway.
The later ones did, yeah, but I feel like that only lasted for a few years. The separate ignition key long predates the resistor key thing. In other words, that's not WHY they had separate keys.
Yes and so many of them you could just pull the key out of the ignition while it was running. Or when they got got really worn out, you could just turn the ignition on without any key at all.
Or the Hondas and Nissans up to the early 2000s, you could use pretty much any key from any other car of the same make if you just jiggled the key.
Not all of them are that expensive. From memory, I paid AU$200 for a genuine Toyota RAV4 key at the dealership (including cutting and reprogramming), which is about US$140.
One other option not mentioned in the article: Replacing the key shell and moving the guts from the old key.
Obviously not an option if you lost the key, but when my Toyota keyfobs got really worn (button membranes breaking and exposing the underlying microswitch), I discovered that you can avoid the fuss and/or expense of reprogramming the keys by buying replacement key fob shells and moving the circuit board from the old key. Wasn't any harder than changing the key fob battery..
The article is giving automotive companies too much credit. Sophisticated anti-theft technologies don’t translate to high manufacturing cost, especially given that car keys are a very high volume item, typically two are produced per car.
Your iPhone has more sophisticated security measures inside of it along with an entire computer capable of playing relatively recent AAA games and it costs less than some of these keys.
The actual answer is that dealerships make their money on service and demand that the manufacturers throw them bones like this.
Tesla’s fobs are $175 and they don’t even give you any when you buy the car with the excuse that you “just use your phone” so I guess you don’t need dealer franchise laws to be greedy.
The card doesn’t have the functionality of the free fob that came with my Toyota. It can’t honk the horn to find the vehicle, it can’t pop the trunk, and if Tesla made a minivan it wouldn’t open/close the sliding door.
The Tesla key card costs less than a fob because it doesn’t do as much as a key fob.
What grieves me is that, if I don't fancy these fancy fobs, and want an old-school key with a traditional ignition, our purportedly capitalist system doesn't quite have the marketplace to support me.
This is also true for a manual transmission and no-chip design. I basically want a freshly manufactured old-school Jeep.
For whatever it's worth, both the common Chinese models and frontier American models are remarkably good at uh...rapidly reversing a lot of electronics and peripheral tools around many or most automobiles on the road, and if you're clever or maybe bad, the uplift from the models has enabled a lot of both good and absurd shit like being able to rapidly reprogram a key with under a $100 in hardware. It's certainly nice not needing to fight VIDA just because Volvo is a company that hates their customers and just generally sucks post Ford, but I presume this also makes everything recent easier to steal.
A new key for my 2004 Suzuki Grand Vitara costs $685 in Sweden.
Insurance company offers a new key for $100.
I said I lost it and paid $100.
I considered buying a Chinese key programmer on aliexpress for $200, or going to a black market key programmer that would do it for $100 but I was lazy.
Looking forward to having a car that only needs Apple Car Key in the future.
Like others have said it's a revenue stream for the automotive company and the dealerships. The actual software/security side of car keys is "cat & mouse" game because automotive companies either outsourced the design or picked the cheapest/logistically easiest to implement.
The dealerships like making $200+ per fob program and the automotive companies like selling $$$ hardware + software licenses to be able to do so.
It's also likely that a processor that can only do rolling codes but no RNG or AES operations is cheaper and has longer battery life. Car model lifecycles are very long so the choice of components even for ~2018 cars might be using parts form 2013 (my guess). And auto companies are probably only considering parts purpose built for their industry due to supply and price guarantees.
If it wasn't for insurance companies refusing to insure some models with insecure fobs, the issue would likely be much worse today.
> A growing number of manufacturers now offer mobile apps, some of which serve as fully functioning car keys by adding a key to your phone’s digital wallet alongside credit cards and boarding passes.
This was a funny sentence to read. I'm reading this article to kill time while, in another window, I'm on a chat with customer service for my credit card because my credit card stopped working in my digital wallet. I've been trying to resolve the issue for weeks.
So I'm glad my car doesn't require anything like that.
I recently bought a car with just one key - car was priced about £500 lower than expected but the replacement price of the key was £350, that was via a local auto security specialist as the dealer price was much more expensive.
Only bought the second one because you need both in the car to enable the digital lock via the app. Only then did I realise that digital lock via app isn't supported in the UK.
Ah well, at least I now have a spare which the girlfriend is eyeing up...
62 comments
[ 6.2 ms ] story [ 91.8 ms ] threadThe scale starts at crazytown prices and just gets increasingly insane from there.
It's nice more cars just let you use your phone in the first place but like you say most want that physical backup and then get gouged from it even from the examples of "great" pricing.
Just look at the key fob on a Chrysler Pacifica. Start the engine, open/close the sliding doors, open/close the trunk, set off the car alarm, all from a fob with a battery that lasts years with no internet or Bluetooth required.
Tesla’s keycards are relatively affordable at $40 for a pair but the fobs are $175 which is pretty much the same price as a Toyota.
Isn't it two for $40?
Which is still crazytown pricing. They should be about $5, even allowing for a reasonable profit margin for Tesla.
But I was not saying that Tesla key replacements were on the expensive side of the scale. I'm saying that the entire pricing scale is insane. That Tesla keys tend toward the less expensive side of that scale in no way means that they're reasonably priced.
I get that you can use a phone app for "free", but I can't be the only one for whom that solution is a nonstarter regardless of price.
That said, the increased security of modern keys plus the remote control capabilities definitely adds some value.
Surely a company couldn’t gather any personal information with unrestricted Bluetooth access on a phone app, right?
Now, people have been hacking the RFHUB for a while but it's been a fairly exclusive thing. I also doubt that software updates to the RFHUB are actually signed. I suspect that the next couple of years will see any remaining nonsense worked around by LLM-aided reverse engineering.
Are you familiar with lock-picking?
See: https://en.wikipedia.org/wiki/Kia_Challenge for what happens if you skip the immobilizer
It would be reasonable to have something like key and pin (similar to chip and pin[1]), where you have to enter a PIN and have the physical key to start the car. Or have a fingerprint reader. Or use the alertness camera for face authentication.
Since nearly everyone has a phone, and that phone is likely paired to the car, it should also be sufficient to sense that the bluetooth of the phone has paired to the car and at a sufficiently strong signal strength (and is not a new pairing).
The idea that the key itself must embed cryptographic hardware is a historical assumption that should be reconsidered.
[1] https://en.wikipedia.org/wiki/EMV#Chip_and_PIN_versus_chip_a...
Also your steps are about starting the car, but entering the car itself usually needs security too. And since people like unlocking cars remotely that leaves us with either the current RFID keyfob, or some app over Bluetooth or mobile data.
Lol no it wouldn't. That's not making it to production any more than BMW's heated seats subscription charge.
I don't recall the exact answer, but Technology Connections did a video on this very question 2 months ago.
Engines haven't been fully mechanical in decades - and that's good! 2.4M 1mo ago 58:45 https://www.youtube.com/watch?v=0KoeY54M5VA
In the carburetor era, cars guzzled gas, and you could smell unburned fuel in the exhaust.
There is no way you can optimize the performance and fuel economy without a real time system controlling key variables like injection of fuel, and timing of ignition and valves.
But, I can use a credit card style key if I want. They are only $40 for a pair. I can program them in various ways. https://shop.tesla.com/product/key-card
I had to pay additional money to the automotive locksmith to put that in, on top of the $120 CAD base rate.
And, less than two months later, the new fob's battery died! I had a bunch of CR2032's around, which I had gotten cheaply; but insult to injury, you know?
Not just a missing transponder, but a shitty old/used battery on its last legs.
It'll be "fun" if your replacement battery also lasts under two months.
Or the Hondas and Nissans up to the early 2000s, you could use pretty much any key from any other car of the same make if you just jiggled the key.
Obviously not an option if you lost the key, but when my Toyota keyfobs got really worn (button membranes breaking and exposing the underlying microswitch), I discovered that you can avoid the fuss and/or expense of reprogramming the keys by buying replacement key fob shells and moving the circuit board from the old key. Wasn't any harder than changing the key fob battery..
Your iPhone has more sophisticated security measures inside of it along with an entire computer capable of playing relatively recent AAA games and it costs less than some of these keys.
The actual answer is that dealerships make their money on service and demand that the manufacturers throw them bones like this.
The Tesla key card costs less than a fob because it doesn’t do as much as a key fob.
This is also true for a manual transmission and no-chip design. I basically want a freshly manufactured old-school Jeep.
Capitalist fail!
Insurance company offers a new key for $100.
I said I lost it and paid $100.
I considered buying a Chinese key programmer on aliexpress for $200, or going to a black market key programmer that would do it for $100 but I was lazy.
Looking forward to having a car that only needs Apple Car Key in the future.
The dealerships like making $200+ per fob program and the automotive companies like selling $$$ hardware + software licenses to be able to do so.
It's also likely that a processor that can only do rolling codes but no RNG or AES operations is cheaper and has longer battery life. Car model lifecycles are very long so the choice of components even for ~2018 cars might be using parts form 2013 (my guess). And auto companies are probably only considering parts purpose built for their industry due to supply and price guarantees.
If it wasn't for insurance companies refusing to insure some models with insecure fobs, the issue would likely be much worse today.
This was a funny sentence to read. I'm reading this article to kill time while, in another window, I'm on a chat with customer service for my credit card because my credit card stopped working in my digital wallet. I've been trying to resolve the issue for weeks.
So I'm glad my car doesn't require anything like that.
Only bought the second one because you need both in the car to enable the digital lock via the app. Only then did I realise that digital lock via app isn't supported in the UK.
Ah well, at least I now have a spare which the girlfriend is eyeing up...