Some people think that, when keys are locked in the car, we'll bring a master key to unlock the door. Personally, the idea that each tow company would have unfettered access to keys for millions of cars is not only a logistical nightmare, but it's rather scary, given some shops. Instead, we have a few tools and an instruction booklet, and break into a car the same way a car thief would. With the right tools, I can get into most cars from minutes to seconds. That's one skill that they never really teach you in software engineering. I have a saying of, "I didn't sign up to break into cars. It's more of a perk, really." It's great fun, really, and it's a good reminder of some fundamental rules about security.
DISCLAIMER: These articles contain information on car security, but all the information here is freely available elsewhere or with simple common sense (A rock breaks a window). The issues listed are purely for educational purposes, as examples of real-world security issues that can be applied to software analogies. Don't try this at home, because you can easily damage your car if it's done improperly, and laws regarding possession and sales of the tools vary.
No matter which car it is, you can always get into the cabin by breaking a window with a rock. However, this doesn't work for opening the trunk or starting the car. If I can't unlock the car without damaging it, I can always use dollies and pick the car up off the street. Yes, with no damage or dragging, even if all the wheels are locked. Dollies are a pain to put on, but it's doable. Then it's a simple tow to the dealership, where they have all sorts of tools and toys> They can unlock the car or make a new key relatively easily. Physical access is 80% of total access.
Most high-end cars (Lexus, Mercedez, BMW) will disable the trunk release when the car alarm goes off. I've had to tow cars where the key's locked in the trunk. One BMW owner's locked her purse in the trunk. We got into the cabin no problem, but of course this did no good for getting the keys. So I had to tow the car to the dealership. As it was a sunday, the $350 labor of pulling three fuses (under the rear passenger seat -Oh! How I wish I knew this at the time!) and putting them back in (to reset the alarm and reenable the trunk) would have to wait. So for a few days she'd have no car, and no purse. The house keys were in the trunk. Her driver's license was in the trunk. Her credit cards were in the trunk. Her cash was in the trunk. Her cell phone was in the trunk. Were it not for the garage door opener in the cabin, and the kindness of the dealership of loaning her a new car without ID or license, she would have been homeless for a few days.
Even more so, BMWs, especially since the mid-90s and on the 3-series cars, have a double-lock system. If you lock the car with the remote or with the key in the driver's door, not only do the locks go down, but a secondary lock locks the visible locks into place. Locked like that, nothing save the key or remote will unlock the car. Not even if you were inside pressing buttons and pulling on the lock. If you've got a kid locked in the car, bust a window. The keys are laser-cut, so even a mobile locksmith won't be of help. There's such a thing as too secure.
I'll be the first to admit that I'm biased, but most car alarms I've seen are rather useless. I've had a lot of calls where the alarm's gone haywire, and I either have to find a way to override it, or tow the car. Third party alarms are the worst offenders in this. And even when it does work, it's not too effective. I had one call to unlock an exporer, with a cop putting his things into his squad car (It was near a Starbucks) paying little attention. Perhaps it was the sound of the tow truck to give it an air of authenticity, but when the car alarm went off (after I had already unlocked and opened the car), he didn't even look up. Car alarms cry wolf so many times, that an off-duty cop admitted they don't even bother responding to car alarms. In her opinion, the club and LoJack were the more effective than any alarm.
It's a guilty pleasure, but in parking lots, it's a little game of mine to get the truck to rumble just right to set off car alarms. It's about going 5 MPH with the transmission in 3rd or 4th. There's been a few times where one alarm will set off another. I've called it the car mating call. In terms of alarm failures, my favorite one was an old Saab. The member lost the key, and so to prove that they actually owned the car, I broke into the car and checked the registration. The car alarm did nothing. They were the legal owners, so I hooked up the car to the truck. The car alarm did nothing. I started towing. Four miles later, as I was crossing some train tracks, then, only then, the car alarm went off.
On the other hand, the best car alarm design I've seen is one a coworker had. It's a passive keyfob, meaning there's no buttons on it, the car alarm just knows how far away the keys are to the car. Walk away from the car, it locks; walk to the car, it unlocks. But here's the brilliant part: if you lock your keys in the car, you shake the car to wake up the alarm, and then it realizes the keys are right there, and it unlocks. Pure genius, both secure and user-friendly. These two are not mutually exclusive!
The second best car alarm I've seen is the one Lexuses and the Toyota Avalon (which is just a Lexus but without the $30,000 name). It's the standard lock right by the handle, but that's not the smart part. Like most cars these days, it can tell how it's being opened by sensors at the key lock, so when it's being forced open, the car alarm goes off. But the smart part is that when the car alarm goes off, it uses the power locks to lock things back up. It's doable, as there's a split-second, and if you time it right, you can open the door before the alarm locks things up again. But for the most part, it takes a few tries, so it's much more work than a car without this alarm brains. I wish BMW would do this design instead of their deadbolt setup. Security isn't about making things impossible, but making it inconvenient enough, to discourage the bad guys, but let the good guys in.
90% of the Fords are easy. They've got a popup lock by the back of the door, and there's a physical rod underneath that lock that reaches to the actual mechanism. If you've ever seen someone use a slim-jim to unlock these, it just involves the flat piece of metal getting hooked on this rod, and lifting up. I've been able to unlock a Ford in about a second or two, in one fluid hand motion. Most other popup locks on lower-end cars are just the same. The one exception is the 2006 or so Honda Civics. They have a popup lock, sure, but there's what's called a block in the way. That is, they've got a little bit of plastic inside the door that blocks the slim-jim from grabbing the metal rod. Very simple, very effective, making it one of the toughest cars to unlock; I've had to defer to a locksmith on some of them. A little bit of protection, in the right spot, goes a long way.
