Over the past few years, it’s become obvious that modern cars are almost comically insecure. Some vehicles made within the past decade shipped to America without immobilizers, and even the cars with modern security systems can be stolen by amplifying a proximity key fob signal. It makes you wonder, with everything from banking apps to social media platforms offering two-factor authentication, why haven’t cars taken up the gauntlet? Well, some cars actually have in the past, and BMW was doing security with two-factor authentication as far ago as the ’80s.
As the name suggests, two-factor authentication requires two methods of verification, and in the case of physical objects, that often involves something you have and something you know. Like how secure facilities often use fobs and passcodes for certain doors, and you’re on the right track.
In the days before chip-in-key immobilizers, keys themselves were a low-tech anti-theft method. Unless a thief was able to hotwire a car or the ignition barrel was worn enough that anything long and thin could turn it, the theory was that a regular key would deter the easiest crimes of opportunity. However, what if someone had a copy of the key to an ’80s BMW? That’s where the onboard computer’s ‘CODE’ button comes in.
As you can see from this scan of the owner’s manual for a 1988 BMW 6 Series, in addition to telling you how far you should be able to drive on the fuel in the tank and what your average fuel economy’s been, the 13-button onboard computer also had an immobilizer function that worked on top of the key. Essentially, you could set a four-digit code in the computer that, if not entered upon powering the 12-volt electrics on, wouldn’t allow the car to start even if you turned the key all the way in the ignition. Mind you, the system was a bit fiddly to use as it had to be manually activated when you wanted to use it. As the owner’s manual states:
To start the car or cancel the code, turn ignition key to position 1 or 2. The display will show code and 4 flashing segments. Input the code. The correct code will be automatically cancelled by starting the engine or pressing the SET-RES button.
While this immobilizer likely would’ve been more effective if it would set automatically upon engine shut-down, it’s still not a bad idea. Here’s a quick video from YouTuber user Vl T88 of how it worked on an E30 3 Series.
While certainly not perfect, this crude form of two-factor authentication is a sound feature in theory that worked well enough for the time it existed that BMW put it on models like the E28 5 Series, E30 3 Series, E34 5 Series, and E36 3 Series. In the ’90s, passive immobilization rendered it obsolete at the time, but it might be a good idea to bring the code function back with some tweaks given how the car theft game has changed in the era of proximity fobs. In fact, some companies are taking a leaf out of this book and improving the recipe.
This is the Autowatch Ghost II immobilizer, which has grown popular in places where car theft is a big issue. Once fitted, it requires drivers to hit a certain sequence of buttons in order to start a car. While not hugely different in concept to BMW’s old security code system, it operates on top of the factory immobilizer and doesn’t require manual arming, adding an extra factor against relay attacks and key cloning.
On a slightly different note, the Genesis GV60 lets its owner unlock it with facial recognition and start it with their fingerprint. All the biometric data is kept local to the vehicle, and although this system sounds neat, it also requires a bunch of extra parts. Meanwhile, just about every new car has an infotainment screen, and software is relatively cheap compared to hardware, so why aren’t more automakers offering PIN protection for their cars? It was a good idea for BMW in the ’80s, and when used on top of existing passive immobilizers and armed automatically, it might be a good idea today.
Top graphic images: YouTube/Vl T88; Bring A Trailer
Support our mission of championing car culture by becoming an Official Autopian Member.
-
Here’s How Stolen American Cars Reportedly End Up Overseas
-
Canada’s Car Theft Problem Is So Huge, Its Justice Minister Had His Government Car Stolen Three Times In Three Years
-
These Are The Most Stolen Vehicles In America
-
You Could Steal This Car By Flipping Over The Hazard Light Switch
-
Alleged Car Thief Has To Ask Corvette Owner For Help After Getting Trapped In The Car He’s Trying To Steal
Please send tips about cool car things to tips@theautopian.com. You could even win a prize!
It was the 80’s… lots of movies existed where kids stole Dad’s cool car while they were out of town (or at work). This would prevent that.
He doesn’t drive it. He just polishes it with a diaper!
Just as long as I don’t have to pull out a stupid phone app every time I want to start my car.
I work in tech so intellectually I understand the value of 2FA systems, but man do I hate them with a passion.
This seems smart – but in reality, it could be very annoying for those of us who sometimes valet park, have our cars serviced by other people, have other people wash our cars, have other people drive us home after a drinking binge, etc.
I got nothing to add to this other than salute to the author’s comment on how damn good the e24 M6 looks! That said, I might be a tad prejudiced on that topic.
That stupid CODE feature has stranded quite a few older BMW’s and cost people quite a bit of money when shops would mistakenly replace the starter/ECU/ignition switch trying to get the car to start. That and General Modules failing which can also cause a no-start.
God no. Toyota/Lexus has a PIN that just locks out the infotainment screen, like for a valet, except it also asks for the PIN randomly without you ever hitting lock. It the biggest pain in the ass. And you have to set-up the PIN, otherwise you basically can’t use the screen at all.
MagnaVolt… the final word in auto security. No embarrassing alarm noise, no need to bother the police and it won’t even run down your battery!
I once had an E28 1984 533i. The computer was pretty cool for the limited functions. I remember using the computer for a number of things, but I either never knew, never used, or forgot the immobilizer function.
The bank of buttons and old-school red LEDs in the headliner gave an aircraft-cockpit vibe to the interior, even though the computer was basically a pocket calculator grafted onto a car with complicated electronics. The hardest problem I ever had to diagnose with it was a bad ground that caused all sports of sensor-related odd behavior, like a persistent surge from 750 to 2500 rpm and back in idle.
The problem was finally solved with cleaning a corroded ground and plenty of conductive grease. Cheap fix, but it took $400 worth of technician time with a multimeter to find the bad grounding point.
There is an aftermarket product called a Tazer for at least Jeep Wrangler and Gladiator that can enable this function.
It should actually Taze the driver if they don’t enter the right code.
THAT would be a security feature!
In a secure atuomotive network the infotainment system should have no direct communication with the networks responsible for vehicle operation, specificly powertrain and safety. Leaning on the infotainement system for immobolization gives that system a direct network path to the engine, and could allow a malfunctioning infotainment system to affect the vehicle while in use. Worse case scenario is android crashes and your engine dies on the freeway.
This is gorss oversimplication brought to you by the This is Why We Can’t have Nice Things Department TM.
I am surprised no one has immobilized vehicles that hasn’t pay their note putting debit/credit card details to continue lol don’t read this GM Financial.
I don’t recall the specifics, but I remeber at least one BHPH lot was doing this. Day late on your weekly payment, vehicle shuts down and won’t start.
Buy here pay here lots definetly do that. They also put gps trackers on the cars and have extra keys.
They absolutely can do this through the OBD port.
The problem with a pin based anti-theft system is emergencies.
For cars with total keyless systems, where a driver won’t touch the key fob to enter and start the car, requiring a pin may break the process during an emergency where such driver is stressed for some other reason.
Even adding a panic button in the key fob, where the car would understand that there is an emergency and no pin is required, won’t help that much because of the way the driver is used to unlock and drive.
And probably that are better ways to implement anti-theft systems with the amount of computation power included in today’s cars.
“anti-heft”…as in against the weight, heaviness, bulk. Does that mean BMW found a way to make its cars fly like Doc’s DeLorean?
Oh yes Colin Chapman was a pioneer and anti-heft with his work at Lotus
Immobilization too, as I recall.
Many larger buses are not started with a key anymore and usually started with a 4 digit code entered in a keypad now.
And don’t let the simplicity of the BMW OBC fool you… that thing was a HUGE deal back in the day. It was the first onboard computer in a car and their brochures and manuals all touted how advanced it was. They also have the Check Control panels in 5, 6, and 7 series cars which informed the driver of an issue by illuminating a red light in a panel in the cabin. You also were supposed to put the “test” button every time the car was started to make sure no warning lights were burnt out.
The 80s era BMWs were great cars. They were reliable and easy to work on. We would always joke that the most common failure on high mileage BMWs was the failure warning panel itself.
I’m going to find out if that’s still the case… after a 20 or so year hiatus from my life of owning 1980s BMWs (I owned an E23 745i for a while) I just bought another E23 745i, except this one doesn’t run and has been off the road…. for 19 years.
“even the cars with modern security systems can be stolen by amplifying a proximity key fob signal”
Only in cars with push to start. In cars started by regular keys you do get two factor authentication; the RFID signal and the physical key.
Fun fact if you’re old enough – in the pilot of the orginal Magnum PI, Higgins secretly had one of these installed in the Ferrari to thwart
Magnum’s amphibious assault security check on the estate.
Magnum guesses the code and makes it through the front gate just in time to set up the famous credits scene where he fishtails the car onto the road. Tell me you can’t hear the chorus in your head right now…
I tried to get the theme music into my head, but I just realized it’s actually CHiPs that’s currently playing.
Then for you, the scene where the theme music begins is from *its* pilot, as they merge back on the freeway via the cloverleaf after losing the exotic car thieves they were chasing!
I know that scene! I think it was featured on this site recently, maybe?
What’s really freaky is when you watch the DVD/Blu-Ray and you learn there was a different song for the first 12 or 13 episodes before they introduced the iconic theme music.
Watching it in syndication in the 90s, pre internet, I used to wonder why the closing credits had different music sometimes – turns out when they retrofit the familiar opening tune to the older episodes’ opening in reruns, they didn’t bother fixing the credits too.
FWIW, the orginal isn’t too bad I think – very 70s – but yeah, it pales in comparison to the one we all love.
Yeah, I recently went back to watch them, and I was (un)pleasantly surprised. I feel like it was a whole different show, better, and more timeless, once the theme song was updated.
edit: And now the song is stuck in my head.
This wasn’t stopped when BMW included immobilizers. The e38 and e39 had a code option as well, even though their keys had immobilizer chips in them. I don’t know if the e36 has an immobilizer, I always understood that it did. Either way, I never set the code as I am super afraid of setting it incorrectly and not getting it unlocked.
I had a couple of rusty early ’80s Subarus. No anti-theft needed.
I think most people don’t want to put up with the hassle of multi factor authentication (MFA). They have insurance that covers theft. If the actuarial data shows that MFA is effective, then insurance companies should offer discounts if your vehicle uses it.
From what I remeber back in the mid aughts I did get a discont on my insurance for my Scion tC because of it’s OEM security, but now that most vehicles have them it’s the ones that don’t have them that get higher rates.
My 2005 MDX has codes for radio and info screen needed after battery loss. Key is coded as well.
I had one Ford with the old keypad, was great when going biking…
My wife’s ’01 Mitsubishi Galant stereo had a 4-digit code that needed to be put in after it lost battery power for a while. The original didn’t have a clock (??), so when I replaced it with a different OE stereo that had one, I had to call a dealer to get the code.
I always wondered, who the hell was going around stealing shitty stock Mitsubishi CD players?
That’s been the case for Honda since the 90s too.
Volvo also used the 4 digit code thing.
Yes, I pulled the head unit out and wrote the four digit code on it with sharpie because I got tired of trying to find it in the filing cabinet
The “code” system is pretty common on construction equipment and boats too, which often use a fairly generic key you can literally just buy online (or a limited number of variations). If theft is a concern you can optionally set a code also. Although in my experience, this is very rarely done, since even the couple seconds to type the code in most people find annoying enough to not bother with.
When I worked at a marina we had a set of “shop keys”, a ring with like 10 or 12 keys on it, one of them would start probably 99% of boats.
We also had a “dashboard in a box”, in the event we didn’t have a key, or it was a newer/fancier boat that had a digital dash that wanted a code or chipped key, Mercury boat engines all use a generic harness connector near the engine for gauges and ignition, which you could just unplug, and plug in our portable dash instead, completely bypassing whatever security the factory dash offered. It had a long enough cord you could run it up to the helm so when the customer forgot to leave the keys but made a service appointment, we could just drive the boat in and not need to tow it.
I’m not at all one of those em-ay-gee-ay people, but I’m old enough to remember leaving my keys in my car when I got home, and the car was still there in the morning. I didn’t need to take my keys out of the car because I never locked my home.
I still do that.
post deleted
I made a witty and poignant political comment, but decided against leaving it up.
It really was quite clever.
My Peugeot had this too. There was a little keypad down by the shifter that you had to input a 4 digit code to start it every time. It was honestly just annoying.
I have two friends who were stranded because the keypad systems crapped out on their Peugeots. Couldn’t be repaired and had to be bypassed.
I’ve heard that a lot. Super easy to bypass if you do so before it gives you problems but very difficult after. I always meant to disable mine but never got around to it because the car never really ran
Ditto my mother’s c.1995 Citroen Xantia (1815 – I still remember it …)
This immediately reminds me of that great scene in Mad Max: Fury Road with 2-factor authentication in the War Rig. It’d be interesting to see an Autopian how-to article to DIY a system like that for older vehicles!
Admit it, what you really want to see is the autopian build its own war rig, maybe out of a decrepit NYC taxi minivan say, complete with a wild eyed Lewin, a stoic SWG in a leather jacket, David covered in tools, and Mercedes with a metal arm. And just Adrian.
That would make the perfect LeMons Rally team!