One thing that stopped me from seeking the vanity plate - I learned that at least in Texas all plates are made by minimally paid prisoners. So any desire to finance that system beyond what's absolute possible minimum (i.e. regular plates) evaporated.
In Denmark, you can buy a vanity plate (ønskenummerplade) for 8'000 DKK (needs renewal every 8 years), and it can be between 2 and 7 characters long; but the best part is that they permit all Danish letters, including Æ, Ø and Å. One could likely write a script quickly to check these platforms for short combinations, such as ØÅ, which appears to be available.
I found out recently that in my state, the online vanity plate checker shows plates that were PREVIOUSLY registered but NOW available as NOT available. I wanted to get one of my own plates I had years ago and assumed there was some process to have it transferred, but was told by a DMV rep that after two years of non-registration, they're up for grabs. Apparently the web page does not take this into account.
That means there are probably a lot of great plate names up for the taking that people are just assuming are taken. You'd need to call the DMV to verify.
Hopefully Florida's web page does not have that limitation.
I did something similar to get OnlineOrNot's twitter handle - I realised that unclaimed names would 404 and so I set up a check to get an alert when that happened.
It's a fun story of course, but it also seems that people like OP who abuse public APIs are why we can't have nice things, and why so many web pages these days are bogged down by Cloudflare and Anubis interstitials that waste human time.
> Most people never think twice about the random mix of letters and numbers the DMV assigns them.
I started thinking about it when someone parked next to me in a nearly-identical model - same brand, year, etc, the only difference was some roof accessory - and a nearly identical license plate. (Think ABC D12 and ABC E12). I started trying to open their car door, and was confused until I noticed some things in their front seat that were clearly not ours.
Later that week, I was shopping around for car tires, and saw that some shop - PepBoys or something - let you punch in your license plate and let you know what kind of tires you need, and that their API response included the car make and model. I thought about poking around it, and seeing if there was a pattern to the way my state assigned license plates, but never got around to it.
(They live in town, too, and I've seen where they park. I should go introduce myself to our car twin.)
I got my vanity phone number this way too. However key point is to have a registrar with an insecure lookup endpoint like in the article.
Most endpoints now only give you a list pre generated numbers to choose from, AND that endpoint is rate limited to the tits with reCaptcha. No more script kiddies.
I swear I read some case a couple years back where a kid was facing serious prison time for automating requests to w publicly available government website. "Unauthorized access of a computer." I think the author may have just admitted to what the government considers a serious federal crime, as stupid as it is to consider it a crime.
OP here - I did some pretty heavy research on this topic to make sure I'd be okay publishing this / automating anything at all. From what I looked into (and mind you, I'm a 23 year old security researcher & not a lawyer) there are a few recent landmark court cases (Van Buren vs. United States, hiQ Labs vs. LinkedIn) that protect webscraping of a public-facing page without bypass of any technological barriers. Furthermore, Florida has the Computer Abuse and Data Recovery Act that defines any malicious behavior as overuse of resources or an intent to defraud or cause harm, both of which I was very conscious about not violating. I appreciate the concern regardless!
In CO, there isn't an online search. When you apply, you have to list your top options and hope one is available. I'm also not a normal person. I'm an engineer and this was not good enough for me.
I emailed government employees until I figured out who was responsible for license plate records. I submitted a CORA (Colorado Open Records Request) for the entirety of their dataset. I had hoped to get the data on some regular cadence to build a simple online service for others. Unfortunately, they flat out refused and wouldn't discuss options.
When I told my family what license plate I wanted, they laughed at me and said "No one has that, just go get it". And so I did and it worked. I now have what I consider to be the best possible license plate in Colorado: "LCNZPLT"
Occasionally I'll see someone walk by my car, see the plate, think for a few seconds and then start laughing. Mission accomplished!
The short plate came back to bite me: Years after I had moved to another state, an automatic license plate reader on a toll road (91 Express Lanes) in Los Angeles misread someone else's plate as mine. It was kafkaesque: My public records request for photographic evidence was blocked because, if I was correct that the offending driver was not me, the law prohibits the release of records revealing others' driving patterns.
The other plates available when I did a similar search were BO and IR. In retrospect IR wasn't a bad choice.
I have an iteration of NO PLATE, and have received numerous citations and impound notices. At this point, I just ignore them. Registration renewal is possible, only because my local county office understands the situation (years of this).
Of course I could change my license plate, but not'gonna.
What character set does it use? For example, can "O" and "0" considered different characters or same character, and are some letters/numbers not used? If so, then how many they say are possible is not quite that simple, since some might match (so they cannot simply be added together) and some might not be possible.
I used to have a fun novelty plate when I lived in California, but when it came time to get new ones, I went with the most boring, plain plate I could.
With how many crazy assholes there are on the road these days, anything I can do to promote my own inconspicuousness is something I'll do. No bumper stickers, no cute plate frames, nothing. When I'm not carrying skis, the rack comes off
I’m boring. The process for us was: Wifey and I thought of cool names, went to register with our shortlist written on paper, most didn’t work, until one did. Though now we’re considering dropping it because it costs too much.
Hey, would you please consider adding an RSS feed to your blog?
I remember liking your post about Waffle house and now also this one, so I tried to add it to my RSS reader. But unfortunately no feed is available.
>EVENTVALIDATION is (was?) a novel security measure implemented in 2006 by the ASP.NET team to "prevents unauthorized requests sent by potentially malicious users from the client [..] to ensure that each and every postback and callback event originates from the expected user interface elements, the page adds an extra layer of validation on events".
The attack it prevents is called XSRF, and this security measure wasn't novel in 2006.
31 comments
[ 2.7 ms ] story [ 51.1 ms ] threadThat means there are probably a lot of great plate names up for the taking that people are just assuming are taken. You'd need to call the DMV to verify.
Hopefully Florida's web page does not have that limitation.
I started thinking about it when someone parked next to me in a nearly-identical model - same brand, year, etc, the only difference was some roof accessory - and a nearly identical license plate. (Think ABC D12 and ABC E12). I started trying to open their car door, and was confused until I noticed some things in their front seat that were clearly not ours.
Later that week, I was shopping around for car tires, and saw that some shop - PepBoys or something - let you punch in your license plate and let you know what kind of tires you need, and that their API response included the car make and model. I thought about poking around it, and seeing if there was a pattern to the way my state assigned license plates, but never got around to it.
(They live in town, too, and I've seen where they park. I should go introduce myself to our car twin.)
Most endpoints now only give you a list pre generated numbers to choose from, AND that endpoint is rate limited to the tits with reCaptcha. No more script kiddies.
https://en.wikipedia.org/wiki/Vehicle_registration_plates_of...
I emailed government employees until I figured out who was responsible for license plate records. I submitted a CORA (Colorado Open Records Request) for the entirety of their dataset. I had hoped to get the data on some regular cadence to build a simple online service for others. Unfortunately, they flat out refused and wouldn't discuss options.
When I told my family what license plate I wanted, they laughed at me and said "No one has that, just go get it". And so I did and it worked. I now have what I consider to be the best possible license plate in Colorado: "LCNZPLT"
Occasionally I'll see someone walk by my car, see the plate, think for a few seconds and then start laughing. Mission accomplished!
The short plate came back to bite me: Years after I had moved to another state, an automatic license plate reader on a toll road (91 Express Lanes) in Los Angeles misread someone else's plate as mine. It was kafkaesque: My public records request for photographic evidence was blocked because, if I was correct that the offending driver was not me, the law prohibits the release of records revealing others' driving patterns.
The other plates available when I did a similar search were BO and IR. In retrospect IR wasn't a bad choice.
Of course I could change my license plate, but not'gonna.
Next steps would be to make it LLM assisted and to generate common number/letter replacement combos
Personally, I wouldn't pay extra every year to have an easily recognizable vehicle.
The attack it prevents is called XSRF, and this security measure wasn't novel in 2006.