PSA Warning: PAAK might leave your Mach-E (or possessions inside) vulnerable to theft

[garyd9]

TL;DR: Enabling Phone as a Key might leave your Mach-E (or at least possessions inside the Mach-E) vulnerable to theft.

I was browsing the Mach-E manual earlier today and noticed a specific sentence that got me thinking:

The typical operating range for Phone as a Key is 131 ft (40 m).

That got me wondering if a long PAAK range could result in a thief stealing items from inside my car (or even stealing the car entirely!)

I decided my scenario for testing would be my car parked outside a building and my phone inside the building with a solid wall and at least 30-50ft (9-15m) of empty space between the car and my phone. (This would be a fairly common situation for eating at a restaurant, I think.) (This scenario also made it easy to test from my home by moving my car up and down the street.) For each test, the car was left locked (and it was verified locked by the side mirrors auto-folding in.) The "solid wall" is a wood framed wall with dry-wall on the interior and a faux-brick exterior filled with insulation.

I then started the FordPass app on my phone (an iPhone 15 pro max), and put my phone in standby. I put my phone down inside my house, went outside my house, walked to wherever the car was, and tried to open the car using the button on the driver side door. For each try, I would press the button no more than 3 times (waiting around 5seconds between each press) and if the door opened, I'd also try to start the car.

Results:

At 30 feet (9m) with a solid wall between the car and phone, I was able to unlock the car 5 out of 5 tries.
At 40 feet (12m) with a solid wall between the car and phone, I was only able to unlock 3 out of 5 tries.
At 50 feet (15m) with a solid wall between the car and phone, I was only able to unlock 1 out of 5 tries.

I was not able to start the car at all on any attempt regardless of distance.

---

The take-away from this is that leaving PAAK enabled could be a risk. While it seems that the Mach-E won't allow starting the car when the phone is far away from the car, it DOES allow unlocking it. Of course, different people might have different results with their particular phones. Perhaps different Mach-E's would also have different results.

For me, this test resulted in me disabling PAAK. Perhaps one day Ford will put out a fix so the phone has to be closer to the car. (Or perhaps there already is a fix out there, but my car doesn't have it.)

I do think that if a person has PAAK enabled, they should at least be wary. I keep coming back to the distance quoted in the manual: 131ft (40m.)

Sponsored

 

[MoonRiver]

Mine 22 select is not that sensitive. My PAAK was in my house about 60 ft away from Mach e which is my garage, and the fob was 30 ft away also in the house, Mach e detected none of them. Doesn't PAAK communicate with Mach e though bluetooth? BT as far as I know doesn't work in too long of a range does it?

 

[garyd9]

Doesn't PAAK communicate with Mach e though bluetooth? BT as far as I know doesn't work in too long of a range does it?

Yes, it’s Bluetooth based. The range can vary depending on a lot of things. Ford suggests 131 feet (which seems long to me, but is probably accurate in open air line of site.)

 

[Sikkun]

Mine 22 select is not that sensitive. My PAAK was in my house about 60 ft away from Mach e which is my garage, and the fob was 30 ft away also in the house, Mach e detected none of them. Doesn't PAAK communicate with Mach e though bluetooth? BT as far as I know doesn't work in too long of a range does it?

In most situations the BT will not be any further than a fob that can also hit 50+ feet in the right conditions.

 

[Mach-Lee]

I haven't done the full distance-variable test like you, but I can confirm it unlocks from 20' away with my iPhone 12.

I've warned about this issue for a long time, if you park outside and your phone is nearby you should quit FordPass completely or disable Bluetooth so people can't walk up and open your car. People have had things stolen out of their Mach-E this way. The BLE technology is very difficult to effectively distance filter due to differences in phone ping response times and signal strength characteristics, which vary widely from phone to phone, and even from OS version to OS version. It's extremely difficult for Ford to keep up with the tuning/calibration for each specific phone model, so as a result the response time and/or signal strength threshold may get increased to a healthy margin to ensure it works more reliably. And then it ends up working too far away.

Luckily the car IS able to accurately determine if the PAAK is inside or outside the vehicle, so it's not going to start or drive for a kleptomaniac. They just get inside and rummage around.

The fob is a lot better because it's a known hardware configuration, so time-of-flight performance can be precisely characterized. Therefore the distance filter on the fob (about 4' max) is very tight and works well, the car will never open if the fob is 8' away (unless a relay attack is used).

The problem is BLE really wasn't designed to be used for Phone As A Key, so it doesn't work perfectly and the technology didn't live up to its expectations. The solution for these inconsistent ranging problems is to move from using BLE to UWB technology which has a defined timing standard and centimeter ranging accuracy. Hopefully we see that technology in the next-gen EVs.

 

[thenew3]

So the MME doesn't use UWB like many other cars with PAAK to detect the range the phone is from the car?

Is this an iphone only issue? I've tested keeping my phone (android) in the garage while the car is parked in the driveway (about 20 ft away). It won't let me unlock the car even though the ford pass app shows BT is connected to the car and gives me option to lower/raise windows/frunk/tail gate etc.

I can only unlock the car when the phone is within about 10-15 feet of the car.

 

[AliRafiee]

That’s interesting because half of the time I can’t unlock the car with my phone in my pocket. I have to take it out of my pocket for it to work.
My phone is usually upstairs right above the garage, and if I don’t have it with me, it won’t unlock.

 

[Mach-Lee]

So the MME doesn't use UWB like many other cars with PAAK to detect the range the phone is from the car?

Is this an iphone only issue? I've tested keeping my phone (android) in the garage while the car is parked in the driveway (about 20 ft away). It won't let me unlock the car even though the ford pass app shows BT is connected to the car and gives me option to lower/raise windows/frunk/tail gate etc.

No, vast majority of PAAK out there is BLE or NFC. UWB is brand new on cars (only came out in the past couple months), so far I think only Tesla has it and maybe the refreshed Rivians.

I then started the FordPass app on my phone (an iPhone 15 pro max), and put my phone in standby. I put my phone down inside my house, went outside my house, walked to wherever the car was, and tried to open the car using the button on the driver side door. For each try, I would press the button no more than 3 times (waiting around 5seconds between each press) and if the door opened, I'd also try to start the car.

Results:

At 30 feet (9m) with a solid wall between the car and phone, I was able to unlock the car 5 out of 5 tries.
At 40 feet (12m) with a solid wall between the car and phone, I was only able to unlock 3 out of 5 tries.
At 50 feet (15m) with a solid wall between the car and phone, I was only able to unlock 1 out of 5 tries.

Couple questions for you Gary, how did you measure the distances? And what angle was the phone approaching the car (straight ahead, 30º right off the nose, etc)?

Also, if you try to remember, did you get a message saying "Device Not Supported" when setting up PAAK? That may be relevant to these results.

 

[67 Stang Convertible]

I phone 12. when I walk up to my car in the parking lot, the lights come on at around 20 ft. If I leave my phone in the kitchen (connected to the garage) and extra fob sits no more than 10 ft from the car, I can not open my car. And, I assure you I wish it could at those few times when I realize my phone is not in my pocket (then the heavy sigh, and the march back into the kitchen) ?

 

[garyd9]

Couple questions for you Gary, how did you measure the distances? And what angle was the phone approaching the car (straight ahead, 30º right off the nose, etc)?

The distances were measured with the Mk I Eyeball (so probably +/- 5ft on each measurement.) For the angle, assuming hood of the car is at 0 degrees and the passenger door is at 90 degrees, the phone was approaching at approx 355 degrees (near head-on) for the first test, and about 265 (near head-on to the driver side door) degrees for the second two (longer distance) tests.

Please keep in mind that my intent wasn't to be entirely scientific, but more to answer the question of "Might having this feature of the car enabled result in theft?"

I was actually very impressed that it rejected starting the car. Off the top of my head, the only way to accurately validate the phone being inside the vehicle would be to have 2 (or 3) receivers to estimate (or triangulate) the location of the phone. Sadly, that wouldn't work for an accurate measurement outside the car. (There might also be aspects of BLE I'm not familiar with.)

Also, if you try to remember, did you get a message saying "Device Not Supported" when setting up PAAK? That may be relevant to these results.

I honestly don't remember. At the moment, PAAK isn't enabled on the car, so I could re-add it this evening and find out.


I also want to be clear that I'm not attacking Ford on their implementation. Not only do they warn that the range can be very long in the user guide, but what they're trying to do is very difficult. However, most users won't read that single line in the manual to be warned...

 

[garyd9]

To whichever Moderator who moved (and edited) this post: Please add a note that you did so. I don't object but it threw me off...

 

[Herbknowsit]

I decided straight off not to use PAAK since I am weaning myself from constant info addiction. But I admit I love the ability to remote cool the MME as it’s been in high 90’s here. I wish Ford could turn the clunky key fob into a sleeker stick as Apple does and many hifi components do. Yeah sure, they would be easier to lose but would also fit in many pant/shirt pockets. A simple sliding “door” to cover buttons would prevent the dreaded inadvertent horn alarm syndrome. That often happens when one has a house key or two attached to a fob and they touch back to the buttons while jammed in a pocket that is snug. Of course I realize that most people will never be without phone in hand so why bother with a fob?

 

[generaltso]

No, vast majority of PAAK out there is BLE or NFC. UWB is brand new on cars (only came out in the past couple months), so far I think only Tesla has it and maybe the refreshed Rivians.

The Kia EV9 uses UWB. And I can confirm that it makes a world of difference.

 

[garyd9]

But I admit I love the ability to remote cool the MME as it’s been in high 90’s here. I wish Ford could turn the clunky key fob into a sleeker stick as Apple does and many hifi components do. Yeah sure, they would be easier to lose but would also fit in many pant/shirt pockets.

With PAAK disabled, you can still remotely turn on the climate control (as well as manually lock/unlock with button presses) with your phone. Disabling PAAK would disable the ability to open/close the windows and open the hatch/frunk from your phone. Those things could still be done with the fob.

 

[Gullwingdmc]

So the MME doesn't use UWB like many other cars with PAAK to detect the range the phone is from the car?

No, the MME only uses Bluetooth and Bluetooth LE. UWB wasn’t widely available when this system was being developed.

Sponsored