Natis online booking, and the government being too helpful.


Note: this is not the NATIS site, nor does it have any association with it. If you’re looking for the booking system, click this link.

Update: it looks like the CATPCHA is now required for every request, so at least an automated leak is out. This still allows for targeted looking up of data though, like investigating job applicants, or anyone for whom you have an ID number, which probably isn’t ideal.

So the National Traffic Information System (NaTIS) recently launched a new website where you can book for various driving licences / renewals online. The website itself seems fairly slick and fast, and it’s good to see initiatives like this coming from government, as anyone who’s spent any time at a driver’s licence department will know.

Can’t stop progress.

As an example, if you choose to book a driver’s licence renewal, you are prompted for the type of identification, as well as, say, your ID number. What if you make a typo? Well, not to worry, it will validate your ID number for you.

Neat

That’s neat. What if you typo’d so hard, you entered a valid, but non-existent ID number? Not a problem.

Um…

Well, they’ve definitely tried really hard. Uh… did they just expose a service we can use to check if an ID number exists? That’s… odd. What if you typo’d an ID number of someone who existed, but didn’t have a driver’s licence?

Hold on…

Oh dear. So we can use this to check if someone has a valid driver’s licence? That’s a little concerning. And what happens if you enter an ID number of someone who does exist?

Oh dear.

Well, that’s not good.

To summarize, Natis has exposed a service that, after filling in a Captcha, you can enter an ID number and be told:

  1. If the ID number is valid,
  2. If the ID number has been assigned to someone,
  3. Whether or not that someone has a driver’s licence,
  4. If they have a driver’s licence, what their first and last names are.

That’s a lot of info to just be leaking out all over. I assume that wasn’t intentional. Looking at the page for applying for a learner’s licence, I think you may be able to retrieve names about someone who doesn’t have a licence yet as well, but I haven’t confirmed.

A good initiative, but someone really needs to be vetting these things before they go out.

Tagged with: , , ,
Posted in Government, Privacy, Security
21 comments on “Natis online booking, and the government being too helpful.
  1. Piet says:

    i can post a message but not make a booking ??

  2. Lizelle says:

    I need to make an appointment in Pretoia north Akasia but no space available there is no people there but they are full?????????

  3. These comments just made my Friday!

  4. And it now looks like they added a mandatory Surname and Initial field to the start page which should help – well spotted!

  5. gumani says:

    how can I get my temporary licence its bad for this not some day.

  6. Lindi says:

    How can I cancel my appointment date

  7. PJ Hall says:

    I need to make a booking to renew my licence card but cannot access anything on this page. who do I stay legal if I cannot do this.

  8. PR du Plooy says:

    Tried how many times to make an online booking to renew my drivers licence at Akasia but now space available what do you suggest?

  9. Arthur Koekemoer says:

    I have been trying to cancel a appointment made about 6 weeks ago at Springs as alternative as I could not find anything in Pretoria at the time. I was not able to do so. I have send emails to http://www.sayellow.com and tried phoning 0861400800 and 011-3602417 without any luck

  10. Lisa says:

    Hi, does anyone how I can cancel my online booking to renew my drivers license.

  11. Need to urgently cancel booking i made in Nigel as Springs has now available. please help urgently before i loose a spot at Springs

  12. Charity says:

    What does it mean I don’t exist

  13. largo says:

    Enatis is always off line. How do i make a booking if i cant get onto their page:
    https://online.natis.gov.za/#/ …. off line
    https://online.natis.gov.za/ … off line

    this has been the case now for a month. Im trying to log in every day and get absolutely nowhere very quickly.

    where the heck do i go to make a bloody booking?

    These buggers are worthless

  14. Karen says:

    My oroblem with the required surname business is the site does not have it on their database. Maybe it was mispelled by a data capturer. I cannot access the booking options. It gave me a messge that I must go in person to the licence center. However it seems they only accept online bookings. Catch 22 much? I am an essential worker and my licence expires soon. Dreading the chaos after lockdown and the backlog of people needing to renew their licences.

  15. Carol E Hendricks says:

    I made several bookings, got it everytime, but only got the point where they must send me my OTP number. I never receive it whether it is by email or sms, absolutely nothing. It is so frustrating.

Leave a Reply