VanMoof encryption key exporter

https://github.com/grossartig/vanmoof-encryption-key-exporter

by doener • 3 years ago

214 221 3 years ago

gregdoesit• 3 years ago

Note that a competitor to VanMoof, Cowboy Bikes, have also created an iOS app - with a beta on the App Store - that supposedly does the same (saving the encryption keys locally).

I say supposedly because the source is not available to inspect. However, the linked FAQ states that no data is stored outside the app.

Here it is: https://bikey-app.cowboy.bike/

(Note this is not en endorsement for Cowboy - whom I know nothing about - just pointing to the currently only iOS app I know of to save these same encryption keys for VanMoof owners).

yabatopia• 3 years ago

Going from Vanmoof to Cowboy Bikes is like switching from the plague to cholera.

Same modus operandi: excessively VC funded, lots of hype, proprietary parts, mounting losses, loosing money with every sale, ... and it's getting worse every year. Cowboy Bikes is just another bankruptcy waiting to happen.

wraptile• 3 years ago

How on earth are they losing money selling a 3000-5000$ _bicycles_ lol. I'm flabbergasted.

patd• 3 years ago

The team behind Cowboy also has a history of going bankrupt and not doing the right thing. Their previous venture was a Uber Eats competitor and they took the end user’s money until the end but never paid the restaurants nor the deliverers. That’s the main reason why I can’t get myself to buy one their bike. But it seems Van Moof wasn’t any better.

jtwaleson2• 3 years ago

I'm riding a Cowboy right now, and I chose it because they didn't have the service and quality issues that Vanmoof had. I've been very happy with it and hope they will not go under. I was annoyed with the app but I created a bluetooth key fob so I don't have to use the app to unlock it. Now I'm even happier with my daily rides.

That being said: if I were in the market today I think I'd go for the Veloretti Ace. Less proprietary parts, great design and owned by a stable company.

vayan• 3 years ago

Yeah I would go the Ampler Bikes way if I were in Europe. More grounded company.

wjnc2• 3 years ago

Don’t buy products made by VC funded firms! Especially not if it’s a real product and you value repairability and service. VanMoof made losses the size of their revenue. They made bikes… where’s the natural monopoly to be chased there?

dtech2• 3 years ago

Blitzcaling to achieve monopoly is not the only reason for funding. A manufacturing company like this has high up-front costs for R&D and manufacturing, orders of magnitude more than a typical software companies. You also don't need to chase a monopoly to make expanding to new market with investor money a sound decision. Obviously VanMoof didn't make it work here and had horrible OPEX due to expanding to markets without getting the sales to support it.

Arnt10• 3 years ago

What did Van Moof make, exactly? Do you think they were normal bikes?

They made expensive e-bikes with theft recovery features. They have features that make it possible to trace and locate them, and Van Moof would actually do this. For people who spend €3-4k on an easily stolen object that the police won't care about, that's a unique selling point.

wiseowise• 3 years ago

Waiting 6 weeks for any kind of repair was also their unique selling point?

Cthulhu_2• 3 years ago

Note that when they first came out, they were actually pretty affordable; since then, competition and mass production spun up and you can get an e-bike for <€1K now, and they'll be less custom made, more generally available parts too. The brand's USP then became that they look and are pretty unique, which is cool on one hand, but they weren't able to make it financially viable. Probably because they relied on VC money, and spent it on people who knew they had VC money to burn.

mattio• 3 years ago

I am not sure why everyone thinks they are expensive. Just the bike is about 2000 euro.

There are eBikes costing 4000 euro.

My van moof was about 2800 because I bought the 2 packages taking care of theft and repairs. Because of their image I never have to lock the bike besides their amazing kick lock bike, so getting on and off the bike with locking and unlocking it is a matter of seconds.

This is not expensive at all.

*their image amongst bicycle thief’s makes the bike unattractive. They hunt down stolen bikes if you bought their theft service. If they can’t find it you get a new one.

skerit• 3 years ago

They made expensive e-bikes with theft recovery features

My husband's VanMoof bike got stolen in Ghent, they couldn't do shit about it.

crote• 3 years ago

An AirTag is $30. So yeah, what did they make?

Ultimatt• 3 years ago

A more unique selling point is having an easily and widely serviced ebike since its complexity and serviceability is worse than a normal push bike for ordinary people. You can get trackers for most other ebike systems.

WeylandYutani• 3 years ago

Not everyone coming to HN may be aware of this but basically every bicycle producer has an app now.

I'll give van Moof credit for inventing some neat things but as we all know just being the first doesn't automatically mean success.

dr_dshiv3• 3 years ago

Van Moof bikes are EVERYWHERE in Amsterdam. They obviously shouldn’t have taken so much investment. But if you can capture a latent market need like that, there probably is a lot of opportunity at scale, too.

oblio10• 3 years ago

They're losing money on every sale... what market?

clydethefrog• 3 years ago

There is a lot of bikes in Amsterdam in general. Van Moof just stands out because of their 1 marketing, 2 annoying signature noise whenever people bump into them, 3 loud owners that general use it as a status symbol and 4 joke status due to national Dutch publications writing about all the shortcomings of owning this bike.

I live in Groningen, a Dutch city that is even more suited for bikes, and I rarely spot any Van Moof here. There is a big amount of Swapfiets though, because there is a bigger demographic for a sturdy bike that costs 20 euro as month. You can have that bike in theory for 8 years and it still will not have the same cost as a Van Moof.

planb• 3 years ago

While I think you're right, you could have said the same thing about Tesla cars - but it worked out in that case. The problem with VanMoof was that they prioritized growth over quality - which may be a side effect of taking VC money, but is plain dumb if you're selling physical goods that are expensive to fix. Just talk to anyone with a VanMoof or see the subreddit: Nearly every bike they sold required multiple repairs during the warranty.

Here's my personal story (they sure didn't make profit on me):

I got my S3 in 2020. It went dead a few weeks later. We didn’t have service hubs close, but I told the support I could do the repairs myself. The sent me a new main unit, that didn’t help so I had to send it in (they wouldn’t ship the battery to me because of some regulatory issues). Took a while but I got a working bike back. A few weeks later the e-shifter broke. Again I fixed that myself and for a few months everything was fine. Then the battery (or main unit) died again in late 2021. I insisted on getting a replacement bike and could convince them to swap my S3 for the second gen one (that with Apple Find-my).

On that bike I had to replace the left button and later the e-shifter (again). The rest of 2022 went fine but the eshifter broke again this spring and it got stuck in the 4th gear.

As the bike is now out of warranty, I did not contact support and went with just riding it this way until yesterday, when I finally got around to fix the (mechanically defective) eshifter using parts from the old (electronically defective) eshifter that I replaced last year. Now it is running fine again. Wouldn’t get another VanMoof as my next bike though.

londons_explore• 3 years ago

Part of a premium product is the number of failures to expect.

To reduce the number of failures, they need a fleet of thousands of bikes in the field to monitor and redesign any component that might break.

But those bikes aren't yet reliable - so they shouldn't be putting their brand name on them.

Other manufacturers get this right. It is pretty common I buy something from Aliexpress for really cheap and it is clearly a premium product that has had the logos removed and is being sent out for user testing. They normally come with a card in the box saying "If this breaks, email this gmail address and we'll exchange it for a new one for free". They do that because they really want to know about failures. That lets them redesign the product to make it reliable, which in turn lets them put the premium brand name on it.

You simply can't make a product reliable with lab testing alone. The only way is with real users and time.

midoridensha5• 3 years ago

This is why I only buy bikes with mid-to-high-end Shimano components. My bike is my daily transportation many days; putting up with this kind of unreliability is unthinkable.

wjnc2• 3 years ago

I was thinking about Tesla while posting. It's the natural counter argument. That's why I specifically mentioned the target market (in my opinion): bikes. (One of the reponses above is critical of my target market definition. Hey, I'm Netherlands-based. Two wheels is a bike. Whether € 10 or € 10k. I can understand that theft and bike services are more of a US value proposition.)

The thing is I think Tesla pulled off a near miss with their repairs, waiting times and general inavailability of spare parts. That was a very big issue for a few years. Tesla got a helping hand (in several European countries at least) in tax breaks for the electric early adopters. With the tax brakes came the premier buyer: lease companies (say NED / BEL). You know what lease companies are good at? Supply chain management on behalve of their customers. If a Tesla was out for repairs for a month, the lease company had to deliver a temporary car. The tax brakes for the consumers kept the demand up, no matter the service record. No tax incentives helping VanMoof.

Second is that I think the disruption Tesla caused in the car market at that time was a lot larger than that of VanMoof. As others point out: VanMoof didn't leapfrog (e-)bike market and didn't get a temporaty moat. They were actually a late to pivot to electric. Their earliest models were based on non-electric, affordable and robust (as a buyer at that time: they weren't robust at all). Then by playing the high margin-high marketing angle they just weren't a viable option in the price range where quality starts to matter.

All in all: Tesla got a temporary technological head start with some favourable tax headwind giving them just enough runway to manage the supply chain. VanMoof had no technological head start, no tax incentives and crashed and burned on the supply chain.

haspok7• 3 years ago

Just look at their homepage, it is clear where the VC money went. Instead of making really good quality bikes they spent all the money on web design.

They thought they can do what Canyon can do, but Canyon is a much, much bigger company.

oblio10• 3 years ago

Is there some place where I could check out the "big" bike companies? Especially electric commuter bikes that deliver to Europe?

fermentation• 3 years ago

I'm just now hearing about VanMoof failing. This is surprising, considering these bikes seem to have pretty meh build quality and are being priced much higher than one would expect.

ashald• 3 years ago

I've got an X3 that is rock solid even after me and the bike flying apart in an attempt to avoid collision with a truck. And its design is the primary reason why I decided to start biking again to begin with - I just find it so pleasantly satisfying I just want to ride it. So IDK, but I haven't seen a viable alternative yet.

nicbou2• 3 years ago

What about it makes it so satisfying?

If you're not into bikes, try a few of them. I find any properly tuned bike to be an absolute joy to use, although I never tried a Van Moof.

madeofpalk7• 3 years ago

The S/X3 was the worst bike they made. I regret foolishly 'upgrading' from S3 to X3. The eshifter in it was notorious for reliability.

I'm convinced the S/X3 is why the company is going under.

aden1ne• 3 years ago

The build quality is so bad they are going under in warranty claims. They also don't use common components, so very few bike repair shops in high-volume markets (e.g. Netherlands) are willing to touch VanMoof bikes.

arp2423• 3 years ago

Apparently they spent €8M on warranty claims, on an income of €83M, so ~10% of their income. It's not really clear to me if this is exuberantly high, especially since this may also cover non-traditional "warranty" like their theft recovery.

fragile_frogs• 3 years ago

I ride BMX, road bikes and Mountain Bikes. I've tried a VanMoof two years ago and the build quality was terrible. You couldn't pay me to ride one.

chizhik-pyzhik• 3 years ago

A cursory look at the code and this seems legit, nothing that would steal my login credentials. It's a small codebase.

I'm curious how long the hardcoded api key here will work, though: https://github.com/grossartig/vanmoof-encryption-key-exporte...

used in https://github.com/grossartig/vanmoof-encryption-key-exporte...

alias_neo• 3 years ago

I don't know anything about these bikes; but what is one supposed to do once they retrieve their keys? Does the app/bike provide an alternative method of presenting the key? Are keys rotated, so they need to be downloaded more than once (I assume that's that's the case since this code is intended to be run as a service, in a Docker container)? If so, what happens when their servers do shut down and there is no API?

Are people like the creator of this tool hoping for a future option to make use of the keys, and they're just being backed up for a rainy day at this point?

rjacksonm1• 3 years ago

The keys in this case are used for bluetooth comms locally between somebody's device and their bike.

These are ordinarily used by the VanMoof app to unlock the bike and control the bike's settings.

There are already some third-party apps (Moofer, Mooovy) to allow alternate access to those settings – including some hidden ones.

With a few tweaks those third-party apps should be able to support direct key upload, rather than having to log in and proxy authentication through to VanMoof's API.

pilif• 3 years ago

I assume that's the key used by the app. So if they kill that key, they also kill all existing applications.

That's the thing with this kind of "protection". If your proprietary app needs to access the server, anybody who can either extract the key from the app with reverse engineering or who can listen in on the communication between app and server will be able to use that API.

It's the same issue as with DVD encryption: If you need to show the movie to people, people need to be able to decrypt it. If this needs to happen offline, then the material needed for decryption must be static and either be on the disk on in the player - where it can be extracted and used by third parties.

fsckboy• 3 years ago

if you're going to make a tool that does what this does, you gotta call it Vanmoof Diver

ano-ther• 3 years ago

Honest question: what’s the appeal of a bike that needs an internet connection & app to unlock?

gnopgnip• 3 years ago

If it’s stolen they will either recover it or replace it. And everyone knows this, so no one will buy a stolen one and they are less likely to be stolen.

fh973• 3 years ago

If they're still in business.

TeMPOraL2• 3 years ago

And everyone knows this

You mean they know the vendor is an infinite supplier of free bikes to steal, deSaaSify, and sell to a different market?

Either way, the message doesn't spread itself; I wouldn't overestimate how much small-scale semi-pro thiefs know or care about bullshit tech startups.

j-a-a-p• 3 years ago

Ah, now i am beginning to understand why they needed 200 million to develop a bike...

onion2k• 3 years ago

Not any more, so owners will probably need to be a bit more careful now.

barefeg• 3 years ago

Maybe a clarification: it doesn’t need both the app and internet connection to unlock. There are 2 ways to unlock and one of them uses the app and Bluetooth (no internet).

In terms of the appeals, I see it the other way around. The app is just the means to get the feature set to work; people don’t buy the bike because it has an app. There might be other implementations of the features that don’t require an app.

jjav• 3 years ago

Honest question: what’s the appeal of a bike that needs an internet connection & app to unlock?

I struggle to understand those who think something like that could be a good idea.

Isn't it obvious that an app will not be around for as long as a bike can last?

I have a bike from the early 90s, that's over 30 years. Does anyone think an app will be around even for 10 years, let alone 30+?

benoliver9992• 3 years ago

I worry about this with most components of e-bikes. I suppose a mid-drive one is probably always gonna have parts you can replace but custom kit like VanMoof seems ready for landfill.

seu• 3 years ago

Isn't it obvious that an app will not be around for as long as a bike can last?

That's the softwarization of everything, with its in-built early obsolesce: they clearly expect you to start replacing your bike as frequently as you replace your phone, irrelevant of how long the hardware itself is still functional.

RajT88• 3 years ago

A buddy of mine is a hardcore rider. He goes through a $5k bike every 5 years or so.

Could he refurb the titanium frames for newer parts? Maybe. At some point racing tech moves on and you need a newer frame for the latest and greatest stuff to fit.

blackbeans2• 3 years ago

While what you are saying is true and the market is moving towards long term solutions because of environmental reasons, at the moment the lifespan of electric components in bikes is usually set at 5 years with 2 years of warranty for the consumer.

Bikes are made of aluminium these days instead of steel, which gives them a lifespan of about 10 years, certainly not 30.

If you buy an ebike, you must be prepared for maintenance and replacement of parts. That's the state of the market right now.

I agree that making an app mandatory for a bike is a bad idea, and I would never buy such a solution. However this is an urban city design bike, aimed at a specific group of customers who do value these kind of innovations.

lm284692• 3 years ago

Isn't it obvious that an app will not be around for as long as a bike can last?

People under 25 don't know better, they genuenly haven't experienced anything else than Chinese made self destructing Bluetooth enabled plastic gadgets

vultour• 3 years ago

This is why I struggle updating my old PHP apps. It sure would be nice to refactor it into something newer, but I really don't want to run it on some VC-funded wet dream that disappears one day with 3 hours of notice.

madeofpalk7• 3 years ago

Honest answer - I don't expect the e-bike to last past 10 years. I expect(ed) that by the time the app was unavailable I would have moved on to a different e-bike for whatever reason.

I don't want a non-e-bike. I want a bike with pedal assist.

Daz1• 3 years ago

...You have less to worry about with regard to theft? I don't understand your question.

walthamstow• 3 years ago

I have an older model, the ES2, which can be unlocked by tapping a key code into the button in the handlebars. I don't ever use the app for anything, it's not even downloaded to my current phone.

Rebelgecko3• 3 years ago

You don't need an internet connection or the app, but that's the most convenient way - you can enter a PIN on the bike itself to unlock it.

I think the appeal (at least for me, I considered one but never got one) is that it makes the bike harder to steal. Someone can't just ride off on it after they cut your lock. I worry about leaving my $600 bike out in public, so I'd be super paranoid about a $2000+ bike.

herrherrmann• 3 years ago

Similar appeal for me! I have a neighbor with a VanMoof and they are one of the few bikes that can just be parked in a corner with a kickstand and doesn’t need to be locked to a metal bar or other static thing. And this VanMoof has been around in our backyard for quite a few years, so I suppose the “don’t steal me, I’ll be tracked” tactic works. That being said, once I tried riding a (older non-electric) VanMoof, I was shocked how terrible it felt to ride – So, I never considered getting one in the end.

tjoff• 3 years ago

Thought they just throwed them at the back of a van rather than biked away.

Either way you most likely won't recover it.

jansan• 3 years ago

I once overheard a conversation at a bike shop where a customer complained that he could not switch on the light without using the app. On that day I knew I had made a good decision bying a steel frame non-battery bike.

Gasp0de6• 3 years ago

How does it prevent the thief from riding away? Does it block the pedals using the motor or something?

tiku• 3 years ago

The appeal was that the bike signalled that you are not just a normal bike rider. You are one of the few lucky enough to be able to afford one.

jillesvangurp2• 3 years ago

The appeal is that thieves need to do the same thing. Which limits the value of the bike for them because it makes it easy to track them down. It's part of the theft protection. Which, if you've ever had your bike stolen is a big selling point for these bikes. Theft is a reason why I've never bothered with premium bikes. Because you can't take them anywhere and expect them to not get stolen. Van Moof changed that. They can be stolen of course but it's a lot of hassle and bike thieves learned pretty quickly that there's very little point in doing so as they'll go through a lot of trouble to track down the bike. Which means it's risky.

Van Moof actually had an insurance policy that you could buy that included a guarantee to either track down your stolen bike or replace it. The so-called bike hunters would attempt to track down the bike. And stealing one involves dealing with a very loud and obnoxious alarm that is motion triggered that can only be disabled by unlocking the bike.

Those were all good things. What's not good is all the proprietary components, the poor quality of those, and the over dependence on the Van Moof servicing. That's what's killing the company. Basically classic VC funded company problem: great idea and product but hopeless execution resulting in a company that has a lot of cost but no profits making that problem worse through rapid growth and inflated investor expectations. The debt bubble burst last year, they are running out of cash now, and game over pretty much.

I actually have a lease bike from a company called Swapfiets here in Berlin. Very nice deal. I pay them per month and the bike is basically ignored by bike thieves and vandals. There are hundreds of thousands of these bikes across Europe. Each bringing in revenue through a subscription. Genius idea.

The bike is decent but nothing special. What they sell is peace of mind. I get to ride a decent bike and not worry about it getting stolen. Very low tech solution; the bikes are just very recognizable which means selling them is not a thing for thieves. If it gets stolen and I can show the key, my risk is 60 euros. I've had one for three years now and I park it all over town in all the hot spots where bikes get stolen, vandalized, etc. without a second thought. Not a single incident.

ensocode• 3 years ago

This. I also would not like my bike to rely on an internet connection. At least in my view this lowers the value of the bike.

midoridensha5• 3 years ago

Theft is a reason why I've never bothered with premium bikes. Because you can't take them anywhere and expect them to not get stolen.

Maybe where you live. Here in Tokyo, bike theft isn't a big problem, and there's lots of reasonably expensive bikes (and e-bikes) parked on the sidewalk with just a lock through the wheel spokes.

tgv• 3 years ago

Idk the Berlin market, but in The Netherlands, homebase of Swapfiets (literally: swap bike) as you probably know, a decent secondhand bike costs €100-200. Nobody comes to fix your tire, but if it doesn't get stolen, it's a lot cheaper than a Swapfiets. Still quite a few of my (younger!) colleagues have a Swapfiets. I don't really get it.

ornornor2• 3 years ago

The appeal is that thieves need to do the same thing.

Couldn’t you achieve that with a hardware key though? You don’t really need a server and still have a hardware Bluetooth key that is secure with the bike being useless without it? Then you don’t depend on a company staying afloat and granting you the privilege to keep using your bicycle as they see fit/VC greed dictates.

madeofpalk7• 3 years ago

It doesn't need an internet connection & app to unlock.

It needs an internet connection to initially get the bike's encryption keys. After that the app can communicate with the bike over bluetooth without internet access.

And then, you actually don't even need the app to unlock the bike. You can unlock the rear hub by entering a passcode physically on the bike without the app. Occasionally the app/bluetooth conked out and I had to unlock using the code.

demanxe• 3 years ago

Looks like you put some nice work into the project, congrats!

xyst• 3 years ago

Wow - I was really looking forward to the VanMoof V. Shame to see them struggling financially.

It was supposed to be delivered in December 2022. But it was eventually pushed back to end of this year (2023).

Contemplating canceling my pre-order ($20-30?) now.

jbverschoor3• 3 years ago

They’re almost bankrupt.. they filed for “uitstel van betaling” yesterday or Wednesday

jbverschoor3• 3 years ago

Which means they legally don’t have to pay anyone right now.

At least that’s what I always understood about it. Not sure if that’s “chapter 11” or somethings else

sjaak• 3 years ago

If you want one there are MANY second hand (cheap!) ones for sale on marktplaats.nl as we speak -- for reasons that don't need explaining :)

NoLinkToMe• 3 years ago

He's talking about the V, which is not out yet. Not the S5 or A5, which indeed your post applies to.

jonasdegendt2• 3 years ago

This reminds me of Boosted Boards, which was also VC funded and got killed when Trumps China tariffs killed any profits they had on the hardware.

When Boosted went under years ago some people tracked down the manufacturers of the individual components and to this day you can buy brand new replacement motors. It'll be interesting to see if a market pops up for VanMoof replacement parts as well.

I sure hope so, I'm sitting on an S3 with a broken e-shifter. Support told me they didn't have any in stock and they'd let me know when they did. With hindsight I know now they probably hadn't been paying suppliers for a while now, and weren't getting any parts in because of that.

syndacks• 3 years ago

You don’t need your phone (or internet) to unlock or use the bikes. All these posts bury that part. But fuck Moof, saw this coming a while ago.

VanMoof encryption key exporter

Related Stories