Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

Bluetooth phone as key is coming to Model S and Model X

This site may earn commission on affiliate links.
No insult intended. RFID is actually a powered chip transmitting data, just using wireless power rather than battery. It can encrypt or not (as can BT or wifi). As for distance, that also varies. Some require few cm, but others can be read meters away.

Perhaps something new???

This is a description of how the ones we use on Automated Lines etc work, found on another site.

RFID tags are considered “dumb” devices, in that they can only listen and respond, no
matter who sends the request signal. This brings up risks of unauthorised access and
modification of tag data. In other words, unprotected tags may be vulnerable to
eavesdropping, traffic analysis, spoofing or denial of service attacks.
Eavesdropping (or Skimming)
Radio signals transmitted from the tag, and the reader, can be detected several metres
away by other radio receivers. It is possible therefore for an unauthorised user to gain
access to the data contained in RFID tags if legitimate transmissions are not properly
protected. Any person who has their own RFID reader may interrogate tags lacking
adequate access controls, and eavesdrop on tag contents.
 
Perhaps something new???

This is a description of how the ones we use on Automated Lines etc work, found on another site.

RFID tags are considered “dumb” devices, in that they can only listen and respond, no
matter who sends the request signal. This brings up risks of unauthorised access and
modification of tag data. In other words, unprotected tags may be vulnerable to
eavesdropping, traffic analysis, spoofing or denial of service attacks.
Eavesdropping (or Skimming)
Radio signals transmitted from the tag, and the reader, can be detected several metres
away by other radio receivers. It is possible therefore for an unauthorised user to gain
access to the data contained in RFID tags if legitimate transmissions are not properly
protected. Any person who has their own RFID reader may interrogate tags lacking
adequate access controls, and eavesdrop on tag contents.
Yes, there exist advanced RFID devices. I don't have a model 3, but doesn't isn't the model 3 key card an RFID (no battery)? And yet it serves as a key for the car. I would guess they don't use a dumb RDIF there which can be evesdropped/cloned from meters away.
 
I don't know in particular how the M3 card works, but RIFD cards can actually be smart cards (they are actually called contactless smart cards), powered by an induction coil that gets excited when close to an electromagnetic field (generated by the reader) instead of internal power.

The chip embedded in the smart card can contain secure enclaves for keys and algorithms (i.e. encryption algorithms). You cannot extract the key directly from the secure enclave, but you can "challenge" the card by sending it some random data. The card will use the encryption algorithm and the stored key to encrypt the challenge and will send it back to the reader/challenger. The reader, who also knows the key, can verify that the data was indeed encrypted with the correct key and conclude that it is talking to a legitimate key-card. Optionally, the reader may also generate and send a signed random sequence so that the key can also verify that it is communicating with a legitimate reader/challenger.

This is only one way to do it, one that would be open to brute force attacks, since an adversary can actually listen to the challenge and the response. Of course, the adversary would need to know the encryption algorithm used to generate the challenge response. By the way, nowadays, it is considered a good practice to keep the key secure and not to obfuscate the encryption algorithms. Peer-reviewed algorithms are less prone to vulnerabilities.

There are of course other ways to do this. This is just an example.
 
Just carry the key without battery, and follow the "dead battery" procedure when you need to use the key as backup.

Not sure about newer cars, but this definitely didn't work on my 2013 Model S. I think the "dead battery" procedure was really just a "low battery" procedure that had you place the fob closer to the receiving antenna where a weak battery could still transmit. I tried removing my fob's battery and I could not open the car from the outside placing it in the designated spot by the wipers nor could I start the car with it inside by the cupholders. Will have to try this on my 2018 Model X to see if it's still the case.
 
  • Like
Reactions: cpsss and JohnnyG
Not sure about newer cars, but this definitely didn't work on my 2013 Model S. I think the "dead battery" procedure was really just a "low battery" procedure that had you place the fob closer to the receiving antenna where a weak battery could still transmit. I tried removing my fob's battery and I could not open the car from the outside placing it in the designated spot by the wipers nor could I start the car with it inside by the cupholders. Will have to try this on my 2018 Model X to see if it's still the case.
It should work. Did you try opening passenger door?
 
It should work. Did you try opening passenger door?

Yes. I tried for some time on all the doors, moving the keyfob, turning it over etc. No dice.

Later, I unlocked the car with my other fob, then moved it out of range. Using the battery-less fob, I tried to start the car by placing it in the designated spot, moving it about etc. and only got "Key not Inside" errors and the car would not "start".

This exercise convinced me there is no RFID capability in the fob, and that these designated spots are simply to enhance reception from a fob with a weak battery by placing it close to the receiving antennae.

As I say, this was an early 2013 Model S. Haven't tried this exercise on my new Mode X yet.
 
  • Like
Reactions: JohnnyG
Yes. I tried for some time on all the doors, moving the keyfob, turning it over etc. No dice.

Later, I unlocked the car with my other fob, then moved it out of range. Using the battery-less fob, I tried to start the car by placing it in the designated spot, moving it about etc. and only got "Key not Inside" errors and the car would not "start".

This exercise convinced me there is no RFID capability in the fob, and that these designated spots are simply to enhance reception from a fob with a weak battery by placing it close to the receiving antennae.

As I say, this was an early 2013 Model S. Haven't tried this exercise on my new Mode X yet.

It worked on my 2014 Model S so it might be true that some older cars didn't have RFID.
However haven't seen such complaints here on TMC... And the manual seems to be the same.
 
I think this is a great feature for some people including myself.

I have to pass in front of my car when I bring some trash to the storage area, or getting out of home to west. That will always wake my car if I'm not careful. With Bluetooth, I can turn it off on my phone when passing by, so the car keeps sleeping!
 
It worked on my 2014 Model S so it might be true that some older cars didn't have RFID.
However haven't seen such complaints here on TMC... And the manual seems to be the same.

It could very well be that the fob I tested was defective. I didn't try removing the battery and repeating with my other fob, so you never know. I did run into a situation where my fob's battery got so low that I couldn't use it unless I did place it in those areas. In that case, an otherwise useless fob with a very weak battery DID work using the prescribed locations.
 
  • Informative
Reactions: hiroshiy
Are you sure about this? It didn't work on my 2017 S, and the SC guy says I can't unlock with a completely dead battery. Maybe I shall test again.

This was my understanding as well. i.e. a weak battery in the designated spots will work, but not with a dead or no battery. Many have disputed saying there is some sort of RFID tag in the fob, so who knows. Must try this on my new Model X to see what I get.
 
Okay, I just went outside and tried this... Interesting results...

First, my setup:
A. 2015 Model S with AP1. Configured for Auto-folding mirrors, Auto-presenting handles, Auto-lock on walk away.
B. Car was in garage, locked, mirrors folded, handles in.
C. I was in the house (approximately 30 feet away).

Second, my actions:
1. Removed battery from fob. Pressed all buttons multiple times to drain residual energy.
2. Walked into garage from behind car, pressing buttons. Nothing happened.
3. Walked around car, from the back, to the driver's side, around front, to the passenger's side, pressing each handle. Nothing happened.
4. Placed the fob on the windshield, just above the passenger wiper blade, and the mirrors folded out, handles presented, lights came on. Note that I did not press any buttons or handles.
4a. My assumption is that the car was executing the normal presence detect as if I walked up to the car.
5. I got in the car, pressed the brake pedal, got the warning about no key in car.
6. While still holding the brake pedal, I positioned the fob under the 12V outlet and the car started.
7. I then pressed the lock icon on the screen, got out of the car, and closed the door.
7a. The handles retracted, but the mirrors did not fold in. The car was locked.
8. I then walked back around the car checking all handles. The car was locked.
9. I then went back to the windshield with the fob, but no matter where I placed it, the car would not unlock.
9a. I did try to push on the handle the whole time I was trying to find a spot which would unlock the car.
10. I used my phone to unlock the car, I got in, pressed the brake pedal, got the warning about no key in car.
11. While still holding the brake pedal, I positioned the fob under the 12V outlet and the car started.
12. This time I put the car in "D" and then back to "P". I hit the lock icon, and got out and closed the door.
12a. Again, I could not use the fob to get back in the car.
13. I went and put the battery back in the fob and used it to fully lock the car, which also folded-in the mirrors.
14. I took the battery back out and went to try again. It did not do it automatically, like it did the first time.
14a. I had to keep moving it around while pressing the handle, but finally did get it to unlock.

Moral of the story... it's finicky, but does appear to work with some persistence.
 
  • Helpful
Reactions: Lex
Are you sure about this? It didn't work on my 2017 S, and the SC guy says I can't unlock with a completely dead battery. Maybe I shall test again.
Yes, I'm sure that was at least my experience. I also tested with the battery out.

Okay, I just went outside and tried this... Interesting results...

First, my setup:
A. 2015 Model S with AP1. Configured for Auto-folding mirrors, Auto-presenting handles, Auto-lock on walk away.
B. Car was in garage, locked, mirrors folded, handles in.
C. I was in the house (approximately 30 feet away).

Second, my actions:
1. Removed battery from fob. Pressed all buttons multiple times to drain residual energy.
2. Walked into garage from behind car, pressing buttons. Nothing happened.
3. Walked around car, from the back, to the driver's side, around front, to the passenger's side, pressing each handle. Nothing happened.
4. Placed the fob on the windshield, just above the passenger wiper blade, and the mirrors folded out, handles presented, lights came on. Note that I did not press any buttons or handles.
4a. My assumption is that the car was executing the normal presence detect as if I walked up to the car.
5. I got in the car, pressed the brake pedal, got the warning about no key in car.
6. While still holding the brake pedal, I positioned the fob under the 12V outlet and the car started.
7. I then pressed the lock icon on the screen, got out of the car, and closed the door.
7a. The handles retracted, but the mirrors did not fold in. The car was locked.
8. I then walked back around the car checking all handles. The car was locked.
9. I then went back to the windshield with the fob, but no matter where I placed it, the car would not unlock.
9a. I did try to push on the handle the whole time I was trying to find a spot which would unlock the car.
10. I used my phone to unlock the car, I got in, pressed the brake pedal, got the warning about no key in car.
11. While still holding the brake pedal, I positioned the fob under the 12V outlet and the car started.
12. This time I put the car in "D" and then back to "P". I hit the lock icon, and got out and closed the door.
12a. Again, I could not use the fob to get back in the car.
13. I went and put the battery back in the fob and used it to fully lock the car, which also folded-in the mirrors.
14. I took the battery back out and went to try again. It did not do it automatically, like it did the first time.
14a. I had to keep moving it around while pressing the handle, but finally did get it to unlock.

Moral of the story... it's finicky, but does appear to work with some persistence.
Did you press "passenger" door handle?