TomTom: “Internet standards do not apply”
In June last year, I bought a TomTom GPS device. Their use of Linux on the device was a clear plus in their favour, but it was only that, given that overall they’re the best devices available.
Unfortunately, the TomTom HOME software that is needed to manage the device is not as good as the device itself.
An account on their website is needed for updates and the online shop, and as I usually do, I used an email address in the form jb+something@jblache.org. That’s a trick most of us use to trace back the origin of spam, usually revealing that some company sold its customer database. I’ve been doing that for years.
I was quite happy that the website did not reject the address as being invalid; that’s something that happens everytime the random web developer maintaining the site decides to start “validating” email addresses, for some value of email addresses.
For the following 8 months I’ve been using this address as the account login (don’t really have the choice, anyway) with the TomTom HOME software. Last month, the v2 of the said software was finally made available for Mac OS X.
Where the v1 used to accept my email address, the v2 would now reject it. You guessed it, Joe Random developer decided to start validating email addresses in TomTom HOME.
I reported the regression (and here, something must be said about their infamous support website), with pointers to the relevant RFCs. In the following email ping-pong, they managed to:
- Pretend the password was the problem. I have to say here that the software displays a big red “invalid email address” next to the email address field as soon as I enter the + character. No mistake possible here.
- Send me my login and password, in clear text, when I never asked for that. That also means they’re storing passwords in clear text. IT’S 2008 FOR FUCK’S SAKE! STOP STORING CLEAR TEXT PASSWORDS, DAMMIT.
- Pretend their email platform is the most secure in the world. Ever heard of SSL? TLS? Clearly not.
- Pretend it’s not a regression in the v2 of TomTom HOME. We’re not speaking the same language, it seems.
- Pretend the email address is invalid. No surprise there, but it’s clear they did not bother reading the fucking RFC.
Last but not least, their last reply was: “we found that the standard does not apply to us. Please change your email address for a valid one.”
Now, I’m left wondering: does the GPS standard apply to TomTom devices? I truly hope so.