Posted by infosecau 15 hours ago
White one is harder to tell obviously, but the shape of the mirror looks the same, and you can see the top of the dash has a chamfered shape that looks an awful lot like this pic: https://media.ed.edmunds-media.com/toyota/rav4/2022/oem/2022...
Posting a video demo probably isn't a great idea for this kind of thing. I'm sure some sicko could have figured this out just from the sound the locks make.
I know it seems like no such laws exist, as almost all serious cyber-crime is cross-border and done anonymously, making it nigh-impossible to prosecute.
But when you're an honest cybersecurity researcher, posting your findings openly under your own name? You're one of the few people who can be prosecuted.
I miss the web being less career focused and more crazy
It's almost like something is happening to make sure this happens endlessly. It's probably nothing
I'm assuming he means AWD.
I only have four wheels. If all the wheels are driving, and I only have four wheels, then...
Again, I do know what the conventional difference is. But it's just that: convention. Unless you memorized the convention beforehand, there's really no way to decipher why 4WD/AWD has any meaningful distinction, nor which of the two specific names maps to which mechanism.
4WD vehicles are often part-time 4WD, meaning they can be switched between 4WD and RWD or FWD.
AWD vehicles are full-time AWD because part-time AWD is unnecessary given that the drivetrain delivers power where it's most needed.
The clearer distinction is that a 4WD has a second gearbox (aka a transfer case) that either manually or automatically engages the front wheels, the Jeep Wrangler /TJ being the architype. That means the extra wheels cannot be triggered seamlessly. A 4FW has distinct driving modes whereas an AWD uses clutches to bounce between modes as needed.
Bluey has a couple lines about this distinction. In Australia, even small children have opinions on 4WD v AWD.
AIUI, you lose energy because the power/torque has to go through an extra differential, transfer case, etc, before reaching the rear wheels.
Going from the engine through the transmission to the front wheels is already a 'fixed cost', but the extra mechanics (and their friction loses) to the rear wheels an 'OpEx' that you don't necessarily have to pay if you don't need to.
True for a FWD v RWD car decisions, but in an AWD are not the rear differential and driveshaft still turning whenever the rear wheels are turning? Even the clutch packs should still be rotating even if disengaged. The fact that there is no power through them doesn't mean they aren't generating losses.
It sounds like the savings are more in construction costs than fuel savings.
AWD - clutch packs. Best for nasty conditions on road, IMHO.
https://en.wikipedia.org/wiki/Six-wheel_drive
So nwheels x n driven wheels.
But 6x4 notation is handy when you have six wheels, sure.
I'm guessing that maybe a distinction between offroad capable cars and non-capable cars is useful for liability reasons. Or something else.
Some AWD systems might intelligently change power to different wheels (or front and back) and that might vary per brand and model. 4WD could also do this. Usually with 4WD you might also have a 4 lo and 4 hi gear as well.
Then there's also various types of differentials and locks and whatnot which is a whole more detailed discussion.
Think of it more like it's going to be 2WD most of the time, but when there is low traction (such as ice) the 4WD will engage as power is always going to all wheels.
4WD is a permanent thing, or at least always on when you engage it. The system locks all the wheels to the same spin speed.
4WD is for off-road use. All tires rotate at the same speed.
At this point, the distinction is gone, because car bards marketing.
(AI lies)
Suffice to say, in British parlance any vehicle with four driven wheels can be called a "4×4"
What does this mean?
All the secrecy seems pointless in the age of AI.
Remote start is huge where I live. When it's -10C and there's a foot of snow you have to dig out in the morning, you can start your car from the app and then start shovelling. The alternative is a hokey pokey of shovelling yourself a path to the car, getting in, starting it, getting out, resuming shovelling. Not the end of the world but it's very nice. Even if there's no snow it's nice to get the cabin above freezing while you're eating breakfast without putting your boots on.
i'm in legit cold canada and being able to open my garage remotely and start my car means it's a lot easier to herd small kids into a warm, comfy carseat.
as for "I often forget to lock the doors"... why do you often forget to lock the doors?
Having just switched from an "old-school" car to one of these "keyless" types, I think the problem is actually self-reinforcing -- the keyless entry and start stuff means you interact with the key less and less so you're more likely to forget to interact with it to lock the car. I can't think of a time I forgot to lock my old school car and yet it's happened more than once with the newer car since I got it a few months ago.
I really like using my phone as my key for my car. It's nice having less stuff in my pockets.
Clearly, not a critical use case but it is handy.
Remote locking and remote start are much more useful.
I’m not saying physical keys are not needed, but a nice digital solution is one of the things I really wish I had a Tesla. I wish the other car manufacturers would actually invest in good mobile experiences, they’re all such ass.
good question. I don't know? There are three things I carry with me literally everywhere: phone, keys, and wallet. Any one of them missing in the morning means I have to hunt around the house to find them before I can leave for work. This would not change if I could unlock my car with my phone (I still need to be able to lock my front door and/or let myself in when I come home again, requiring keys)
That's not to say they make sense. The total amount I spent on having the locksmith let me back in to my apartment that year was significantly less than the cost of putting in a combination lock.
Unlike say etcd where three improves reliability to the best of the three, three locks would decrease reliability to the worst among them.
Modern cars already make it much more difficult to lock your keys in the car than in ye olden days.
And the "did I remember to lock my car" remote-check functionality doesn't seem nearly worth the "now a hacker can remote-unlock my car" tradeoff. It's not like that "did I lock it" check helps prevent a "someone smashed the window and grabbed something out of it" scenario anyway.
It's completely unnecessary.
Modern cars automatically lock themselves when they sense there are no keys nearby, nobody in the seats, and the doors are closed for x minutes.
Neither of my modern cars have that behavior.
Or at least as a car owner, this is my risk assessment exercise output.
[1] Yeah, I just pulled this off my ass, don't think there are trustworthy stats either in one direction or the other.
Meanwhile, if I'm out in public and a bad update bricks my phone (or cell coverage is down?) I can no longer use my car. The idea that consumers would hope for more entrenchment into the phone ecosystem is absolutely baffling.
I do own a car. Keys in home are always in exact same spot. Phone can we literally anywhere, good I have smartwatch and I can trigger "locate my phone" that way.
I just don't get the idea of unlocking car though app via internet. Neither I get the "keyless entry" (meaning I do not even need to touch the key fob to unlock car) and "start button" (well if you place key in ignition switch then you will not lose it!)
The security drawback is not worth, fixing non-existing problem in the first place.
Misplacing the phone actually. Car keys are either in someone's pocket/bag (then you talk to whoever used the car last) or in a set place in my home. The phone might be wherever I used it last.
So, while I misplace my phone more often, I also find it with less difficulty.
And so can the police, and so can DHS, and so can ICE, and so can Google ad services, and so can the last 50 highest bidders, and so can ...
Unfortunately Hyundai decided, in their wisdom, to put the door lock button (to lock all doors) in the console between the front seats. Exactly where Sally stepped when she came from the back.
Both my wife's keys and phone were still in the car.
30 minutes later, a local mechanic showed up. He gently pried the front door open with something like a whoopie cushion, and was able to poke the door lock button and open everything. It took him about 5 minutes.
Hyundai Canada can, of course, open the doors remotely, but when I called them they refused to and only offered to call CAA (the Canadian version of AAA, and the people Hyundia sub-contracts their roadside assistance to). I guess that makes sense considering the liability of remotely unlocking for someone whose identity they can't verify.
…And what about the many other things one misplaces about the house? For instance, Wireless mice, TV and various other remote controls, etc.
I just cannot understand why the tech crowd hasn't developed a much-needed Missing Objects protocol.
Think of this. When you lose an object you immediately go to a big button that's hidden and securely bolted down (so you can never lose it) then press it. Like your fob key and car, it activates all these easily-lost items and they start beeping madly so you can find them. Lose the mouse in the couch somewhere and the 'couch' starts beeping. Voilà, one found mouse.
It's crazy that a simple concept like this doesn't exist in practice.
However there are some edge cases where these systems do not always lock when walking away, if you're opening other doors, the trunk, etc.
Are there cars that let you drive them without the key?
My car allows me to unlock it with a phone from the other side of the planet. But to actually drive, it requires the key to be inside.
Mazda charges $10-15/month for their remote unlock/start app.
I live in a cold climate. Remote start isn't even necessary much less very necessary. I start the car, then clean off all the snow and leave. Running the engine isn't going to remove a foot of snow off the windshield and it definitely won't off the roof or hood.
Regardless remote starters do not need the web or a phone, they existed in the 1990s.
Not just necessary, but very necessary? I understand it's convenient, but I think you've overstated it a bit. You can always start your car and then go back in the house for a few.
Factory remote start is designed to be operated while unattended, and prevents people from stealing the car, prevents it from running too long, etc.
They hook a lot of people now with the first couple years free, then spin around and go for a $150+ a year whammy. We gave up.
Also, there was something sticky with the door lock. If I used the key instead of the fob, sometimes the anti-theft system would not disarm and the only way I found to disarm it was to use the fob to turn that alarm off. Grrrr. Fobs lasted about 3 years and cost $100 to replace/reprogram.
My current car (a Miata) has a key only to unlock the door in the event of a dead battery. It has a pushbutton instead of the traditional ignition key, so the key is pretty useless outside of a dead battery.
All remote unlock is doing is adding an unnecessary insecure remote layer on top of that for convenience.
I'm not convinced it is even lazy to use a phone to unlock a car.
you can argue that the security tradeoff is not worth it, but claiming the demand is not there is just silly
> So you can be just a little bit more lazy
Which:
> i can either go back inside to get the keys, or just open the car from the app
I think qualifies, personally. Your house might be way bigger than mine though
Should we get rid of washing machines, dryers, Cuisinarts, in-sink disposals, etc too? They've even killed and injured people all so people could do slightly less work.
Humans love convenience, our entire modern life is oriented around technology created to serve those motivations. An extra way to unlock something with a single point of failure is unsurprisingly going to appeal to that same instinct.
You will need an online account with obscure terms of service to use the car, won't be able to repair yourself, your data being sold, etc.
Evil.
I.e. a Wiki where you supply Make/Model/Year, receive instructions on which fuse to pull, which box to remove or disconnect.
Right now this information is so scattered across the web, disorganized, and full of errors. Sometimes buried in YouTube videos. Even LLMs cannot provide accurate info and you need to do laborious research.
Somebody make this happen.
I read comments that this may still not be ideal, as when you take it a dealer service (especially during the warranty period), all the collected data is cached locally and may eventually get uploaded to the proverbial mothership at that time. If you can/could tell it to stop collecting generally, then there's nothing to upload, antenna or not.
Not sure how valid this thinking is, but it is worth considering as a 'threat model'.
The trend might even be moving away from some types of inspections.
For example, Louisiana recently did away with its annual inspection program for all non-commercial, non-school bus vehicles (except for some emissions testing in some locations due to federal clean air act). [2]
[1] https://en.wikipedia.org/wiki/Vehicle_inspection_in_the_Unit...
Smartphone OS makers have top-notch security teams, and they are tech companies who understand how tech works extremely well. Actual Android smartphone makers (thing Samsung or Motorola) are humble enough to understand that they should just let Google do the hard parts of the OS.
Car makers are not tech (software / internet) companies, do not understand how to think about tech to be successful in tech, do not have the right mental models for cybersecurity work, but they nevertheless want to do their own software instead of getting it from a more responsible party. This is a recipe for disaster. And, just like smart TV makers, they make their money on hardware, compete on price, and aren't advertising companies themselves, which encourages shady deals with data brokers.
You realise that in the EU cars have a SIM in, and an emergency button? This is since 2018, see: 112 eCall regulation.
I've been telling people that 2006 is peak car for at least 5 years and almost everyone thinks I'm crazy but I just get more convinced ever year.
1. Enough computer control for reasonable efficiency
2. Largely independent computers
3. No centralized infotainment that controls the entire car (you can swap the radio)
4. Still lots of knobs and dials, no touchscreens
5. Enough computers to get pretty good diagnostics if/when something goes wrong
6. Most of them have lock clickers, maybe trunk, almost nothing else
7. Engines are older, built "heavily" and don't suffer from too much boost / high bearing load
I think the last one is a big one that the closer a car gets to say 2020ish the more you really have to look at how it was built to know what you're getting. It's great to have a two-stage oil pump to reduce pumping losses when an engine doesn't REALLY need 60psi of oil pressure at all times. But GM 6.2L V8s are grenading all over the place to save less than 1mpg and over 100kmi at say 18mpg vs 17mpg that's 5555 gallons of gas vs 5882 gallons or 350 gallons. Even at $5/gallon that's only $1750 in gas vs $10-$20k for a new engine and I can't imagine it's net-reduced emissions as there's absolutely a bunch of emissions encapsulated in that at least $10k price. This is just one example.
BTW I'm not advocating for any policy or that anyone should be forced to do anything. I'm just personally more excited about keeping older (fuel injected, computer controlled, efficient) cars running well than I am about spending a bunch of money on a new car that's got a lot of engine "innovation" in it where all the kinks haven't been worked out yet.
It's really an indictment of the sorry state of modern web design, where everything is punted client-side and APIs are exposed. Ooh... it's "rich" content... so what.
They didn't have these types of issues doing logic server-side in CRUD apps 20 years ago. Unauthenticated users got the boot. It was easier to secure.
Guys were doing the same shit in JSP and ASP or even Perl CGI in the 00s and these issues were nonexistent.
I figure someone out there could dump the firmware off an old OnStar module these days and have an AI RE it - we do have open-source cellular SDR stacks that could handle both the analog and digital voice calls on old vehicles.
h264 is the better choice for short progressive download clips on websites if compatibility matters.
>Firefox enables HEVC on:
>Windows from Firefox 134 using either hardware (on devices that support it, where the range is the same as Edge) or software (on Windows the user must pay for and install an extension)
>macOS from Firefox 136 using either hardware or software.
>Linux from Firefox 137 using either hardware or software (via the system ffmpeg).
>Android from Firefox 137 using hardware only.
https://developer.mozilla.org/en-US/docs/Web/Media/Guides/Fo...
...and even if this wasn't the case, FF has 2.5% market share. Using a 20 year old codec for 2.5% would be insane. If anything, he should be using a newer codec like AV1 that's also widely supported.
Surprisingly, in my experience h264 produces higher quality (better VMAF) for the same bitrate.
My theory is all the codec-optimisation attention went to h264 because of the crazy licensing situation of h265
You probably used the wrong settings. Netflix said "AV1 streaming sessions achieve VMAF scores that are 4.3 points higher than AVC and 0.9 points higher than HEVC sessions" 9 months ago: https://netflixtechblog.com/av1-now-powering-30-of-netflix-s...
I don't think that's accurate, since the first Apple processors with AV1 support only came out in late 2023 (A17 Pro, M3).
It's a one minute video, would it have been so hard to redo it.
Edit: raining downvotes, well fuck me, I guess you all prefer sloppy shit.
“Thanks for the nice write-up. Gotta admit the video still irks me. Like, portrait to landscape mid-recording… Since it was only a minute, think re-recording would be well worth it.”