KM's Fairy Godmother Department

[major_clanger]

After my nasty labels-gumming-up-printer experience the other day, I emailed Konica Minolta's technical support line to ask for advice on if it was possible to clean the image transfer belt of my printer. (In case anyone's wondering what this bit does, I found a nice explanation whilst googling for advice). At most I was hoping for some hints on whether or not I could use WD-40 or IPA, and to be honest I was rather expecting to hear that there wasn't much I could do short of replacing the ITB assembly - which costs about £300.

I was thus pleasantly surprised to get the following reply:

Dear Mr Bradshaw,
I will send you some cleaning solution to remove the residue.

Kind regards,

Shaun Lamberton
Technical Support Agent,
Konica Minolta Printing Solutions

Thinking objectively, I can see the business sense behind this generous gesture: a happy customer with a working printer will keep on buying expensive colour toner cartridges. Nonetheless, it's a very prompt and helpful response; Mr Lamberton, I salute you.

Regarding the weekend's other hassle, I finally got my car back today, after paying a bill that made my Flexible Friend cringe to the tune of a sum that just made it into four figures. It does seem that everything that could wear out did so at the same time, but spread over five years and 75,000 miles I suppose that it doesn't seem quite so horrifying. As it is, the garage were very apologetic for the delay - one of the replacement bits had to be re-ordered as the first box had the wrong part inside - and not only discounted some of the parts but threw in a free valet.

This was also the first time I've had one of the new MOT certificates. Having been studying land law, I can see the similarity with the changes that the Land Registry have made recently, in that in both cases (buying land or getting a car MOT'd) the bit of paper you get is no longer the legal proof in its own right, but is rather just a notification of the update of a central electronic register. I'll be interested to see how well the security works on the new system, as I understand that concerns in this area led to long delays in introducing the system. But if it all works, the idea of being able to independently verify that a car's MOT is genuine is a good one. And it's nice to see that the standard form has a feature that some garages have been using for a while: a peel-off sticker for your windscreen with a reminder of when the next test is due. I just hope it's not prone to coming off inside the test centre's printer...

Comments

[pigeonhed.livejournal.com]

Headline baffled me, then realised different KM -- I could usea fairy godmother though!

[purpletigron.livejournal.com]

the idea of being able to independently verify that a car's MOT is genuine

Having thought about access to information, and the analogy of medical confidentiality: Only good if there are a limited number of named individuals with access to the database. Otherwise, the scope for data misuse balloons.

[timill]

All MoT testing stations must have write access, and both we and the insurance industry have read access. And I'm sure there are others.

So that's a lot of people...

[major-clanger.livejournal.com]

Why?

There are all sorts of very good reasons why medical data is and should be confidential (e.g. the potential for discriminatory treatment). But why should it be a problem to be able to ask if the authentication code on an MOT certificate is actually associated with the vehicle it purports to be for?

The most one could do with the current system, as far as I could see, is come up with random 13-digit numbers and see if they happen to coincide with a particular car registration. Even if you hit lucky, all you get back (I've just tried it with my details) are the make, model and colour, mileage, date of test and phone number of the test centre. Other than that the latter probably indicates very roughly where the owner lives, this does not really tell you a lot. Since the chances of guessing are so small, the only way you'll realistically get this info is if you have the test certificate, in which case you have it all in hard copy anyway.

[purplecthulhu.livejournal.com]

Given what you've said is there already, there are several avenues of abuse open. Firstly, the government can, and probably already has, sold the insurance industry read access. You could thus expect unsolicited calls aimed at you for insurance purposes, loans to buy a new car, etc etc. If read access is sold further, then you can expect contact from car manufacturers etc. who think you want their products. The problem here is that you do not control who has access to the data and while there may be restrictions on access now, these can change very quickly and easily. And that's before you start on what's possible with unauthorised access which will be easier to get with this system. Maybe there are robots out there now firing 13 digit codes at the system and scraping the results into a big database.

And the ever lingering worry is what might be stored here that you can't see. Is your address there, for example, but only visible to those authorised - which could be those spam marketers if they grease Gordon Brown's hand with enough silver?

[major-clanger.livejournal.com]

Bu if you're going to assume the Evil Guvmint is going to do all that, then you might as well assume it's going to sell the vehicle register, the numberplate database and the full list of driving licences!

[purplecthulhu.livejournal.com]

To be honest I'm surprised they haven't.

The key new threat here seems to be the open access to the database after entering a 13 digit code from anywhere on the internet (if I'm interpretting what you've said about the system correctly). With this, I'm sure some script kiddie is ready to scrape a lot of the database already, whether HMG sells it or not.

[major-clanger.livejournal.com]

Well, to get a valid response you have to enter the right combination of 13-digit MOT code and the vehicle registration. Any attempt to scrape the system is going to get a 99.9999...% rejection rate, which might just be noticed (the T&C on entering the site permit use only on the basis that you own the vehicle in question or genuinely intend to buy it).

If the system worked by entering the MOT code, and threw out the registration and other details, I'd agree with you. But what it does is take in the MOT code (which is only on the test certificate) and the registration, and - if and only if the two are paired in the VOSA database - it gives you the vehicle description and mileage.

So a program that looked like:

for MOT = 1 to 999999999999
for number = A11AA to ZZ55ZZZ (i.e. the complete list of valid registrations)
queryVOSA(MOT, number)
if query <> reject then print number, quert
next number
next MOT

might, access constraints on the VOSA database permitting, eventually list the description and mileage of every car in the country. But I think that we're talking a rather large value of 'eventually' here, as the response rate is going to be limited by (and throttleable via) the database report engine.

[purplecthulhu.livejournal.com]

OK - requiring the registration number does increase the search space substantially, and would be more of a block to script kiddies. I hand't grasped that was part of the system.

But there is a broader point... When you had the certificate, you were responsible for its security, and for the security of your own information. Now that its all on a publicly accessible server, you can no longer be respnsible for your own security. You have to rely on the programmers and operators that the government has got doing their job properly, and on the platform they work on being secure. And this is not only to direct, dumb attacks like the one I suggested, but also to more subtle ones based on the computiong infrastructure. Any idea what platform this all runs on and how secure that might be? Lets hope its not Windoze!

The problem with a lot of these current government IT projects is that they are taking the responsibility for information security out of the hands of a small number of identifiable individuals (eg. you, the MOT garage in this case, or, for the NHS medical records system, you, your doctor and their staff) and putting it in the hands of a lot of faceless people running networked systems that you know little about, and can do even less about checking or improving. They are saying 'trust us, we know what we're doing' when, in case after case in the past, they patently have not.

The MOT thing is a small delta on the overall problem. The ID card database, which represents a nationalisation of identity, is far worse.

The DVLA have sold your personal details

[purpletigron.livejournal.com]

BBC: The RAC Foundation had voiced fears the information was being used by so-called cowboy clampers. (http://news.bbc.co.uk/1/hi/uk/4493926.stm)

Re: The DVLA have sold your personal details

[major-clanger.livejournal.com]

Ah, now that is an example of misuse of data, and I hope it gets stepped on forthwith.