Natis online booking, and the government being too helpful.

Note: this is not the NATIS site, nor does it have any association with it. If you’re looking for the booking system, click this link.

Update: it looks like the CATPCHA is now required for every request, so at least an automated leak is out. This still allows for targeted looking up of data though, like investigating job applicants, or anyone for whom you have an ID number, which probably isn’t ideal.

So the National Traffic Information System (NaTIS) recently launched a new website where you can book for various driving licences / renewals online. The website itself seems fairly slick and fast, and it’s good to see initiatives like this coming from government, as anyone who’s spent any time at a driver’s licence department will know.

Can’t stop progress.

As an example, if you choose to book a driver’s licence renewal, you are prompted for the type of identification, as well as, say, your ID number. What if you make a typo? Well, not to worry, it will validate your ID number for you.

Neat

That’s neat. What if you typo’d so hard, you entered a valid, but non-existent ID number? Not a problem.

Um…

Well, they’ve definitely tried really hard. Uh… did they just expose a service we can use to check if an ID number exists? That’s… odd. What if you typo’d an ID number of someone who existed, but didn’t have a driver’s licence?

Hold on…

Oh dear. So we can use this to check if someone has a valid driver’s licence? That’s a little concerning. And what happens if you enter an ID number of someone who does exist?

Oh dear.

Well, that’s not good.

To summarize, Natis has exposed a service that, after filling in a Captcha, you can enter an ID number and be told:

  1. If the ID number is valid,
  2. If the ID number has been assigned to someone,
  3. Whether or not that someone has a driver’s licence,
  4. If they have a driver’s licence, what their first and last names are.

That’s a lot of info to just be leaking out all over. I assume that wasn’t intentional. Looking at the page for applying for a learner’s licence, I think you may be able to retrieve names about someone who doesn’t have a licence yet as well, but I haven’t confirmed.

A good initiative, but someone really needs to be vetting these things before they go out.

Tagged with: , , ,
Posted in Government, Privacy, Security
11 comments on “Natis online booking, and the government being too helpful.
  1. Piet says:

    i can post a message but not make a booking ??

  2. Lizelle says:

    I need to make an appointment in Pretoia north Akasia but no space available there is no people there but they are full?????????

  3. These comments just made my Friday!

  4. And it now looks like they added a mandatory Surname and Initial field to the start page which should help – well spotted!

  5. gumani says:

    how can I get my temporary licence its bad for this not some day.

  6. Lindi says:

    How can I cancel my appointment date

Leave a Reply