fifo.sh

A long long time ago somewhere in a nice small city not far from the normal world I bought a nice bluetooth stick…

It’s a damn nice thing does something like bluetooth 1.2 or so and is nice enought to transfer photos.

After a while (1 morning) in my pocket it opened up:

As good viewers can see there is nothing that connects die antenna to the stick. Seems to be useless.

For the people with glasses or who do see the small pictures on high-resolution screen:

Now for sale: A “bluetooth antenna”! For only 5 euro you can have it (that’s what the ‘extended range’ costs more instead of the normal version)….

In some definitions 1.0 isn’t 1.00 in this case it’s a crucial version numbering of documents regarding the OV-chipkaart[1].

A long time a ago there was someone steaming chipcards clean with acid. This resulted at the beginning of this year in some media-hype-rumors about the shiny new-not-yet-implemented dutch public transport card. But never trust a hacker and ask for a second opinion. They asked TNO, a dutch research company who also helped to develop this application card and some of the security measures.

They wrote a very nice report but a new hack voided this report.

Next step in the process was ‘let’s ask an independent researcher somewhere else‘. This worked and after a while they came up with a document version number 1.0. Normally in scientific publications this means it’s final you can release it and everybody would be happy.

Not this time. They wrote a newer version with version number 1.00 and changed (or just deleted) some little facts:

• They ‘forgot’ to mention the possibility of a DOS/DDOS on the system since ‘it hasn’t to do anything with the security of the card’
• They changed the part in the conclusions where they mentioned that ‘a low cost cardreader’ can make good copies into ‘relative simple to copy a card’
• They changed the statement that ‘money and work could be better used for finding a securer card instead of introducing the current one’ into ‘put more effort in finding a better card’ (Effects of this statement for a ‘normal reader’: Go on with the current card and meanwhile have some fun spending a lot of money).

Meanwhile TLS (TransLinkSystems or so) doesn’t want to talk to the reported who found the version 1.0 (NOT the 1.00 that one was already public) and they are gone in some form of hiding about what is happening.

To make it more funny they are now going to do a ’softer’ approuch in deploying the system overall: They are going to introduce it into the large cities, phase out all the old paper tickets and if (and when) it works well they will deploy it in ‘the countryside’. This could bring me (and others) in the situation that you can’t take bus 1 from A to B with an OV chipkaart and you can’t take the next one with a strippenkaart.

It’s recipie for disaster.

And don’t get me started on some more crap about the lying from the minister about the money already spended on this project (about 1.000.000 EURO (that’s about 1.560.000$!) in tax money alone.

Maybe I should hop on to this project as a consultant or so. There should be a LOT of money hanging around.

KEEP HACKING….

[1]: A chipcard with mifare chip protected by crypto-1

P.S. Starbug: when can I get my backup of my OV chipkaart?

Hello dear ladies, sirs and sysadmins.

Lately I got some problems with stricter SSL certifcate checking (which is a good thing) but….

From RFC2818 3.1

If a subjectAltName extension of type dNSName is present, that MUST
be used as the identity. Otherwise, the (most specific) Common Name
field in the Subject field of the certificate MUST be used. Although
the use of the Common Name is existing practice, it is deprecated and
Certification Authorities are encouraged to use the dNSName instead.

But what I see is that a lot of people don’t understand this quite well and users end up with a lot of errors about wrong hostnames. Pretty funny to see

“Certifcates hostname.domain.tld is not valid for hostname.domain.tld’

The easy answer to solve this: Put also the Commonname in the certificate request as SubjectAltName.

And for the fun…. Apple did implement the RFC the right way.

Yesterday afternoon I tried to order something at dealextreme.com (Yes I know that’s all chinese crap you don’t want to have but still order because it’s cheap).

A convinient way to pay there is to have a paypal account. That way you only have to export your (american) creditcard number to the USA and not to china. Another nice thing is that you can pay with your bank account (direct debit or so) if you have linked your bank account into paypal.

Nice nice nice that big bad internet these days. However here comes the lazy user: he has forgotten his password (or the postit with password). A real nice feature is the ‘lost password’ link overthere. I clicked it and it wanted some answer for a secret question. I didn’t know that either but nice as they are at paypal (and stupid as normal users can be) you can change the question in 3 other options. Including ‘what is your phone number which is like xxxxxxx42). Whow that would keep someone busy for hours….. The next question options where even funnier. ’secret question’, ‘creditcard number’ and ‘bank account number’. For the last two the last two digits where given again. After entering my bank account number I could set my password again.

Hello morons over there? I just entered:
* my bank account number
* my mobile phone number
* my emailaddress
and I could set my password without problem.

I don’t know how bank account numbers are threated in other countries but here it’s not a real secret and not that difficult to obtain. And for mobile phone numbers we have sites like orkut,hyves,linkedin,xing/openbc and my alltime big friends at google.

I was wondering why paypal didn’t email me a new password (or some activation link) but there is the point of scammers around the corner.

Ohw and you hackers/slackers/… out there don’t bother: I don’t have a paypal account anymore.

(any spelling errors are because MaemoWordPy don’t have spellchecking)

Update 2007-06-07 21:39

FooBar just checked it with his own account and told me that this trick doesn’t work anymore. I used an other paypal account to check it too and it doesn’t work this way anymore. They now call you by phone. And just after logging in it asked me to ‘update contact information’ and add an extra phone numer.

Seems that paypal is secure again (for now).

Whow it seems to work out of the box software download.

MaemoWordPy seems to be great.

Someone already experienced that you had to configure an IP by hand somewhere in an OS?

Good. I have been experiencing that for a while and I REALLY would like it if UI designers made life a little more nicer for me.

If I type an IP like 172.16.16.1 in a box and a netmask of 255.255.255.0 the software could fill out 172.16.16. already for me in the ‘default gateway’ box. Maybe a bit greyed out (like you see in much searchbars all over the internet) but I would really like it. Even Mac OS X doesn’t have this feature.

Ohw and for anyone who wants to implement it, it’s a very simple rule: at every position where the netmask is 255 you can just copy the number from the IP. It would make life just a bit easier.

Damn.. wordpress was bad, is bad and will be bad. But at least I have a new version.

For some technical reasons I don’t have my old posts here. I maybe will put them back.

See ya,

Mendel

[Nederland/English/Deutsch]