Password- what good is it?

[just4fn]

It appears that the password for tomtom can be disabled or removed by connecting to the computer and removing files and putting in your own files. It seems to me that the tomtom shouldn't connect to the computer until after the password has been put in. Am I right?

 

[flyer1024]

I think the way it works is you have to first connect to the computer to input the password.

After that the only way to remove the password is through the device and then only if you know the password.

seems secure enough.

 

[just4fn]

I have added the password. When I connect the 920 to the computer, it connects before the password comes up. All I have to do is reformat and add any 920 files that I have without a password.

 

[flyer1024]

hmmmm.....yes, you are correct about that. A thief just has to download the home program and fire things up.

didn't realize that was the case.

 

[The Spook]

just4fun,

Although I am sure your intentions are good (you do it just 4 fun, right? ), you have just broken (or helped to break) the main security feature of password protection, i.e. security by obscurity. It was never great, now it is worse. Let's hope that thieves don't know how to use google.

On the upside, I will no longer receive dozens of PM's from suspicious first-time posters asking how to remove the password protection from 'their' tomtom!

 

[just4fn]

Do you think people are stupid, should we put our head in the sand? Tomtom needs to be aware and fix their security. Dont blame for making shortcomings aware.

 

[infama]

I have added the password. When I connect the 920 to the computer, it connects before the password comes up. All I have to do is reformat and add any 920 files that I have without a password.

Would a thief have 920 files?

What about authenticated maps, etc?

I must be missing something here.

 

[just4fn]

I don't think its an issue if a thief has files, Its an issue that the lock is just an inconvenience of having to punch in 4 digits to access the screen with the knowledge that the lock isn't locked at all. I have since removed the password for the inconvenience of having to do just that.

If you can't take authenticated maps from one tomtom to another than the password protect is ok, I dont know if that is possible. I am sure that the maps from a 720 won't work with a 920, but a 920 to another 920 might?

 

[infama]

No,

The maps are locked to the particular device.

However, there may be workable illegal hacks out there, so your point has some merit.

Besides, if you have full access via HOME, then the point is moot as a full backup could be done and then restored minus lock file?

Somehow, I dont think you can do all this without invoking the password, however.

I will check it out and report back with findings.

 

[25or624]

the issue for me -- is that the thief doesn't know my home address or can navigate to it. so for me -- I think the password (and all it's shortcomings) protects that for me.

 

[The Spook]

Do you think people are stupid, should we put our head in the sand? Tomtom needs to be aware and fix their security. Dont blame for making shortcomings aware.

No, I don't think all people are stupid and I don't think we should all bury our heads in the sand.

However, I am personally very uncomfortable with doing or saying anything that may help a thief make use of something they stole. That is not why I am here. Just because I know how to compromise certain security systems does not mean I should be telling anyone who asks, as I would have to bear some of the moral responsibility for that persons immoral actions. I don't want to do that. Many people here (and elsewhere) are aware of such vulnerabilities, but are cautious about how and where they talk about them.

Of course, the best practice is to physically secure the unit, to prevent it being stolen in the first place. Once a sufficiently motivated and intelligent thief has physical access, they will always be able to circumvent any software-based security.

Anyway, how would you suggest that this could be fixed?

It is no different to car locks. Do they deter casual thieves? Yes. Can they stop an experienced thief? No. Are you comfortable teaching casual thieves how to easily break into locked cars? I am not.

 

[SShadow]

Be better off contacting TomTom with your observations, rather than posting it publicly. *shrug* I never leave mine in the car anyways, so the only way they're getting it is at gun point or coming to my house.

 

[The Spook]

Be better off contacting TomTom with your observations, rather than posting it publicly.

SShadow, you are talking to just4fun, not me, right?