I'm curious how long the hardcoded api key here will work, though: https://github.com/grossartig/vanmoof-encryption-key-exporte...
used in https://github.com/grossartig/vanmoof-encryption-key-exporte...
That's the thing with this kind of "protection". If your proprietary app needs to access the server, anybody who can either extract the key from the app with reverse engineering or who can listen in on the communication between app and server will be able to use that API.
It's the same issue as with DVD encryption: If you need to show the movie to people, people need to be able to decrypt it. If this needs to happen offline, then the material needed for decryption must be static and either be on the disk on in the player - where it can be extracted and used by third parties.
Are people like the creator of this tool hoping for a future option to make use of the keys, and they're just being backed up for a rainy day at this point?
These are ordinarily used by the VanMoof app to unlock the bike and control the bike's settings.
There are already some third-party apps (Moofer, Mooovy) to allow alternate access to those settings – including some hidden ones.
With a few tweaks those third-party apps should be able to support direct key upload, rather than having to log in and proxy authentication through to VanMoof's API.