Digital License Plates

California just legalized digital license plates, which seems like a solution without a problem.

The Rplate can reportedly function in extreme temperatures, has some customization features, and is managed via Bluetooth using a smartphone app. Rplates are also equipped with an LTE antenna, which can be used to push updates, change the plate if the vehicle is reported stolen or lost, and notify vehicle owners if their car may have been stolen.

Perhaps most importantly to the average car owner, Reviver said Rplate owners can renew their registration online through the Reviver mobile app.

That’s it?

Right now, an Rplate for a personal vehicle (the battery version) runs to $19.95 a month for 48 months, which will total $975.60 if kept for the full term. If opting to pay a year at a time, the price is $215.40 a year for the same four-year period, totaling $861.60. Wired plates for commercial vehicles run $24.95 for 48 months, and $275.40 if paid yearly.

That’s a lot to pay for the luxury of not having to find an envelope and stamp.

Plus, the privacy risks:

Privacy risks are an obvious concern when thinking about strapping an always-connected digital device to a car, but the California law has taken steps that may address some of those concerns.

“The bill would generally prohibit an alternative device [i.e. digital plate] from being equipped with GPS or other vehicle location tracking capability,” California’s legislative digest said of the new law. Commercial fleets are exempt from the rule, unsurprisingly.

More important are the security risks. Do we think for a minute that your digital license plate is secure from denial-of-service attacks, or number swapping attacks, or whatever new attacks will be dreamt up? Seems like a piece of stamped metal is the most secure option.

Tags: , ,

Posted on October 13, 2022 at 6:19 AM • 58 Comments

Comments

Jose Sardinas • October 13, 2022 6:50 AM

Setting aside the security issues, and considering vehicles in CA need two plates (rear and front) in the very improbably scenario 🙂 of a fender-bender, or backing up into a lampost or wall, or those highly improbably events that we all have heard of and never experienced… What happens if that digital plate gets punctured, crushed, bent, or whatever? Who pays for the replacement? Is the insurance forced to cover it? Would that increase the premiums? What happens if the plate is vandalized, stolen, or just damaged? With a regular metal plate, you just straighten it up with a hammer and you’re done… in this case, I don’t think that’s gonna be an option.

As with the law stating that attaching location devices to these things is not allowed, isn’t robbing, carjacking, murdering, et. al. also forbidden?

This is definitely a “solution” for a problem that does not exist.

Q • October 13, 2022 6:54 AM

The obvious advantage is that it requires an energy source to work. So simply remove power to make your number plate become un-trackable.

You can’t do this with sheet metal plates. Those remain trackable 24/7 by all the license plate readers dotted around everywhere.

Bilateralrope • October 13, 2022 7:15 AM

@Q

If I was designing a plate like this, I’d go for something similar to an E-ink display for the plate. Something that only requires power to change what’s displayed. Then I can use the car to supply the power, because the plate will only need power while the car is running. If thieves disable the power connection, the plate will display whatever it was last showing, which is probably the number plate.

Also, my experience with a kindle tells me that e-ink is much easier to read in direct sunlight than displays on tables/phones.

Perhaps most importantly to the average car owner, Reviver said Rplate owners can renew their registration online through the Reviver mobile app.

I live in New Zealand. I’ve owned a car for over 6 years now and have renewed my registration through a government website every year.

The biggest risk I see with these digital plates is what happens when someone starts messing with them to get them to display whatever the attacker wants. An attacker who starts with full access to the hardware.

Mauvaisours • October 13, 2022 7:27 AM

I leave in France,
Plate numbers are now assigned to the vehicle until destruction.
I fail to see the point of these …

Rob • October 13, 2022 7:30 AM

“Perhaps most importantly to the average car owner, Reviver said Rplate owners can renew their registration online through the Reviver mobile app.”

Huh? How does it take something this intrusive to have online registrations? I live in the backwards state of TX, and we’ve had online registration for a long time with the plain old steel plates.

Paul Hutch • October 13, 2022 7:31 AM

I’ve been avoiding needing to mail a renewal form for I think over 15 years now in MA.

Not sure how long CA has had theirs up but it’s here:
https://www.dmv.ca.gov/portal/vehicle-registration/vehicle-registration-renewal/

So the high price isn’t even needed to get “the luxury of not having to find an envelope and stamp”.
It does however allow renewing via an app instead of through a web browser for those people who find web browsers confusing and hard to use 🙂

Michael • October 13, 2022 8:12 AM

“Rplates are also equipped with an LTE antenna, […]”

“The bill would generally prohibit an alternative device [i.e. digital plate] from being equipped with GPS or other vehicle location tracking capability“

Could someone please remind someone about how cellular networks (such as LTE) are able to push data packets to a specific terminal?

Ron Oakes • October 13, 2022 9:43 AM

I worked at a major mobile phone chipset manufacturer as part of the location team for 5 years. Even though I was laid off in 2015, I am aware of the capabilities of any modern mobile device to locate its position even without utilizing the satellite based global navigation systems.

Without using the GNSS systems, an LTE mobile device won’t be able to precisely place itself, but it should still be able to provide a position within thousands if not hundreds or tens of meters just from the information available from the network. And if the chip can pick up any WiFi or other signals even without an actual antenna, this may be even more precise.

anonymous • October 13, 2022 9:52 AM

I wonder if the plates will use thin pale gray font on paler gray background. Because…you know, “modern.”

Nameless Cow • October 13, 2022 10:17 AM

@Q

You can’t do this with sheet metal plates. Those remain trackable 24/7 by all the license plate readers dotted around everywhere.

Can’t tell whether that’s intended to be sarcasm, but why aren’t de-powered digital license plates be subject to the same tracking by license plate readers as the conventional ones?

EvilKiru • October 13, 2022 10:28 AM

@anonymous: Why wonder when you can find plenty of examples of what they look like over at Google images, which reveals the choices to be blue letters on a white background or white letters on a blue background.

Ted • October 13, 2022 10:28 AM

@Bilateralrope

Re: Messing with the display

Amen brother. It could be more than just advertising or personal messages. Reviver itself is already thinking outside the box here. They have a patent for a digital display (not the license plate?) with forward thinking suggestions like:

“Official details may also include details relating to the driving history of the driver; for example, if the driver has an imperfect driving record, a notification may be rendered on the display in order to warn others in the vicinity of the vehicle.“

Woohoo?! You guys, I’m really not that bad of a driver.

US Patent # 9,007,193

Peter Galbavy • October 13, 2022 10:29 AM

While I think they are a dumb idea, other sources do state they are e-Ink based, so will display without power.

Ted • October 13, 2022 10:32 AM

Oh hey. Here’s another Reviver patent that could help with parking:

“As illustrated, the digital license plate and/or user device 1710 can operate to interact with a parking facility 1704, parking meter 1706, or parking fine system…

“Position in a parking facility can be determined with reference to local wireless beacons, inertial navigation systems, LIDAR or time of flight laser systems, camera or video systems, various sensor systems, including accelerometers, light levels, mechanical pressure or triggers, ultrasonic based sensors, or Global Navigation Satellite Systems (GNSS), which can include but are not limited to GPS, GLONASS, Galileo, Beidou or other regional systems.”

Yay?!?

https://patents.google.com/patent/US9007193B2/

Rick Auricchio • October 13, 2022 11:18 AM

@ Mauvaisours:

California “generic” numbered plates stay with the car for its entire life.

Custom “vanity” plates with a user-chosen number/word are usually moved to one’s new car. (The registration process accommodates the change of vehicle.)

But in neither case is it ever important (necessary?) to change a plate’s number once it’s issued. So why build something easy to change at all?

Kirkland • October 13, 2022 11:36 AM

” Privacy risks are an obvious concern when {strapping an always-visible personal-identifier to your vehicle } ”

but any license-plate is a major privacy risk.

worse, license-plates are totally unnecessary for their official legal purpose;
these unique public identifiers merely signify the vehicle is registered & government fees paid — but there’s no legal reason to also broadcast the vehicle owners specific identity to the world 24/7.

of course, government agencies and countless private entities love being able to identify & track everybody via mandatory license plates — they would also love it if everybody was required to wear a big name tag with their Social Security number when out in public.

VIN codes easily meet the administrative needs of vehicle registration identification.

Citizen Privacy Rights far outweigh any perceived benefits of license plates !

Anonymous • October 13, 2022 11:40 AM

So how long before you can go to your favorite shady website and purchase a license plate number changer? Never pay a toll again! Just blast through the electronic toll booth with a number that’s not yours, and you’ll never see the ticket. Worried about plate readers tracking your every move? Set your plate to change numbers randomly, or at locations of your choosing.

The possibilities are endless!

Jordan Brown • October 13, 2022 11:50 AM

We saw one of these the other day, and thought “no, that can’t really be a digital license plate, because that would just be too stupid”.

The whole point behind license plates is that they are difficult to change!

Not Really Anonymous • October 13, 2022 12:04 PM

License plates should just go away. With license plate readers having gotten so effective, the value to the public versus the individual has changed dramatically since they were first required.

JMC • October 13, 2022 12:55 PM

Many luxury car owners in CA don’t bother putting any plates on the front of their car, because they don’t like the way the plates look and the small fine if they get stopped by police (which almost never happens) is worth it to them.

I think these people are the target audience for digital plates, as they will be built into luxury cars and the cost will not be as important as the aesthetic.

Nameless Cow • October 13, 2022 12:55 PM

@Kirkland

worse, license-plates are totally unnecessary for their official legal purpose;
these unique public identifiers merely signify the vehicle is registered & government fees paid — but there’s no legal reason to also broadcast the vehicle owners specific identity to the world 24/7.

That’s obviously not true. License plates are are useful for eyewitness identification of vehicles fleeing the scene of a crime or accident. They are also used for road toll billing and issuing parking tickets. I’ve been to parking garages that insist on head-in parking for all vehicles, presumably to make it easier to write tickets for violations.

TimH • October 13, 2022 2:16 PM

2Michael, Ron Oakes: Unless Reviver explicitly states that Rplate doesn’t include GPS, presume it has.

Frankly • October 13, 2022 2:21 PM

Now the race is on, to be the first hacker to change all digital license plates to say “STOLEN” or “HELP ME” or “$#%&!”

Fazal Majid • October 13, 2022 2:47 PM

Presumably the plates use e-ink and thus the numbers stay visible even when powered off. The main use I can see is crooks bypassing the controller to make swapping licenses, whether for toll fraud or to avoid tracking by automatic number plate readers, e.g. the city of Tiburon in the Bay Area has ANPR on every ingress point to the city, compiles a list of cars that have come in and not gone out overnight and alerts police (the assumption in this tony municipality is clearly that outsiders must be up to no good).

David in Toronto • October 13, 2022 3:34 PM

This idea came up and was debated several years ago in another state (possibly on this very site, possibly on LinkedIn – I can’t recall). In any event digital license plates were a MASSIVELY STUPID idea then. SO MANY problems, several that should have been non-starters including the obvious lies and misrepresentations. Nothing material has changed as Bruce’s readers are demonstrating.

I live in the other CA, we’ve had online renewal for years. My province even stopped charging normal vehicle owners for the privilege of renewing. We don’t even issue plate stickers anymore. The world has not imploded.

We have had a few plate issues over the years. The wrapped plates that bubbled and peeled off the metal after a few years and the shinny new plate design blue with white letters that was unreadable at night when lit! We went back to the old way, painted metal with raised letters.

Costly with minimal benefits and a lot of unknowns that will not end-well, digital plates are an expensive-flawed-mind-boggling-stupid idea! PLEASE set the penetration testers loose on this ASAP, I need the entertainment!

I do hope this is OPTIONAL and that people just IGNORE this but perhaps common sense is dying out.

/Curmudgeon_Mode

David Leppik • October 13, 2022 3:57 PM

I read a sci-fi book where all the taxis had e-plates. Obviously the bad guys were changing their numbers every time they turned a corner, which made life hard for the detectives. The book never said why any government would want e-plates, since the whole point of license plates is to have an immutable identifier, and the only thing e-plates add is mutability.

It’s like serving great looking, inedible food for dinner. Actually, maybe some Instagram users might think that’s a good idea…until they get hungry.

Ralph Haygood • October 13, 2022 3:58 PM

“Anonymous” left pretty much the comment I came here to leave: “So how long before you can go to your favorite shady website and purchase a license plate number changer?” This is going to be fun, fun, fun! And not just for evading bridge tolls. Say good-bye to parking tickets! Hit-and-run? No problem! Speaking of hits, this’ll come in handy for hit men and other fine specimens of humanity as they flee the scenes. And so on. The possibilities are limited only by your (criminal) imagination!

No real benefits and massive potential abuses: what could possibly go wrong?

Alan • October 13, 2022 4:22 PM

I’ve been renewing my registration in California via the web for years. It’s actually one of the more pleasant web experiences.

SpaceLifeForm • October 13, 2022 5:56 PM

I mentioned James Bond 2 squids ago about this. Probably no one connected the dots because they did not read the link.

Here is a pic of a California license plate downloading an update.

A nailed-up cellco connection. Imagine the possibilities.

‘https://nitter.net/DougDeMuro/status/1576981788672421888#m

Here, a cheap license plate flipper. Showing the link to Goldfinger.

‘https://www.youtube.com/watch?v=7udPA7NnvF0

Erna • October 13, 2022 8:50 PM

seems like a solution without a problem.

I’d say these are a solution to a non-problem. But license plates do have a problem: privacy, as others have noted.

We should probably come up with a better word than “digital” here, because Canadian military license plates have been digital forever (also: Nunavut and the Northwest Territories).

Anyway, dynamic electronic plates could easily be designed to make tracking basically impossible by parties not holding a private key. With much more difficulty, this could likely be done while maintaining an “eyewitness identification” feature, provided the witness knew the approximate time. But, of course, the issuers of these plates don’t even pretend to care about privacy (some were even found to be straight-up selling private information out of their databases).

Bilateralrope • October 13, 2022 9:34 PM

@Michael

That’s the magic of requiring a user to run an app on their phone. You can do all the tracking through the app, using the phones existing hardware, without needing to violate that law. Especially if the app refuses to work unless you give it all the permissions it demands. Even ones you can’t see why it asks for.

David in Toronto • October 13, 2022 10:45 PM

@Erna – I’d forgotten about the Force’s digital plates, lol

Now that second paragraph actually has some benefits in it. Pity people dont think that way.

@Bilateralrope – sadly you are right even if Erna’s ideas were implemented, there’d be another ID tagged to your phone.

Clive Robinson • October 14, 2022 12:56 AM

@ ALL,

The supposed only advantage to these plates is that the authorities can put the word “stolen” or equivalent in them…

But are people asking the big question of “How?” and then thinking about how to attack that?

Apparently not so far…

Well just to get the ball rolling.

People have asked the likes of “how does it display when there is no power?”

To which the answer is apparently E-Ink.

But nobody asked,

“Can the screen be updated with no power?”

So unless it has a built in rechargable source the answer is very probably “it can not”.

Thus the sole advantage of this over priced bit of nonsense is gone if a car thief yanks the fuse?

Oh my bad,

“I’m assuming a fuse”

Why? Because it’s an electronic item that could go wrong, draw excessive current get hot and potentially catch fire and burn your car with you in it to a heap of “hot rust”…

So now I feel a new meme coming on,

“Security -v- Safety”

So there is yet another thought for an attack on an over priced piece of tech-junk that is also potentially your own personal “Weenie roaster”. Find a way to make it “burn on demand”… So when you drive down the road in your old clunker and some smart ass puts up some rude message on their tail plate, you press the button and start singing that old Platters song wirh the words “smoke gets in your eyes”…

There is potentially so much fun and so little time with these…

To quote Shakespear’s Marc Antony,

“Cry “Havoc!” and let slip the dogs of war,
That this foul deed shall smell above the earth,
With carrion men, groaning for burial.”

Gert-Jan • October 14, 2022 6:21 AM

I think it is a mistake for the government (in California) to allow number plates that can be dynamically altered.

Where I live, you can’t just get any number plate you want. You need proof that you are allowed that number plate text. Also, replacement number plates are stamped with a increasing index number (first replacement set is marked with “1”). (Hacked) eletronic number plates circumvent all that.

Rplates are also equipped with an LTE antenna, which can be used to push updates

Why is a liability like this presented as a good thing? When you’re driving around, you won’t even know what your electronic number plates are saying, since they could potentially change every minute, or be blank at “convenient” time. I assume you won’t know when they’re updated, or attacked, etc.

Bilateralrope • October 14, 2022 10:49 AM

@Clive Robinson

And if there is a rechargeable power source inside the plate with enough capacity that disconnecting it from the car doesn’t help the thief, there are still two attacks to disable the ability to push updates:
– Physically disable the battery
– Physically disable the antenna

The license plate would have a standard design. So it would be far easier to target components of it than to get at the fuse within the car, because the location of the cars fuse boxes would vary from one model to the next. Then there is the work of removing anything from the car that’s blocking access to the fusebox. Then finding the specific fuse.

Meanwhile the components within the digital plate will be in the same place every time. Much easier to go at them with a battery powered drill.

Oh and here’s a problem with updating the license plate to display “stolen”. Multiple similar looking cars get marked as stolen. One of them is used to commit a crime. But, since the cars all look similar and are displaying the same thing on their digital plates, it’s going to be very hard for witnesses and cameras to tell which car was used for the crime.

Or maybe a car gets marked “stolen” incorrectly and then a bystander decides to play the hero and steal the car to pass it to the police. Hopefully this bystander doesn’t have to forcefully remove the driver from the car.

Nameless Cow • October 14, 2022 12:33 PM

@clive Robinson, @Bilateralrope

The license plate would have a standard design. So it would be far easier to target components of it than to get at the fuse within the car

To the eye, a digital license plate is just an image on an e-ink display. If you’re not dealing with electronic verification, you can just replace a genuine license plate with something that looks like one. You don’t even need to attack a genuine unit.

Bilateralrope • October 14, 2022 1:52 PM

@Nameless Cow

So I can mark my vehicle as stolen while committing a crime, thus ensuring no witness gets my plate, without even needing to have a digital plate on my car ?

Or I could stick my fake “stolen” marker on the car of someone I don’t like and cause them trouble.

This is going to get real messy, real quick, once the public get some idea of what the stolen marker looks like. Even if their idea is wrong.

Clive Robinson • October 14, 2022 7:14 PM

@ ALL,

A repost because my earlier reply to @Bilateralrope has vanished…

With regards a thief going after the fuse, and not the diplay internals etc.

The displays are alledged to have anti-tamper measures so they can detect direct attacks on the hardware and the antenna or LTE cellular system (via an illegal jammer etc).

Loss of power though is an “expectated” issue due to vehical maintainence, upgrades, and even jump starting in cold weather etc.

Now the designers could make the display show it’s been potentially tampered with if the power does get cut… But consider these e-plates are aimed at the luxury market not the consumer. Thus just like hotels they do not want to upset their customer by making them have to get it re-loaded every time…

SpaceLifeForm • October 14, 2022 7:26 PM

@ Nameless Cow, Bilateralrope

It is probably easier than you would guess.

The ‘plate’ is just a flatscreen. There are no raised characters.

So, something that is of the correct size, with proper framing, could be made to look real. Add some removable printable static plastic.

SpaceLifeForm • October 14, 2022 8:41 PM

@ Clive, Bilateralrope, Nameless Cow

Was this it? I still have the text. There was no reason for it to disappear IMO.

Seems obvious to me, that Nameless Cow, and Bilateralrope read it because they commented on it.

I’m pretty sure based upon what I have observed in last 24 hours, that the servers need to be restarted. I think the MariaDB is having problems again due to memory leaks.

https://www.schneier.com/blog/archives/2022/10/digital-license-plates.html/#comment-411066

The supposed only advantage to these plates is that the authorities can put the word “stolen” or equivalent in them

Bilateralrope • October 15, 2022 12:57 AM

@Clive Robinson

Your post is still visible for me.

@SpaceLifeForm

Does vigilante action sound like a good thing for you ?

Because that’s what I’m expecting if cars are marked stolen. People who aren’t satisfied just calling the police to tell them about a marked stolen car, but want to do something to help recover it. People who think that they are allowed to commit all sorts of criminal acts to stop the person they think is a car thief.

Now imagine the fake STOLEN plate being placed on top of an unpowered metal plate by someone who wants to hurt the owner/drive of that car.

Clive Robinson • October 15, 2022 3:43 AM

@ SpaceLifeForm,

Re : missing post

Yes that was it, it’s now visable again…

It’s disappearance was,

1, Long after the half hour uncertainty time we’ve observed and commented on in the past.
2, Much longer than an hour before I retyped from memory.

All very odd, and as you indicate, indicative of an evolving software issue such as a memory leak.

David in Toronto • October 15, 2022 2:18 PM

Hmmm … but which stolen plate. It’s not uncommon to steal a plate (or car) to commit a crime. Even displaying “STOLEN” seems a bit silly.

Yes, officer the bank robber was driving a getway car the plate said “stolen”

David in Toronto • October 15, 2022 2:23 PM

Now if you want to protect the car, you could make the roof display “STOLEN” in infrared so the helicopters can see it.

Prior art disclaimer … something like this was used in a Banacek episcope. The only obvious claim here is to use infrared.

SpaceLifeForm • October 15, 2022 3:26 PM

@ Bilateralrope

re: vigilante action

I do not see it as an issue. If it really is stolen, then I would expect that any sane person would think that the perps may have a gun, and if motivated, would just call the police and report it.

Watch the youtube link I posted earlier. The perps were caught because the person monitoring the security cams was actually paying attention and noticed that a license plate flipper had been used and called the police immediately.

https://www.schneier.com/blog/archives/2022/10/digital-license-plates.html/#comment-411056

Jesus Valente • October 16, 2022 8:25 AM

Well, it is a matter of having it secure enough so that no one can make a digital twin from it. This is to be considered similar to digital SIM cards form mobile phones.
Those are becoming the standard.
So why shouldn’t it be also with licence plates the case?

David in Toronto • October 17, 2022 8:53 AM

@Jesus Valente people can’t tell visually if something is digitially secure. That will only work for people with the right kit to query the device or something like a cell network. Law enforcement will go for that kit but there are already legal/privacy cases about the use of automatic license plate scanners.

Even if the plate were constantly in contact with a network there will be times where it can’t communicate and it still needs to fall back to visual clues. It can’t flash stolen if it’s in a parking garage or the middle of nowhere.

Worse, any static display (or predictable dynamic element) is easily spoofed either with a wrap or fake electronic plate.

Ollie Jones • October 17, 2022 11:33 AM

What of the inmates at Folsom State Prison who stamp and paint the metal plates? Their prison jobs are probably safe. Customers for this new tech probably all have offices on venture-capital row on Sand Hill Road in Palo Alto.

There’s one way to make this product line even more pointless: put it on a blockchain.

Nameless Cow • October 18, 2022 3:52 PM

@SpaceLifeForm

The ‘plate’ is just a flatscreen. There are no raised characters.
So, something that is of the correct size, with proper framing, could be made to look real. Add some removable printable static plastic.

Yep. That’s what I had in mind when I wrote

To the eye, a digital license plate is just an image on an e-ink display. If you’re not dealing with electronic verification, you can just replace a genuine license plate with something that looks like one. You don’t even need to attack a genuine unit.

Eric • October 18, 2022 4:52 PM

This is for subprime auto finance, I think? Makes it REALLY REALLY easy to repo the car. And you can pass along any costs to the driver.

James Reardon • November 6, 2022 3:01 PM

All this technical discussion misses the point. Sure, anything with an LTE antenna can be tracked — if there is an LTE radio connected. If “updates” (what updates?) can be pushed to the plate, then the plate can be identified anywhere. Anywhere.

When our progressive CA government decides it is time to charge people by the mile for driving, or to limit access to metro areas, or seek out “insurrectionist” fans at a Giants game, these plates are perfect.

For awhile, poor people will fly under the radar, and then the plates will be mandatory — meaning subsidized for all, and another useless industry is born.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.