Item — HN Reader

The Haruhi problem reminds me of De Bruijn sequences, aka why I don't trust 5 button keyless car entry systems. Fords keypads do not have return keys, delays, or attempt limits. A 3125 button sequence can guarantee you will unlock the door. It would take about 10-20 minutes for someone who has practiced to break in. Someone this year made a bot that did it in about 5 minutes.

https://en.wikipedia.org/wiki/De_Bruijn_sequence

https://hackaday.com/2018/06/18/opening-a-ford-with-a-robot-...

4 comments

Two problems with this plan though:

1) Even when you succeed you can't start the car.

2) Even given the best case scenario you end up with a Ford.

"de Bruijin sequence is a similar problem, but this problem has the additional constraint of being non-cyclical." [1]

[1] http://mathsci.wikia.com/wiki/Talk:The_Haruhi_Problem/@comme...

Additionally de bruijin sequences are about generating all possible n-length strings from a fixed k-character set (where you can repeat characters). In this problem we only want to generate k-length permutations of a k-character set.

You're worried about someone standing next to your car for 10-20 minutes pushing buttons and not messing up a 3125 number combo on a keypad with almost no tactile feedback?

Surely a rock or other heavy blunt object would be more effective.

The comment you're replying to contains:

> Someone this year made a bot that did it in about 5 minutes.

It's also the case that it's plausible one can interrupt & resume the sequence (at the cost of 4 extra button presses per interruption).

So you are saying that keypad entry systems are vulnerable to meth addled mathematicians?

https://www.reddit.com/r/math/comments/1jyp0a/how_much_amphe...

Sure, but it's kind of silly. There are far, far simpler ways to get into a car than bringing a robot with you.

Do they give you on-going [presumably] secret access?

Yeah, this is nowhere near as bad as the proximity remote attacks where a simple amplifier is enough to trigger the key to open the door - or even to drive away with the car if you do a bit more serious engineering.

If you read down in the comment thread on the Hackaday article, they make it clear that Fords after about 2002~2003 have an attempt limit. I happen to know that my '05 did, at a bare minimum. It's still deeply not secure, but nothing about a car really is... It's intended to make my life convenient and keep the honest people honest.