Jason English, our esteemed editor, wonders, “How many other Camrys would my remote unlock? Is it really 1:1, or is there a chance my fob would open a Camry in Phoenix or Toronto?”
When you push a button on your car remote or garage door opener, a radio transmitter inside sends a signal containing a numeric code to a receiver in the car (or in the garage). When it gets the signal, the receiver tells the car (or the garage door controls) to lock or unlock (or open or close)—or whatever it’s supposed to do given the button you pushed.
When remote garage door openers first came out in the 1950s, the transmitters in the remotes sent out a single signal. This was all well and good as long as you were the only person on your block with a garage door opener. But as they became more common, you could open any garage you wanted, because all remotes worked on the same signal. A security breakthrough came 20 years later when DIP switches—sets of eight manual electric switches packaged in a group and attached to a printed circuit board—were added. By setting the eight switches to a certain arrangement inside both the transmitter and the receiver, you had some control over the 8-bit code that they shared. The DIP switches could provide 256 possible codes. So while some security was provided, areas with lots of garage door remotes were still prone to code doubling and people opening up their neighbors’ doors.
Early remote entry systems for cars were slightly more advanced. The system for each car had a unique code set by the manufacturer and used by that car’s transmitter-receiver pair alone. The ratio really was 1:1. Just as my car lock or yours wouldn’t open for Jason’s key, our receivers wouldn’t have responded to his transmitter’s signal. These systems had their own problem: while the codes were unique to their cars, the same code was transmitted every time you used the remote. A radio transceiver called a “code grabber” could be used to intercept, store and retransmit the code later on. It was like having your key stolen and copied, without you knowing, while you were putting it in the keyhole and opening the door.
To combat the problem, manufacturers began using rolling codes (or hopping codes) in the mid-1990s. Instead of using a single fixed code, these newer systems use a set of rolling codes that change every time the remote is used. Now when you use the remote, the transmitter sends the current code to the receiver (most systems use 40-bit codes or longer, allowing for more than 1 trillion different combinations). If the receiver gets the current code, it responds; if not, it does nothing. The transmitter and receiver then “roll” the code using the same pseudorandom number generator (PRNG). When the transmitter sends the current code, it uses the PRNG to create a new code and remembers it. After receiving the current code, the receiver uses the same PRNG with the same original seed (the number that initiates the PRNG) to generate a new code. Using this method, the transmitter and the receiver generate matching sequences of codes and are synchronized (and, of course, all the information that’s transmitted is encrypted).
What if you press a button on the remote while you’re away from the car, generating a new code on the transmitter and desynchronizing the system? The receiver forgives your human error and accepts any of the next X valid codes in the code sequence (the number of “look-ahead” codes the receiver accepts varies among manufacturers). Push the button one too many times, though, and the receiver will ignore the remote and you’ll have to resync the system.
Modern remote keyless entry systems are pretty secure, but there is a slight chance Jason could open another Camry if he wants to walk up to one and press the unlock button on his remote (assuming it uses a 40-bit code) one trillion, ninety-nine billion, five hundred eleven million, six hundred twenty-seven thousand, seven hundred and seventy-six times, running through all the possible codes his remote could transmit until one works (assuming he can hit the button once every second without taking any breaks, he’ll need just shy of 34,842 years to do so). He’ll also have to hope that the Camry he’s trying to open has a receiver that uses a 40-bit like his remote, and isn’t a newer model that might use a 66-bit code with 7.3 x 1019 possible codes.
Comments (29)
Comment
- subscribe /
- give a gift /
- terms of service /
- about /
- contact us /
- write for us /
- ad info /
- subscriber services /
- press /
- privacy policy /
- rss /
© 2012 Mental Floss Inc. All Rights Reserved. Mental Floss is a registered trademark owned by Felix Dennis. mentalfloss.com is a trademark owned by Felix Dennis.
Disclaimer: All submissions made to mental_floss become the property of Mental Floss Inc and may be used without further permission by the submitter and without compensation to the submitter. If you do not agree to these terms, please do not submit anything to mental_floss.
I used my keyless entry and unlocked my doors and managed to pop open another car’s trunk parked beside me(different make model, and year) with my remote. I waited around and no one came so I closed their trunk lid.
posted by Dianna on 12-30-2009 at 10:00 am
Excellent article. My uncle works as a mechanic for a car dealership and they ended up with a remote that would somehow set off the alarm of any car of that brand you pointed it at… not sure how that worked, but it was several years ago.
posted by Heather on 12-30-2009 at 10:00 am
RE: rolling code forgiveness
So, if there is more than one remote and one is used much more often, the less used one may stop working merely because of this lack of sync?
posted by anomdebus on 12-30-2009 at 10:14 am
In the mid-90′s, if I pressed the “unlock” button on my own fob, it would set off the panic alarm on my best friend’s car every single time.
Made for some hilarious moments until he finally caught on to me.
posted by James on 12-30-2009 at 10:18 am
A friend of mine who works for the police department once told me about a very bizarre case where a jeep was reported stolen, and twenty minutes later was reported returned. A visitor to the apartment complex was borrowing his friend’s jeep, and went to the wrong one. Alarm key fob and key both worked. Jeeps were 10 years apart in age, and the person who drove off didn’t know he was in the wrong car until he got to a store with brighter parking lot lights and realized he was borrowing a blue jeep and driving a green one.
heh. Re-Captcha “Idea Blurry” oddly approriate.
posted by Stormy on 12-30-2009 at 10:38 am
That was a really interesting article. I know that by showing this to my husband, he is going to test out that forgiveness factor.
posted by Michelle on 12-30-2009 at 10:55 am
So does the new technology cancel out the “code stealers”? Every few months I get a warning e-mail about people stealing my code from the keyless entry and wondered if this article would cover it (and it did, so thanks!)
posted by OkieMelissa on 12-30-2009 at 10:57 am
I locked my car remotely at the mall once and the car across the row beeped. I was able to unlock the car and lock it again using my remote. Different make and model. I moved my car to a different spot in case they returned before I did.
posted by Jim on 12-30-2009 at 11:28 am
I left my 1998 Pontiac Sunfire at the Toronto Airport and flew to Atlanta in 2007. As we were leaving a shopping plaza, by habit I approached a red 2 door Sunfire near me and tried to open the door. Before I could realize what I was doing (with my husband laughing his ass off at me) the door opened. What are the chances of that?
posted by Amanda on 12-30-2009 at 11:41 am
anom debus wrote:
“RE: rolling code forgiveness
So, if there is more than one remote and one is used much more often, the less used one may stop working merely because of this lack of sync?”
I was wondering about that myself. I had a remote that stopped working, so I started using the spare (which I kept in a drawer and hadn’t used in years) and it worked just fine.
posted by bkreporter on 12-30-2009 at 11:55 am
I was given two fobs (I hate that word) when i purchased an ’03 Jeep Liberty. The 1st died within a few years and the 2nd picked-up without missing a beat. If the 1st was in sync with the vehicle, then how did the 2nd just start working?
posted by Clay on 12-30-2009 at 11:59 am
@bkreporter and @anom debus: the two remotes likely each have their own pairing, so using one doesn’t change the counts on the other.
posted by Andy on 12-30-2009 at 12:02 pm
I think something scarier than this is the girl from the accounting firm that was delivering paychecks to our office locked her keys in her car when it was running. She had a smaller Chevy car, I think a Cavalier, and saw that I had a Chevy Malibu and asked to use my key. She put my key in her door’s lock about halfway, gave it a pop at the other end and her door opened right up. Screw key fobs (I hate that word too, Clay!) how about just plain keys!?
Re-Captcha: “First Twosome” booyah
posted by Nate on 12-30-2009 at 12:17 pm
Key fobs are individually paired with the car. There is some limit to how many fobs a car can be sync’d with (i.e. 3 or 4?). The likely reason one remote stopped working and the old one still worked is the battery of the first was worn out, but the unused fob was still good. The same is true of rolling code garage door openers. There is usually some pairing button on the motor and if you hold it down it will clear all known remotes. This is used if you lose a remote. You must then re-sync each remote and keypad that you still want to use.
Brian
posted by Brian on 12-30-2009 at 12:19 pm
Great article! Thanks for an interesting read!
posted by Moth on 12-30-2009 at 12:21 pm
On a slightly different note, my mom once unlocked the door of a car parked next to hers at the grocery store. Same make and model, and the door lock key worked. She got in and tried to start the car before she realized it wasn’t her car! The ignition key did not work.
posted by Jaime on 12-30-2009 at 12:49 pm
Roughly a year ago, I was in the campus lot trying to find my truck using my remote. I noticed quite quickly that this white car beeped everytime I locked/unlocked when I used my remote. I didn’t catch the make or model at the time.
After reading this article, I was confused about how this was possible, because our prng should not have synced up after that initial use, however I am using a third party remote made by Viper. Might these use a different type of system than what is written about in the article?
posted by Robert on 12-30-2009 at 1:04 pm
Many years ago my mom went out to her Olds 442 and when she turned the key it didn’t feel right. Concerned it might break, she drove straight to the hardware store and had three copies made. When she got home in her Olds 442, she discovered that she had made copies of the key to her (older) Studebaker Lark. The key from her old Lark worked in her newer 442. And that story just makes me wish I still had her Lark. What a great car!
posted by Hyacinth on 12-30-2009 at 1:40 pm
Before I bought my own car, I used to drive my parent’s red 2001 Kia Rio. It doesn’t have power locks, just good ol’ manual locks. I drove it to Wal-Mart with the boyfriend one night. I got back to the parking lot and managed to unlock another red 2001 Kia Rio. When I sat in the drivers seat I noticed I was not in the right car. I sort of closed the doors and booked it to the right car.
posted by Courtney on 12-30-2009 at 2:34 pm
When there are multiple remotes used the car or garage door opener will keep track of both sequences. My understanding of rolling codes is that it will block the last x codes from being used again rather than only allowing the next x codes to be used. This fixes the problem of pressing the button too many times and also the problem of loosing sync when a battery is replaced.
posted by Steve M. on 12-30-2009 at 3:08 pm
anomdebus and bkreporter,
Brian and Steve M. have got it. When you’ve got more than one remote, the reciever can keep track of the different code sequences.
For everyone wondering how/why they’ve managed to open others’ cars with their remotes (even different makes), we’ll cover that in a post next month.
posted by Matt Soniak on 12-30-2009 at 3:46 pm
Hyacinth, you can keep the Lark…I’ll take the 442.
posted by Dave on 12-30-2009 at 4:06 pm
I once unlocked the wrong 2001 Toyota Avalon with my GF’s keyfob. I was distracted and walked to the wrong car that was the same exterior color. I found a list on the drivers seat and thought \what does she have this list for?\ I put the list in the center console and sat down, but the seat was set too close to the steering wheel for me. I then noticed that the upholstery was the wrong color and deduced it was the wrong car. Our car was about 15 feet away. The keyfob worked on both cars at the same time. I always wondered if the owner of the other car noticed that his/her list was moved.
posted by dogfriend on 12-30-2009 at 9:05 pm
Leaving the mall once with my mom, we got into her maroon mustang with grey interior. After letting the car warm up, she noticed that she couldn’t find certain things she had in the car. Then she looked – this isn’t my car! Both her car, and the stranger’s car were kept with minimal accessories inside, so it took a while to notice. Her door key and her engine key worked the other car, the same spot but one aisle over. Pretty sure she went and had the dealer install new locks lol.
I have a friend in real estate, her son got the box of garage remotes and drove through housing developments opening random garage doors. (when people were home, not looking to cause theft).
lol recaptcha: gloomy caravans. As in, The Dodge Caravans were gloomy when they had their codes captured.
posted by Sharon on 12-31-2009 at 10:28 am
Fascinating! I actually have thought about this a lot, but never taken the time to try and research it. Which is precisely why I love the _floss!
posted by Roger on 12-31-2009 at 11:21 am
The only thing I learned about car door remotes is that they do not work when the car is running….I was getting ready to take a trip back in 1997 in my (new) Nissan, and decided to warm up the car first. Didn’t want it to be stolen, though, so I locked the doors and took the remote with me.
But it wouldn’t UNlock the doors! What a fiasco!
posted by Logan on 12-31-2009 at 3:58 pm
For some reason the fob to my mom’s ’04 Trailblazer would lock the doors on my ’97 Sentra, no matter which button was pushed! I had to be very careful about leaving my keys in the car when I went over there. Lucky I know a locksmith– he visited me SEVERAL times before we finally caught on to the problem!
posted by LadyBugg on 1-2-2010 at 11:17 am
@ Stormy My grandfather had two vehicles that were different makes and models. The same key worked for both of them and we found it kind of odd. I guess the odds of having keys and remotes that work for more than one are greater than we thought.
posted by Heather on 1-3-2010 at 2:52 pm
It seems so many people have had experiences unlocking others’ doors. Imagine how many times we’ve pushed the button and NOT noticed some car unlock across the parking lot.
As for me, my 98 Pathfinder remote twinkles the neighbor’s Chrysler 300 headlights. Not too exciting.
posted by Mateo Jose on 7-8-2010 at 6:06 pm