Multi-factor auth

[mkhuffman]

The vehicle is susceptible to replay attacks at home as well. Often, home is where you are targeted, and I feel MFD would be more useful there than anywhere else.

I usually park inside my garage, so I feel it's very safe to disable MFA when parked there. I think making it an option is a good idea. Although it's not hard to do at home also.

Sponsored

 

[iansriv]

I’m replying to your post from your S right now

While you're in there, can you get the credit card I dropped down the side of the driver's seat?

 

[iansriv]

The vehicle is susceptible to replay attacks at home as well. Often, home is where you are targeted, and I feel MFD would be more useful there than anywhere else.

That's when my friends (Smith and Wesson) come in handy.

 

[COdogman]

While you're in there, can you get the credit card I dropped down the side of the driver's seat?

You know damned well that is gone forever.

 

[godfodder0901]

That's when my friends (Smith and Wesson) come in handy.

I'm friends with them as well. The problem is that it'll happen silently, at night, when they aren't around.

 

[iansriv]

I'm friends with them as well. The problem is that it'll happen silently, at night, when they aren't around.

Yes, it will happen silently (obsidian).

 

[bigsky]

As I have said already, I finally got to try out this new Rivian MFA update. Invariably, it went like this:
I use PAAK (a great blessing); approach my R1S, doors unlock, get in, tap of the brake pedal, and that's when all the good stuff ends. The R1S display prompts me to check my phone!
Seriously, Rivian!?

So now forget PAAK; must fumble in my pockets looking for my phone, find it, pull it out, unlock it, launch RIvian app, find the "let's go" screen, tap on it, my R1S is ready. Now put phone back in pocket or somewhere else. Time and again, the thought crossed my mind, what if I lose my phone; what if the phone goes dead!?

Never taken for granted, this Rivian MFA has made me appreciate so much more how Tesla, however imperfect still might be, has brilliantly, simply, and easily implemented PIN to drive. Tap on brake pedal, keypad appears on display, enter PIN, my glorious Tesla gets unlocked, off I go, ready. No phone, nothing else needed but the awesome tech built into my Tesla.

Summarizing: Rivian, RIvian engineers, what were you eating or smoking when you dreamed up this MFA aberration?
What on god's earth possessed you to come up with such a stupid, absurd, and actually dangerous MFA implementation (lose your phone?)
Not only is this MFA implementation such a stupid absurdity, it also at best partially defeats PAAK use as well. It makes those of us who appreciate and are thankful for the PAAK feature feel as if we have gone back in time and started (involuntarily) using that other stupid, relic, ICE-age anti-EV absurdity called the key fob.

C'mon, Rivian, do this right. LEARN FROM TESLA about getting PIN to drive done right!
See how Tesla does it on the vehicle display screen.

 

[VandalSibs]

As I have said already, I finally got to try out this new Rivian MFA update. Invariably, it went like this:
I use PAAK (a great blessing); approach my R1S, doors unlock, get in, tap of the brake pedal, and that's when all the good stuff ends. The R1S display prompts me to check my phone!
Seriously, Rivian!?

So now forget PAAK; must fumble in my pockets looking for my phone, find it, pull it out, unlock it, launch RIvian app, find the "let's go" screen, tap on it, my R1S is ready. Now put phone back in pocket or somewhere else. Time and again, the thought crossed my mind, what if I lose my phone; what if the phone goes dead!?

Never taken for granted, this Rivian MFA has made me appreciate so much more how Tesla, however imperfect still might be, has brilliantly, simply, and easily implemented PIN to drive. Tap on brake pedal, keypad appears on display, enter PIN, my glorious Tesla gets unlocked, off I go, ready. No phone, nothing else needed but the awesome tech built into my Tesla.

Summarizing: Rivian, RIvian engineers, what were you eating or smoking when you dreamed up this MFA aberration?
What on god's earth possessed you to come up with such a stupid, absurd, and actually dangerous MFA implementation (lose your phone?)
Not only is this MFA implementation such a stupid absurdity, it also at best partially defeats PAAK use as well. It makes those of us who appreciate and are thankful for the PAAK feature feel as if we have gone back in time and started (involuntarily) using that other stupid, relic, ICE-age anti-EV absurdity called the key fob.

C'mon, Rivian, do this right. LEARN FROM TESLA about getting PIN to drive done right!
See how Tesla does it on the vehicle display screen.

It has been mentioned in this thread many times - more security means more inconvenience. Having to take your phone out and do something to prove it's you is the point of multi-factor authentication. It's just like logging into my computer at work - I have to have my phone out to tap a button to prove it's me logging in.

Can the notification flow and speed of the phone app be improved to make this a little less inconvenient? Absolutely! But in the end, enabling MFA - or MFD in this case - means you will be doing more before you can shift into gear. It's the nature of the beast.

 

[bigsky]

It has been mentioned in this thread many times - more security means more inconvenience. Having to take your phone out and do something to prove it's you is the point of multi-factor authentication. It's just like logging into my computer at work - I have to have my phone out to tap a button to prove it's me logging in.

Can the notification flow and speed of the phone app be improved to make this a little less inconvenient? Absolutely! But in the end, enabling MFA - or MFD in this case - means you will be doing more before you can shift into gear. It's the nature of the beast.

Well, Tesla apparently did not get the nature-of-the-beast memo and did it right. Just as secure, WYSIWYG, enter PIN on keypad that pops up on display, done. No phone needed. Truly keep it simple, stupid. But hell, no. Not Rivian.

A computer is different, however capricious and arbitrary it is to change password in corporate America every 90 days notwithstanding.

 

[runwithscissors]

I think Rivian engineers will not be surprised when they check the telemetry to find out very few will ever use this feature.

 

[bigsky]

In the current, dumb implementation, god forbid you lose your phone or else; ergo, think three times before enabling it. Then think again.

 

[godfodder0901]

Just as secure

No, it most certainly is not.

 

[mkhuffman]

In the current, dumb implementation, god forbid you lose your phone or else; ergo, think three times before enabling it. Then think again.

I happen to like it. And it is more secure than a PIN.

Does Tesla scramble the numbers used for the pin so you are not always touching the same spots on the screen to activate the car? Is the PIN more than four digits? A scrambled number pad would make it harder for a thief to figure out the pin by scanning the display for where you touch it every time, but that would make entering the PIN more of a PIA. A 20 digit PIN is more secure than a 4 digit PIN, but entering that would be a huge PIA.

And MFA is more secure than a 20 character PIN entered on a scrambled number pad. And much, much easier to use.

 

[bigsky]

I happen to like it. And it is more secure than a PIN.

Does Tesla scramble the numbers used for the pin so you are not always touching the same spots on the screen to activate the car? Is the PIN more than four digits? A scrambled number pad would make it harder for a thief to figure out the pin by scanning the display for where you touch it every time, but that would make entering the PIN more of a PIA. A 20 digit PIN is more secure than a 4 digit PIN, but entering that would be a huge PIA.

And MFA is more secure than a 20 character PIN entered on a scrambled number pad. And much, much easier to use.

PIN keypad moves around the screen. It is not fixed. The PIN is one you create and remember. That said, the objective of any half decent security measure is to make it harder for a thief. e.g., spend more time trying to steal the car.

An MFA may be more secure, but the thought alone of one losing a phone, or having the phone stolen, or having the phone hijacked. You will be 100% SOL, and probably good luck driving your Rivian.
A 4 digit PIN is secure enough. Sure, it may not be the best choice, but at the end of the day, should I lose my cell phone, or have it stolen, or have it die on me, I still can get into my Tesla, punch in the PIN and drive off. That to me is the terrifying, what-the-f-were-you-thinking-Rivian to link your phone to the security of your car. You had better not lose that phone. It is a harebrained implementation. Rivians arguably have much faster computers than my Teslas, yet my Teslas beat the crap out of Rivian in software integration and brains to do the right thing, e.g., rely on the vehicle tech itself for security. Completely self-supported.

That's my point, and the reason why I think that any reasonable person with the most basic knowledge of security may conclude that only a devout Rivian fanboy can possibly argue that Rivian MFA is even okay. It absolutely is not!! Dangerous!

 

[Robin]

I just called Rivian, they said they’ll trade you your truck for a 2002 Camry with an actual key and zero software updates. Win-win?

🛻

Sponsored