Around a year ago I have asked a question about the weakest factor of authentication.

I have had some good answers that convinced me as I always imagined the authentication process in my head as some employee in a high security facility trying to get access to his office by entering his pin or someone trying to login into his PC by entering his password but the answers make little sense if we were talking about a vehicle.


Car keys can get easily lost or stolen by a stranger you met in some pub but it's highly unlikely that you shout your password while you are sleep talking
It's a big hassle and an expensive process to change your car keys; Passwords are very easy to change.


As you can tell from the other question, the biggest issues with passwords (according to the answers I received) were:


If someone has your password, you may not be able to tell that they are actively exploiting that knowledge.
Passwords enable random guessing, offline dictionary search, and other attacks.


Well...


That's true if someone were spying on your system, but if a stranger had your car keys I don't think they would return your car and if they did, you will be able to tell that someone else had access to your car.
Having the car locked for 5 minutes after three failed attempts is a pretty good solution.


Are you in hurry to go to work?  Get inside the house and get the master physical key; having a master physical key that overrides the password system is a good rescue solution, but not when you carry it with you all the time. Carrying the authentication secret in your head is safer than carrying it in your pocket. 

Few other things that come to my mind which makes me wonder why I've never seen a car with a password


You can always use your car as a getaway car in a bank robbery and you later claim that you have lost the keys and it was not you; you can't do that with a password.
A similar idea has been introduced by an infosec expert got turned down the other day on Dragons' Den even when he has invented a nice combination of a device that get attached to the car engine and a mobile app. The mobile app is superior to your physical key and you can't start the car without the app, even if you have the key.




Peter Jones attacked the idea based on the fact that your mobile might run out of charge; the authentication system of the car would never run out of charge as it gets powered by the car battery; it's replaceable, protected and if it's down, the car is down anyway and you can't blame the authentication system.

Poor password choices

The primary threat that a car lock protects against is theft of the car or of objects inside the car. Most theft is opportunistic, not targeted: go to a parking lot, try multiple cars until you find a poorly protected one. With passwords or PIN, you know that many people are going to pick password or 1234 or for the more paranoid their date of birth. Locking a car after failed attempts doesn't matter: the thief will just try the three most likely values on each car then move on.

Additionally, force-locking the car after failed attempts would be annoying if your kid starts mashing the buttons.

Shoulder surfing

Typing a password is vulnerable to shoulder surfing. It's hard to duplicate a physical key solely from pictures (it can be done, but only with precise enough pictures). It's impossible for an unaided human to duplicate a physical key.

It's easy for an unaided human to remember the PIN they've just seen somebody type. Pass by someone in a parking lot, note the PIN, see them the next day/week around the same time, profit.

Loaning

I can loan my car keys to someone. When they give me back the key, I can be reasonably confident that they no longer have access to my car. Sure, they might have duplicated the keys, but that requires time (if they only borrow the car for a short time, I know they haven't done it), and if I trust them enough to loan my car, I probably trust them not to copy the keys.

If there's a single password to open the car, then if I let someone use my car, they have access forever.

This can be solved by having multiple passwords to open the car, of course. But that adds another set of difficulties. One is that the key space might need to be larger: with a small key space such as a 4-digit PIN, the probability of an uninformed guess can become non-negligible with multiple valid codes. A bigger difficulty is that this requires Joe Random to do key management. Joe Random's VCR blinks 12:00 since the last power failure. (Maybe not anymore with DVR that have an Internet connection.) Joe Random understands physical tokens — if I have the object in my hand, I control it — but not password management.
