Around a year ago I have asked a question about the weakest factor of authentication.
I have had some good answers that convinced me as I always imagined the authentication process in my head as some employee in a high security facility trying to get access to his office by entering his pin or someone trying to login into his PC by entering his password but the answers make little sense if we were talking about a vehicle.
- Car keys can get easily lost or stolen by a stranger you met in some pub but it's highly unlikely that you shout your password while you are sleep talking
- It's a big hassle and an expensive process to change your car keys; Passwords are very easy to change.
As you can tell from the other question, the biggest issues with passwords (according to the answers I received) were:
- If someone has your password, you may not be able to tell that they are actively exploiting that knowledge.
- Passwords enable random guessing, offline dictionary search, and other attacks.
- That's true if someone were spying on your system, but if a stranger had your car keys I don't think they would return your car and if they did, you will be able to tell that someone else had access to your car.
- Having the car locked for 5 minutes after three failed attempts is a pretty good solution.
Are you in hurry to go to work? Get inside the house and get the master physical key; having a master physical key that overrides the password system is a good rescue solution, but not when you carry it with you all the time. Carrying the authentication secret in your head is safer than carrying it in your pocket.
Few other things that come to my mind which makes me wonder why I've never seen a car with a password
You can always use your car as a getaway car in a bank robbery and you later claim that you have lost the keys and it was not you; you can't do that with a password.
A similar idea has been introduced by an infosec expert got turned down the other day on Dragons' Den even when he has invented a nice combination of a device that get attached to the car engine and a mobile app. The mobile app is superior to your physical key and you can't start the car without the app, even if you have the key.
Peter Jones attacked the idea based on the fact that your mobile might run out of charge; the authentication system of the car would never run out of charge as it gets powered by the car battery; it's replaceable, protected and if it's down, the car is down anyway and you can't blame the authentication system.