Question to Ford- Why can't you give us 2FA??

[Pelican]

?

Sponsored

 

[Caperjoe]

Found a solution using Ford pass connect- happy with the results.

 

[Blueshound]

My concern is that, sometime in the future, some middle-manager with a responsibility for IT security decided to flip that switch to mandatory as a simple way to protect his own butt, and now the rest of us are saddled with having to constantly "log on" to our own vehicles, regardless of our own personal risk profile. I've seen it happen countless times from the work IT department.

That's not something that I would want to encourage as a standard "feature" on all trucks. There appear to be some aftermarket solutions that might work for you, though.

This. I don't want any solution that requires me to use my "smart" phone to start or use my truck.

 

[Caperjoe]

Then don't use it...

 

[Blueshound]

Then don't use it...

Thankfully I don't have to, since it doesn't exist. I commented specifically to the quoted post, regarding it being made mandatory because of some middle management decision. In my case, as with the quoted post, I have basically zero risk of theft. I want to get in my truck and go, not futz around with my phone.

 

[aaexpert]

Its interesting how its come full circle with car theft and our industry.
As an owner of a car audio/alarm business of 30yrs.... we went from cars with no 'microchip-keys' pre 1990's and installing a bunch of basic alarms., 2000- 2015 hardly ever sold an alarm install. Now we have Smartkeys and the thieves can easily get around it with technology in minutes and sales of alarms are back and way up in recent years. Its not just Ford with this issue (mercedes/chrysler,etc.) and now we are back to installing a variety of new tech versions of 'alarms'.
To be clear, yes anybody can steal a vehicle but adding extra layer(s) of security have proven to deter and prevent the theft in many cases.
Seems like we've come so far in tech. but we are still having to add (after the purchase) paint protections, security, etc. for vehicles that have doubled in price in just a dozen years and you'd think it'd all be resolved/better, especially for the costs.

 

[gb7FRz26]

I wonder what the truck would do if Secure Idle was enabled via FORScan, a replay attack was used to start it and put it in gear, drive off.... no key detected. I bet nothing different until the theif puts it in park.

Maybe when BlueCruise becomes useful, the camera facing the driver will eventually be used like Face ID. Would need a better sensor with laser/depth I guess. Still, another possibility in the realm of technology. "You're not the usual driver. Use the FordPass app to enable Valet mode."

 

[NYLA]

that would be HORRIBLE. i am not freakin logging in and managing passwords for a freakin truck. I already have 463 passwords I cannot remember.

I’d rather just have it stolen and replaced

 

[hotrodmex]

Found a solution using Ford pass connect- happy with the results.

Willing to share for those curious? Or would that make your solution less secure?

 

[Caperjoe]

Sure...

Two options
Option 1. Use RF blocking pouch to secure your keys and only use the phone to lock and unlock. Remove phone from pouch when starting vehicle then place back into pouch once started.

Option 2. * more secure * Remove battery from fob and only use phone to lock and unlock. Use Ford proceedure for starting vehicle with dead fob battery- place key into acess port under cupholder.

Also use a steering wheel, brake pedal lock or hidden electrical starter disconnect.

 

[GDN]

I'm not sure just how much Ford sends back to the Mothership on a daily basis through the cloud, but my gut tells me there is some sort of connected feedback on a daily basis. They need some incredibly talented network and security folks to keep all of that connectivity safe.

Many don't like the comparison's and I'm sorry, but there are very very few Tesla's stolen. First, it is hard. Second, everything about that car at all times is sent back to the mothership - that is what I know many people won't care for in the truck world. However, it prevents them from being stolen without having your hands on the physical keys.

The newer 3/Y's do not come with a fob nor key. It is a key card using NFC technology. You can use that to set up your bluetooth phone. Once in the car you can have a 4 digit pin code (been this way for close to 2 years) without that you get nothing. You don't have to activate the pin code, that is up to each user.

No system is perfect and we won't all be happy with what is chosen, but it is way beyond time that vehicle theft as we know it today be put behind us and the technology required in an EV (and likely the ICE/hybrid versions) is there for it to happen.

 

[Spidergears]

it seems like a simple solution by ford/key fob manufacturer could have been to add a hardware switch to disconnect the power On the key fob. Hmmm..wonder how hard it would be to mod a key fob….

 

[Caperjoe]

Actually there is a solution and it was entirely on Ford's end... RSA. Ford could have invested just a few dollars more in the key fobs to where they had rolling passcodes generated every minute. Ofcourse changing the fob's battery would involve exchanging a master key that would only have to be sent when exchanging new software keys but it would have provided a secure solution. I know rolling codes are nothing new but having a solution where the code changes every minute is far more secure especially if the system actually required it... even of it was for the first 3 or 4 minutes of driving.

 

[jcaspar]

Kill switch is the easy way and you would only use it when needed. I used to just pull the fuel pump fuse on my 1993 K2500. Truck would crank and crank but never start.

 

[Spidergears]

So, I thought I had found something. In the manual, it says this:

KEYLESS ENTRY LIMITATIONS​

Make sure your remote control is within 3 ft (1 m) from the front door handles and the tailgate.​

The system could not function if:​

• The remote control remains stationary for about a minute.​

• …..​

KEYLESS ENTRY SETTINGS​

Switching Keyless Entry On and Off​

1. Switch the ignition on using an original key that has not been created as a MyKey.​

2. Press Settings on the touchscreen.​

3. Press Vehicle Settings.​

4. Press Locks.​

This seemed promising. If you could prevent the relay attack by turning off the keyless entry, then you could use the buttons on the key fob to lock and unlock. Of course that has different attack vectors. Hopefully the alarm would go off if the door was opened by a thief when the keyless entry was disabled. Not perfect, but a step in the right direction.

So, I tried this on my 502a.
1. I set the key fob on a shelf close to my truck and then waited 1 minute, and 5 minutes. Both times the truck unlocked when I grabbed the handle.
2. I looked in the settings->vehicle->locks. I found no option to disable keyless entry.

Does anybody else have the option to disable keyless entry in their vehicle settings? I’m not showing any software updates and it looks like I’m on soft ware version 22012_Product and revision 321.

Sponsored