VanMoof encryption key exporter
github.com
github.com
They made expensive e-bikes with theft recovery features. They have features that make it possible to trace and locate them, and Van Moof would actually do this. For people who spend €3-4k on an easily stolen object that the police won't care about, that's a unique selling point.
Just from what I hear, it seems that there are more cases of unavailble parts this summer than a few years ago. Maybe the supply chains haven't quite settled after covid, even now.
The person who mentioned six weeks didn't specify whether Van Moof has a six-week average or whether it's a 99th percentile.
Words like "common" have stretchable meanings, though, and particularly on Twitter.
Before moving to the Netherlands I did a lot of repairs myself but I've totally stopped now that it's so quick to have them done for me.
What are the decent, mass market brands???
I'm in Europe, I don't want to buy a Mercedes S Class. Who sells the Volkswagen Golf of electric bikes? I just want decent build quality, decent comfort, decent features, good repairability and easy maintenance.
The electric bike market seems immature to me. I want 20-30 big bike brands that I can compare, just like the car brands here, for example:
But the comparability requires you first to pick a type of bike.
The listed price (€3699) is about the same as what I paid for it back then. I made one upgrade to it, by replacing the standard display with a Nyon (which includes satnav among other things) which added €400 to the price.
Awesome bike, absolutely the best bike I’ve ever owned. Rock solid, nothing rattles even on rough terrain or going over speed bumps. I highly recommend the satnav if you plan on touring around. You can pre-plan routes on your PC and upload them to the display (it has wifi). And with the belt drive it’s completely silent, which is nice if you like to tour through nature like me.
Golf would be a 1k bike as the original comment mentioned :-(
Decathlon own brands like B'Twin
There are eBikes costing 4000 euro.
My van moof was about 2800 because I bought the 2 packages taking care of theft and repairs. Because of their image I never have to lock the bike besides their amazing kick lock bike, so getting on and off the bike with locking and unlocking it is a matter of seconds.
This is not expensive at all.
*their image amongst bicycle thief’s makes the bike unattractive. They hunt down stolen bikes if you bought their theft service. If they can’t find it you get a new one.
> If they can’t find it you get a new one.
Can't figure out why they weren't profitable.
Their prices for that trace-or-replace service were quite a bit higher than what my insurance agency charges me for my theft insurance. That operation may have lost money, but that's not obvious.
I share your worries about the trace-or-replace service. Specifically about the "trace" part of trace-or-replace. Ok, the program is excellent promotion, and did put them on the map. But, tracing stops making economic sense very quickly: Bills rack-up very rapidly when you send a couple of your people in a multi-day hunt in an unknown location.
That said, it is a shame that you can’t have specialised bicycle service shops in the centre of London. VanMoof offered a pretty good bespoke experience and my X2 has had a few issues but it’s going quite well four years in. What goes up quickly comes down quickly, I suppose.
They have some fine features that IMO justify their prices, but I'm guessing that I'm an outlier wrt judging bike values and my neighbour more mainstream, so I called them expensive.
I mean, you can get a regular bike for €300, €700 if you want to splurge. But of course, the downside of that would be that you'd get more exercise.
If exercise was the primary focus alongside a commuter, then getting a non-electric bike would be likely the focus.
Source: I just bought a bicycle and went through months of asking colleagues and friends their opinions on e-bikes. I ended up with a bike cause I’m not planning to commute
And what you would have is an expensive bike. $2k is an expensive bike.
The fact the market offers a $3,000,000 car doesn't mean a $100,000 car isn't an expensive car.
We can stop going in circles. You think it's expensive, but it's not an order of magnitude more expensive, like your example cites. Others don't think it's that expensive, and I agree with them. Researching e-bikes 1-2k seems like market price, and they were within that range.
Otherwise 500-700 is the low end for quality bikes.
45 minutes of cycling on an electric bike was still plenty of exercise, and if I hadn't done that, I would've probably taken a train.
But when I choose too I can lower the assist level, pedal hard, and/or go faster and longer.
Best of both worlds. But I have a European ebike with torque sensing, not the glorified escooters with pedals where the motor is either full torque or no torque: I still have to pedal to make the bike move.
Eg. if your through axle breaks, good luck finding a store that stocks one in the correct length with the correct thread and the correct thread length, and even if you do, you'll probably end up paying 40€ for a small piece of metal.
The big exception right now are thru-axles, yes, but the vast majority of bikes don't use thru-axles (and there's no reason a vanmoof commuter bike would need to use those), they use quick release axles, and those are completely standard.
I've had very high end bikes where all but a couple components were standard, and those that weren't will probably become standard soon, too.
Another problem is that every manufacturer has their own standard, eg. Shimano has 24mm hollowtech bottom bracket axles, whereas SRAM has 30mm axles, and they come in a million different sizes (threaded BSA, threaded italian, 68mm wide or 73mm wide, press fit external or internal).
In any case, a bike shop will rarely have the part in stock, because there are so many of them.
Sometimes it's even worse, when a manufacturer just updates their "standard" every few years, eg. the Shimano i-Spec standard for mounting shifter levers has 4 incompatible variants.
ps. I also happen to own a Brompton, which is another strategy - fold your bike so you can take it with you anywhere. Even it was heavily overpriced (~900 GBP IIRC), and it has propietary parts so servicing is not easy. My excuse for buying it is that it paid back it's price in about a year of commuting (by not having to pay for public transport).
The actual cut off for the assistance is typically set to 27.5 km/h, because regulations allow for 10% of tolerance... Then, depending on transmission ratios, it can be quite comfortable to ride at ~30 km/h. The acceleration boost at lower speeds is still super useful.
Of course, VanMoof's and Cowboy's original spiel was that you could easily disable the limit in software.
Is this coping mechanism where you justify yourself you got a good deal from them?
My husband's VanMoof bike got stolen in Ghent, they couldn't do shit about it.
Certainly fun, but I think there are cheaper theft insurance policies out there.
I mean, even if a stolen bike has a working tracker and you're able to trace it to a particular house, do VanMoof's recovery team have the legal authority to bust the door down to reclaim it?
Manufacturers can purchase AirTag-like chips to integrate with their electronics. Done. Price per unit probably orders of magnitude lower than the AirTag retail price.
Of course the whole "locking system" with companion app is a separate thing. But as far as FindMy goes, it should be fairly simple. Would be interesting to learn what kind of royalties Apple charges.
I'll give van Moof credit for inventing some neat things but as we all know just being the first doesn't automatically mean success.
I live in Groningen, a Dutch city that is even more suited for bikes, and I rarely spot any Van Moof here. There is a big amount of Swapfiets though, because there is a bigger demographic for a sturdy bike that costs 20 euro as month. You can have that bike in theory for 8 years and it still will not have the same cost as a Van Moof.
Here's my personal story (they sure didn't make profit on me):
I got my S3 in 2020. It went dead a few weeks later. We didn’t have service hubs close, but I told the support I could do the repairs myself. The sent me a new main unit, that didn’t help so I had to send it in (they wouldn’t ship the battery to me because of some regulatory issues). Took a while but I got a working bike back. A few weeks later the e-shifter broke. Again I fixed that myself and for a few months everything was fine. Then the battery (or main unit) died again in late 2021. I insisted on getting a replacement bike and could convince them to swap my S3 for the second gen one (that with Apple Find-my).
On that bike I had to replace the left button and later the e-shifter (again). The rest of 2022 went fine but the eshifter broke again this spring and it got stuck in the 4th gear.
As the bike is now out of warranty, I did not contact support and went with just riding it this way until yesterday, when I finally got around to fix the (mechanically defective) eshifter using parts from the old (electronically defective) eshifter that I replaced last year. Now it is running fine again. Wouldn’t get another VanMoof as my next bike though.
To reduce the number of failures, they need a fleet of thousands of bikes in the field to monitor and redesign any component that might break.
But those bikes aren't yet reliable - so they shouldn't be putting their brand name on them.
Other manufacturers get this right. It is pretty common I buy something from Aliexpress for really cheap and it is clearly a premium product that has had the logos removed and is being sent out for user testing. They normally come with a card in the box saying "If this breaks, email this gmail address and we'll exchange it for a new one for free". They do that because they really want to know about failures. That lets them redesign the product to make it reliable, which in turn lets them put the premium brand name on it.
You simply can't make a product reliable with lab testing alone. The only way is with real users and time.
The thing is I think Tesla pulled off a near miss with their repairs, waiting times and general inavailability of spare parts. That was a very big issue for a few years. Tesla got a helping hand (in several European countries at least) in tax breaks for the electric early adopters. With the tax brakes came the premier buyer: lease companies (say NED / BEL). You know what lease companies are good at? Supply chain management on behalve of their customers. If a Tesla was out for repairs for a month, the lease company had to deliver a temporary car. The tax brakes for the consumers kept the demand up, no matter the service record. No tax incentives helping VanMoof.
Second is that I think the disruption Tesla caused in the car market at that time was a lot larger than that of VanMoof. As others point out: VanMoof didn't leapfrog (e-)bike market and didn't get a temporaty moat. They were actually a late to pivot to electric. Their earliest models were based on non-electric, affordable and robust (as a buyer at that time: they weren't robust at all). Then by playing the high margin-high marketing angle they just weren't a viable option in the price range where quality starts to matter.
All in all: Tesla got a temporary technological head start with some favourable tax headwind giving them just enough runway to manage the supply chain. VanMoof had no technological head start, no tax incentives and crashed and burned on the supply chain.
They thought they can do what Canyon can do, but Canyon is a much, much bigger company.
I'm curious how long the hardcoded api key here will work, though: https://github.com/grossartig/vanmoof-encryption-key-exporte...
used in https://github.com/grossartig/vanmoof-encryption-key-exporte...
Are people like the creator of this tool hoping for a future option to make use of the keys, and they're just being backed up for a rainy day at this point?
These are ordinarily used by the VanMoof app to unlock the bike and control the bike's settings.
There are already some third-party apps (Moofer, Mooovy) to allow alternate access to those settings – including some hidden ones.
With a few tweaks those third-party apps should be able to support direct key upload, rather than having to log in and proxy authentication through to VanMoof's API.
That's the thing with this kind of "protection". If your proprietary app needs to access the server, anybody who can either extract the key from the app with reverse engineering or who can listen in on the communication between app and server will be able to use that API.
It's the same issue as with DVD encryption: If you need to show the movie to people, people need to be able to decrypt it. If this needs to happen offline, then the material needed for decryption must be static and either be on the disk on in the player - where it can be extracted and used by third parties.
I say supposedly because the source is not available to inspect. However, the linked FAQ states that no data is stored outside the app.
Here it is: https://bikey-app.cowboy.bike/
(Note this is not en endorsement for Cowboy - whom I know nothing about - just pointing to the currently only iOS app I know of to save these same encryption keys for VanMoof owners).
Same modus operandi: excessively VC funded, lots of hype, proprietary parts, mounting losses, loosing money with every sale, ... and it's getting worse every year. Cowboy Bikes is just another bankruptcy waiting to happen.
"Use standard stuff" has a lot of value, obviously, but it also limits you. This is true for everything: from bike parts to the POSIX API or POSIX shell.
That being said: if I were in the market today I think I'd go for the Veloretti Ace. Less proprietary parts, great design and owned by a stable company.
I would like to get the Veloretti Ace, but they only sell it in three countries :/
You mean they know the vendor is an infinite supplier of free bikes to steal, deSaaSify, and sell to a different market?
Either way, the message doesn't spread itself; I wouldn't overestimate how much small-scale semi-pro thiefs know or care about bullshit tech startups.
EDIT: the only real advantage VanMoof could have here is if they're selling shitty bikes and overpricing customers for the brand name. That would indeed deter most thieves successfully - by making stealing those bikes not worth the effort. Well, until the metal prices spike or something, and it's profitable to steal them and sell as raw material...
--
[0] - See e.g. cheaply available conversion kits for Bird scooters; IIRC they were being sold for something like $30. Though those had a plausibly legal use case: converting decommissioned or seized scooters. There were plenty of the latter, as following the example set by Uber, Bird also pretended law and society don't exist.
In terms of the appeals, I see it the other way around. The app is just the means to get the feature set to work; people don’t buy the bike because it has an app. There might be other implementations of the features that don’t require an app.
I struggle to understand those who think something like that could be a good idea.
Isn't it obvious that an app will not be around for as long as a bike can last?
I have a bike from the early 90s, that's over 30 years. Does anyone think an app will be around even for 10 years, let alone 30+?
The website is telling me there's a charge for the shipping, but no way to pay it.
Going with a small/exotic brand will always carry a risk of brand disappearing, no aftermarket options, hard to get spare parts, etc... And e-bike business is especially competitive these days so I wouldn't bet on some random hipster brand having any chance to survive in the battle against established brands.
That's the softwarization of everything, with its in-built early obsolesce: they clearly expect you to start replacing your bike as frequently as you replace your phone, irrelevant of how long the hardware itself is still functional.
Could he refurb the titanium frames for newer parts? Maybe. At some point racing tech moves on and you need a newer frame for the latest and greatest stuff to fit.
You can find parts for nearly any kind of old/obsolete bike technology ever made in volume, even tires for odd wheel sizes that have been mostly abandonned can still be found.
Sure, but that's utterly irrelevant to daily commuter / city bikes, which Van Moof are.
Bikes are made of aluminium these days instead of steel, which gives them a lifespan of about 10 years, certainly not 30.
If you buy an ebike, you must be prepared for maintenance and replacement of parts. That's the state of the market right now.
I agree that making an app mandatory for a bike is a bad idea, and I would never buy such a solution. However this is an urban city design bike, aimed at a specific group of customers who do value these kind of innovations.
Absolute bullshit, especially for a city bike.
Stress cycle is an issue but city bikes are over engineered and don't see a lot of stress compared to every other type of bikes.
I've used alu bikes over 30 years old daily and I had no issues whatsoever, that's how I went to school everyday for 3 years, and that was a race bike that actually had been use for racing in the past
Online posts make it sound like alu bikes self destruct at 5 years and a day...
Yes, aluminium can survive a long time. But in general steel has a better chance to survive. The category of city bikes are low cost bikes, and the frames are as well. They are not so over engineered as you think as it is a very competitive market. The first generation VanMoof frames for instance, were prone to breaking.
While it is possible for a aluminium frame to reach 30 years lifespan, in practice the lifespan is shorter. This is because steel is more forgiving, it can handle dents and scratches where aluminium is more prone to breaking. Also the frames are usually hand welded and this can too be a weak point as it is hard to perfectly weld aluminum. It doesn't mean you can't ride a 30 year old aluminium bike or that it will auto destruct. It does mean that the bike is unlikely to reach that age.
Do you know what the median lifespan is of an aluminium frame? I guess it depends on how often its crashed?
People under 25 don't know better, they genuenly haven't experienced anything else than Chinese made self destructing Bluetooth enabled plastic gadgets
I don't want a non-e-bike. I want a bike with pedal assist.
I think the appeal (at least for me, I considered one but never got one) is that it makes the bike harder to steal. Someone can't just ride off on it after they cut your lock. I worry about leaving my $600 bike out in public, so I'd be super paranoid about a $2000+ bike.
Either way you most likely won't recover it.
The point of Van Moof was to associate their brand with "don't steal our bikes because they will lead the police to your dump location".
Regardless, part of the allure was the Van Moof has (had?) a program where if they couldn't recover your bike you'd get a new one for just $100
Van Moof actually had an insurance policy that you could buy that included a guarantee to either track down your stolen bike or replace it. The so-called bike hunters would attempt to track down the bike. And stealing one involves dealing with a very loud and obnoxious alarm that is motion triggered that can only be disabled by unlocking the bike.
Those were all good things. What's not good is all the proprietary components, the poor quality of those, and the over dependence on the Van Moof servicing. That's what's killing the company. Basically classic VC funded company problem: great idea and product but hopeless execution resulting in a company that has a lot of cost but no profits making that problem worse through rapid growth and inflated investor expectations. The debt bubble burst last year, they are running out of cash now, and game over pretty much.
I actually have a lease bike from a company called Swapfiets here in Berlin. Very nice deal. I pay them per month and the bike is basically ignored by bike thieves and vandals. There are hundreds of thousands of these bikes across Europe. Each bringing in revenue through a subscription. Genius idea.
The bike is decent but nothing special. What they sell is peace of mind. I get to ride a decent bike and not worry about it getting stolen. Very low tech solution; the bikes are just very recognizable which means selling them is not a thing for thieves. If it gets stolen and I can show the key, my risk is 60 euros. I've had one for three years now and I park it all over town in all the hot spots where bikes get stolen, vandalized, etc. without a second thought. Not a single incident.
Maybe where you live. Here in Tokyo, bike theft isn't a big problem, and there's lots of reasonably expensive bikes (and e-bikes) parked on the sidewalk with just a lock through the wheel spokes.
Berlin where I currently live isn't much better but they've not yet introduced parking garages for bikes as far as I know.
It's weird, the main oddity is that it's just not considered theft in the same sense.
Before E-Bikes took off ~10 years ago everyone living in a city had a €50-300 beater bike "omafiets" for commuting, if you went out you were expecting your bike to be stolen on occasion.
So, you'd steal someone else's bike, either personally, or if you were downtown a junkie would ride past every 10 minutes offering a freshly stolen bike for €50 euros, which if you were smart you could easily haggle down to €5-20.
When pressed (especially after a few drinks) almost every city dwelling Dutchie you meet will admit to having stolen a bike, or bought a "second hand" one that's obviously stolen. I'm talking about people who are well off, went to University etc.
So bikes simply weren't personal property in the usual sense, and admitting to stealing one was no big deal, even if admitting in the same company to stealing a car would make you unemployable.
People stole your bike. You stole theirs. It all worked out in the end.
Now, this has really been upset by the E-Bike boom, now people are communiting in the same cities as 10 years ago, but on bikes costing 5-20x as much when adjusted for inflation.
So there's been some adjustment, but not really. The police still don't care about your stolen bike, and realistically you'll face zero consequences if you buy and use a stolen bike.
Complete bullshit. There are people that steal bikes and there are people that buy bikes they can reasonably assume have been stolen and then there is everybody else, where everybody else is by far the larger fraction.
I've lived in Amsterdam for roughly half of my life and that statement really irks me, especially since you seem to use this as a fig-leaf for your own illegal behavior. The lack of enforcement against bike thieves is vexing, but not as vexing is people that move here and that then engage in criminal acts.
Couldn’t you achieve that with a hardware key though? You don’t really need a server and still have a hardware Bluetooth key that is secure with the bike being useless without it? Then you don’t depend on a company staying afloat and granting you the privilege to keep using your bicycle as they see fit/VC greed dictates.
It needs an internet connection to initially get the bike's encryption keys. After that the app can communicate with the bike over bluetooth without internet access.
And then, you actually don't even need the app to unlock the bike. You can unlock the rear hub by entering a passcode physically on the bike without the app. Occasionally the app/bluetooth conked out and I had to unlock using the code.
If you're not into bikes, try a few of them. I find any properly tuned bike to be an absolute joy to use, although I never tried a Van Moof.
I like a different aesthetic but to each their own. A bike you love is the best investment you can make.
I'm convinced the S/X3 is why the company is going under.
Cars: https://www.warrantyweek.com/archive/ww20230511.html
Hvac/appliances: https://www.warrantyweek.com/archive/ww20230706.html
But there are outliers (wind turbines):
When Boosted went under years ago some people tracked down the manufacturers of the individual components and to this day you can buy brand new replacement motors. It'll be interesting to see if a market pops up for VanMoof replacement parts as well.
I sure hope so, I'm sitting on an S3 with a broken e-shifter. Support told me they didn't have any in stock and they'd let me know when they did. With hindsight I know now they probably hadn't been paying suppliers for a while now, and weren't getting any parts in because of that.
It was supposed to be delivered in December 2022. But it was eventually pushed back to end of this year (2023).
Contemplating canceling my pre-order ($20-30?) now.
At least that’s what I always understood about it. Not sure if that’s “chapter 11” or somethings else