Reading a card: I copy the badge in your wallet
A plain access badge does not check who is asking. When a reader powers up, the card just answers with its stored ID. The old 125 kHz badges on a lot of doors and gyms broadcast a fixed number and nothing else. I hold a reader near your pocket for a moment, it answers, and I write that same number onto a blank card.
That is the whole attack for a static badge. No password, no math, just a number read aloud and written down. The copy is indistinguishable from the original to the door.
Why it matters
If your building still runs low-frequency proximity badges, the card is a convenience, not a control. The fix is not a better wallet; it is a badge that proves itself with cryptography instead of reciting a number (see Part 4).
The relay attack: I stretch your fob across the yard
A keyless car is always whispering, “is my key nearby?” The key answers only when it hears that whisper, which is why the car unlocks the moment you touch the handle. The catch: the car measures whether the key replied, not how far away it really is.
So I use two radios. One stands by your front door and hears the car’s whisper; a partner by the car relays it to your key inside the house. The key replies, we relay it back, and the car opens for a key that is fifty feet away on your kitchen counter.
Why it matters
This is not code-breaking; it is a wire made of radio. Because the signal is genuine, rolling codes and encryption do not stop it. What stops it is the car refusing to believe a key that is physically too far away, or the key going silent when it is idle (see Defense).
Replay and rolling codes: record now, open later
Older remotes, some garage doors and cheap gate fobs, send the same code every time. I record one press and play it back whenever I like. Modern car fobs defeat this with a rolling code: every press uses a new one-time value, so a recording is stale the moment it is used.
The known trick against rolling codes is to jam and capture: block the car from hearing your press while I record it, let you press again, then replay the first, still-unused code later. It is fiddly and situational, but it is why “it has rolling codes” is not a full answer.
Why it matters
Fixed-code remotes should be retired. Rolling codes are genuinely better and worth having, they just are not magic, and the relay attack in Part 2 sidesteps them entirely.
Where it fails: I tried to clone a Tesla card, and couldn’t
I put a reader on the key card that unlocks my own Tesla and got nothing useful. That card is not a low-frequency badge reciting a number. It is a 13.56 MHz smartcard that runs a challenge–response: the car sends a random challenge, and the card proves it knows a secret without ever revealing it. There is no static ID to copy.
Why it matters
This is the whole lesson in one card. The attacks in Parts 1–3 work because something is static or merely relayed. Cryptographic challenge–response is why a Tesla card, a modern passport, and a bank chip resist copying. When you get to choose, choose the credential that answers with math, not with a name.
Your keys defense checklist
You do not need a Faraday bunker. You need your keys to stop answering strangers and your credentials to prove themselves with crypto. Do these and the chain above breaks at multiple points.
Work through these when you buy a car, change buildings, or replace a remote. A completed checklist records your work, not a security scan.
The next field note.
Straight to your inbox.
Drop your email and I'll send the next one when it's live. One message, no spam, and you can reply to it. Or just follow on Instagram.