grossartig / vanmoof-encryption-key-exporter Goto Github PK

Kudos for putting this together. The message say to come back in a few days for an update to support other models that the S/X3. I have been coming back regularly. :-) can you advise what timeline you might looking at to include these newer models?

thanks

Issue Description:

Our website, vanoof.grossartig.io, has been mistakenly marked as a deceptive site by Google Safe Browsing. This misclassification has resulted in a red warning that hinders user access. We respectfully request a thorough reevaluation of our website's classification to rectify this issue.

Steps to Reproduce:

Access vanoof.grossartig.io.
Observe the deceptive site warning from Google Safe Browsing.

Expected Behavior:

Users should be able to access vanoof.grossartig.io without encountering any deceptive site warnings.

Additional Information:

The VanMoof Encryption Key Exporter hosted on vanoof.grossartig.io is a valuable tool, enabling secure encryption key downloads.
We prioritize transparency by open sourcing the project and encouraging code review and self-hosting.
The deceptive site classification adversely affects our ability to serve the community and contribute to reducing e-waste.
Previous appeals to Google have not received a response, prolonging the issue.

We're working on resolving this matter.

As I need to enter my vanmoof credentials into this application I'm quite cautious about where this data might end up.

So I installed the application locally and opened it in the browser, checking if any sources are loaded that do not come from localhost, which would eventually put me at risk of having my vanmoof credentials stolen.

Unfortunately I realized that this is the case. The application loads a script from the authors site. ( https://plausible.grossartig.io/js/script.js )

I'm not implying that this happens out of malice and that the author of the script is trying to steal credentials. If I understand it correctly this script is used for analytics and tracking.

However I would recommend to not load that script (at least if the application is running locally) in order to keep up trust in the system that the author created.

I was able to login and download but the file does not have any data in it (file enclosed (JSON - > TXT))
Don't know if it matters: my bike is a S3.

Exporter Version: v0.2.3

bikeData_2023-07-26T08-17-45.675Z.TXT

Hey, I tried to login in a local started container as well as in your online version. Both times I run into an error:
Application error: a client-side exception has occurred (see the browser console for more information).

Google chrome console says:
Failed to load resource: the server responded with a status of 401 (Unauthorized)

I only have a S5 bike in my Account. The login via vanmoof homepage works and I can see my bike there.

Anyone else having that issue?

Full console output:
Failed to load resource: the server responded with a status of 401 (Unauthorized) framework-305cb810cde7afac.js:9 TypeError: Cannot read properties of null (reading 'encryptionKey') at index-e24d57ea1207b8d6.js:1:3705 at Array.map (<anonymous>) at P (index-e24d57ea1207b8d6.js:1:3442) at ab (framework-305cb810cde7afac.js:9:60909) at ud (framework-305cb810cde7afac.js:9:72795) at i (framework-305cb810cde7afac.js:9:120350) at oO (framework-305cb810cde7afac.js:9:99102) at framework-305cb810cde7afac.js:9:98969 at oF (framework-305cb810cde7afac.js:9:98976) at ox (framework-305cb810cde7afac.js:9:95728) a6 @ framework-305cb810cde7afac.js:9 main-d5c9aef8f3ea3bae.js:1 TypeError: Cannot read properties of null (reading 'encryptionKey') at index-e24d57ea1207b8d6.js:1:3705 at Array.map (<anonymous>) at P (index-e24d57ea1207b8d6.js:1:3442) at ab (framework-305cb810cde7afac.js:9:60909) at ud (framework-305cb810cde7afac.js:9:72795) at i (framework-305cb810cde7afac.js:9:120350) at oO (framework-305cb810cde7afac.js:9:99102) at framework-305cb810cde7afac.js:9:98969 at oF (framework-305cb810cde7afac.js:9:98976) at ox (framework-305cb810cde7afac.js:9:95728) ee @ main-d5c9aef8f3ea3bae.js:1 main-d5c9aef8f3ea3bae.js:1 A client-side exception has occurred, see here for more info: https://nextjs.org/docs/messages/client-side-exception-occurred ee @ main-d5c9aef8f3ea3bae.js:1

When trying to log in (locally an on on vanmoof.grossartig.io), I get the following error message and console logs.
Tried in safari and firefox.

Application error: a client-side exception has occurred (see the browser console for more information).

[Error] Error: Minified React error #418; visit https://reactjs.org/docs/error-decoder.html?invariant=418 for the full message or use the non-minified dev environment for full errors and additional helpful warnings.
reportError (framework-2c79e2a64abdb08b.js:9:46428)
(anonymous function) (main-f11614d8aa7ee555.js:1:16887)
(anonymous function) (framework-2c79e2a64abdb08b.js:9:111467)
oI (framework-2c79e2a64abdb08b.js:9:111646)
oS (framework-2c79e2a64abdb08b.js:9:95018)
oS
x (framework-2c79e2a64abdb08b.js:33:1375)
T (framework-2c79e2a64abdb08b.js:33:1905)
[Error] Error: Minified React error #423; visit https://reactjs.org/docs/error-decoder.html?invariant=423 for the full message or use the non-minified dev environment for full errors and additional helpful warnings.
reportError (framework-2c79e2a64abdb08b.js:9:120834)
(anonymous function) (main-f11614d8aa7ee555.js:1:16887)
(anonymous function) (framework-2c79e2a64abdb08b.js:9:111467)
oI (framework-2c79e2a64abdb08b.js:9:111646)
oS (framework-2c79e2a64abdb08b.js:9:95018)
oS
x (framework-2c79e2a64abdb08b.js:33:1375)
T (framework-2c79e2a64abdb08b.js:33:1905)
[Error] Failed to load resource: the server responded with a status of 404 () (favicon.ico, line 0)
[Error] Failed to load resource: the server responded with a status of 401 () (getBikes, line 0)
[Error] TypeError: null is not an object (evaluating 'e.key.encryptionKey')
a6 (framework-2c79e2a64abdb08b.js:9:69820)
(anonymous function) (framework-2c79e2a64abdb08b.js:9:70332)
lH (framework-2c79e2a64abdb08b.js:9:51354)
uY (framework-2c79e2a64abdb08b.js:9:90791)
e (framework-2c79e2a64abdb08b.js:9:111125)
(anonymous function) (framework-2c79e2a64abdb08b.js:9:111134)
oI (framework-2c79e2a64abdb08b.js:9:111646)
oS (framework-2c79e2a64abdb08b.js:9:95018)
oS
x (framework-2c79e2a64abdb08b.js:33:1375)
T (framework-2c79e2a64abdb08b.js:33:1905)
[Error] TypeError: null is not an object (evaluating 'e.key.encryptionKey')
K (main-f11614d8aa7ee555.js:1:10101)
fn (main-f11614d8aa7ee555.js:1:9178)
componentDidCatch (main-f11614d8aa7ee555.js:1:7668)
(anonymous function) (framework-2c79e2a64abdb08b.js:9:70440)
lH (framework-2c79e2a64abdb08b.js:9:51354)
uY (framework-2c79e2a64abdb08b.js:9:90791)
e (framework-2c79e2a64abdb08b.js:9:111125)
(anonymous function) (framework-2c79e2a64abdb08b.js:9:111134)
oI (framework-2c79e2a64abdb08b.js:9:111646)
oS (framework-2c79e2a64abdb08b.js:9:95018)
oS
x (framework-2c79e2a64abdb08b.js:33:1375)
T (framework-2c79e2a64abdb08b.js:33:1905)
[Error] A client-side exception has occurred, see here for more info: https://nextjs.org/docs/messages/client-side-exception-occurred
K (main-f11614d8aa7ee555.js:1:10118)
fn (main-f11614d8aa7ee555.js:1:9178)
componentDidCatch (main-f11614d8aa7ee555.js:1:7668)
(anonymous function) (framework-2c79e2a64abdb08b.js:9:70440)
lH (framework-2c79e2a64abdb08b.js:9:51354)
uY (framework-2c79e2a64abdb08b.js:9:90791)
e (framework-2c79e2a64abdb08b.js:9:111125)
(anonymous function) (framework-2c79e2a64abdb08b.js:9:111134)
oI (framework-2c79e2a64abdb08b.js:9:111646)
oS (framework-2c79e2a64abdb08b.js:9:95018)
oS
x (framework-2c79e2a64abdb08b.js:33:1375)
T (framework-2c79e2a64abdb08b.js:33:1905)

Hi!

As you are probably aware, this tool doesn't work for the SA5. This is because the SA5 uses a certificate based authentication scheme, where you create an ed25519 key pair, which Vanmoof creates and signs a certificate for.

Until recently, this certificate was only valid for 7 days, which makes it kind of meaningless to save in case VM should stop issuing certificates. However, recently VM has started to sign the certificate with a 10 year validity instead (thankfully).

As such, I've released a key generator and certificate exporter script for SA5 bikes. This is currently very unrefined, and I'd love for this project to integrate a more refined version of it:

https://gist.github.com/magnusnordlander/c8682fda2e15b813e5308624877cce59

What's next? How that key can be used?

Hey there,

using your hosted service I am able to download a json (which viewed as text) looks fine. Importing it in the Bikey App yields an error that parsing the file failed. At the same time retrieving the data through bikey tells me "no bike found for this account".

Could there be an incompatibility for the older S3 variants which not yet have the FindMy integration?

My bike refers to be the following according to your json:

• "Edition":"ES-3 2G"
• "modelName":"VM01-200-2G EU"

i am currently away from my bike so sadly I can't edit changes in the VanMoof app which needs a bike to be connected...

Big thanks
Arne