Hacker News Reader

Yes, but I don't think skimmas is fully right. Updating firmware over the internet is not a terrible idea. Public key decryption is well established technology and simple enough for even big corporations to get right.

Of course.. there's some room for them to screw up, but I would argue that that's set off by the risk of having buggy vehicle control firmware killing people. Especially with a new vehicle like the Tesla.

View on HN

There's also such thing as "key stealing". I imagine it would be quite a valuable target.

When you're signing a binary blob, protecting the private key is actually pretty easy since it can be air-gapped/offline. Or heck you can buy appliances where they'll perform specific functions using the private key but won't expose it themselves without physical intervention.

If I were a mega-corporation protecting a firmware private key, your name would have to be Tom Cruise to get it. Though unfortunately responsible corporations seem to be as rare as real-life Tom Cruise characters, so I guess it's a valid concern you have.

Reply on news.ycombinator.com