I think I’ve found a serious flaw with the MyJPJ apps.

Did u know, the apps allowing anybody to register as long as u have an ic number that registered to JPJ database. Yes. without any verification that u own the ic number.

The only thing preventing you from registering with someone else ic are the term and condition. This could lead to some people with bad intention to use someone else ic and register the apps to get information such as home address and picture of u.

And i could see in future that some people could not register their account as the account might be registered earlier by someone else.

i do realised, u are required to put your phone number. But u can put anybody phone number. Right?

I might be wrong. Need to verify with someone with IT security expert or anybody?




-----


This post has been edited by fadzly: Jun 21 2023, 12:50 PM

Polis selalunya akan minta ic dan lesen. Lu fikirlah sendiri.

Technically now you can use najib ic number to register 1 account with dummy but working email address

But not sure it got validate with phone number or not

This post has been edited by fantasy1989: Feb 10 2023, 07:56 PM

Had registered mysikap much earlier.
Even register oso need fingerprint at JPJ

they can overwrite email address iinm

dont play2 with government stuff....if you got caught and they decided to open case on you, it will be permenant record unless you ready to live like scammer

This post has been edited by mrhulk: Feb 10 2023, 08:04 PM

that's is why u better fast fast register your ic first. if not, account get "hijack" by others.

If u can register ur parents account using your phone number and email, means everyone can be your parents.

Old people are not tech savvy. Hence they are the one prone to complication like this.

Means someone can use this information to register.
https://rafiziramli.com/2013/04/saman-tertu...n-mengenai-aes/

that's why with Recent jpn leak... someone who bought the Database just need to make a script to mass register for everyone in merehsia...

kekk...

- MySikap at website maximum is 12 chars for password but MyJPJ app I am able to put in a 13 char password
- My wife's account that I registered at MySikap has my phone number and my own MyJPJ app also has my phone number. - dunno if this will complicate things or not using same phone number for two different person.
- I used my password to enter MySikap website - cannot. Same password use for MyJPJ app can go in. WTF?

This post has been edited by N9484640: Feb 10 2023, 08:59 PM

If they cannot handle this, they should not drive

actually, if u want, you can just brute force, since mainly numeric and most of the number also within a specific range, sumore got millions of rakyat, which mean high probability to hit result. first 6 number is date so pandai pandai la construct base on date range, following 2 digit, is state code (also within a specific range). last 4 digit just hantam.

This is what i scared will happen.

It somewhat similar to MySejahtera where u can register anybody like KJ to be your dependent. But good thing with MyS, they are not releasing private information.

When i want to register after i insert my ic, it says already registered and prompt me to log in.

But I belum register before wor.

How?

Apps issue or my ic been used by others?!

Anyone also experience the same?

possible to prevent this is mandatory scan physical IC, only matching IC able to proceed an account.
or get a TAC at booth like EPF online registration.

This post has been edited by kel32: Feb 10 2023, 09:30 PM

Wifu can check your car ownership and see whether you got unknown car or not. If got, better prepared for good explanation. Or else wifu will think you got mistress.

Why need to register jpj account ?

Cukur dah register, good luck to those kenak hacked for late registration.. huhu

that jpj app is using mysikap credential, no?

This post has been edited by anakkk: Feb 10 2023, 09:49 PM

lol. read about myjpj la bro. jgn blur sotong. read the news

Can do like shopee or tng camera verification

I have tried that MySikap user password cannot be used in MyJPJ app although they share the same I/C as ID. System connection error displayed after I keyed in MySikap user password in MyJPJ APP. JPJ need to rectify that MySikap and MyJPJ could be accessed with the same user password.

So it’s not only me. Thanks for confirming

This was my experience:

I registered on mySikap portal.

Downloaded and installed myJPJ app on my phone.

Logged into myJPJ app using the same user ID and password that was registered on mySikap portal.

Log-in was successful and I was able to access myJPJ app.

This post has been edited by bass4focus: Feb 11 2023, 06:41 AM

I got my parent registered within the same phone and email. Even after logged out my account, i can only see my license and not my parent. Havent tried delete the apps or clear cache yet. Another flaw.

why always use the brand MyXXX its so 2001
cant they just put more proper official name instead of gsm era name

how many characters is your password?

Technically you are correct. Jpj need to upgrade their apps security.

Yea, last time mySIKAP more secure, need go JPJ counter register account, thumb print, and the officer give you temporary PIN.

No need ady?
MyJPJ for me based on my mySIKAP. Had to register thumbprint first for mySIKAP

Yes, I use mySIKAP login and it was fine

You are not wrong,
It is also an issue with most government owned app/sites that provide detailed information just from ic number,

But as you can see a lot of Malaysian takes cybersecurity and personal information lightly.

IC number should be kept as private as possible.

KJ IC last time also leaked. People access to vaccine website and found the vaccine record is not there. Turn out the website no longer maintained. Very dangerous as could no longer change ur ic number.

can go jpj kaunter overwrite
for now they just trust everyone orang baik

Had problem register from app it says my ID been registered before, finally problem solved by registering through JPJ website https://public.jpj.gov.my/public/login.zul

Click Daftar and register, wait for email (need patient ya cos I waited 1 hour for the email to arrive maybe need longer time now cos server busy).

Then proceed to log in MyJPJ app with the ID and password you set.

This post has been edited by la bella: Feb 11 2023, 08:59 AM

My password has 8 characters

ok mine can log in to both already. dont ask me what i did, i also dunno....
i click lost password, then set new password at mysikap website. then i log in to app also can already

ah shit, I got another account, can sign in to app but not website...
I think its something to do with my password too long...

This post has been edited by N9484640: Feb 11 2023, 10:11 AM

Madani really think every B40 orang kampung di Kelate are that kind of tech savvy

even myself also got carried around while trying the process

fuuu

btw, Connection Error now

bravo Anthony

Could some one tag Anthony loke about this?

I think they should come out with a verification to register.

when register got ask for password?...

Its like registering new account for facebook or gmail. Need to set up password email and phone number

The first time I register at app it says my ID been registered before and I click forgot password and my email not matched.
Then I re-register at the JPJ website to change it to my email and reset password.

That means anyone can register on behalf of a person. Mine been registered by someone else.

JPJ need to think of a way to prevent such thing happened.

Means anyone can reset password also?🥲

Anthony Loke cakap
apps MyJPJ tidak diwajibkan

penguatguasa can still check the status lesen and roadtax via their device

sekian

Its not about compulsory or what.

Someone can just create a script for register and run brutforce to get all information among those who havent register. Worst they could sell the data. Your home address there.

Or ah long try to locate you 10 years hutang, old ic got old info. U update the latest home address when renew. They register using ur ic, walla, they got your latest address.

true

but this is Malaysia

i am highly sure this is not the first time of such instance happen

hell even Astro also got data leakage before, just run a brute force against their API (not secured via secret key) and get the customer info

Not compulsory rite?

I also read, our database will be auto registered when whole process done up… but this type of database is 4 jpj / police 2 check, why rakyat need 2 register n rakyat then show 2 enforcement their details via smart phone? Like our utilities bills etc we can just go online check amount owning… without registering our details.

They, JPJ got all the sop to verify user at their counter. Why didn’t practice the same online. Sigh.

Thanks wee ka siong.

loke > all

So....

WHoever encounter issue while registering MyJPJ, with an error saying AKAUN ANDA TELAH DIDAFTAR
Can try this, I had the same issue/error also

Register yourself at mySikap
mySikap registration is the same Login to myJPJ


BUT...LOL
Register mySikap is as silly as go in
Fill in IC, Phone, Email, put in sekuriti kod....

Whoever imposer can register Your IC also...

So the stupid Flaw is actually started from mySikap. myJPJ just used the same logic to register (initially)

WHAT THE HXLL Mr Wee is talking abt...flaw in myJPJ la

This post has been edited by taitianhin: Feb 15 2023, 07:38 PM

What ive found is merely logic. Hence if they couldnt protect this simple thing means how bad our ict developers are.

As bad as the police force?
I still hearing 2 occasions of corruption on going now...
1 fren paying RM30K to Kuantan Police Head
another fren paying RM3k for drunk driving....no saman....just Their Head want Exactly RM3000, no less than that...

both cases, "wanna go court tak?"

Teruk nya. Sian.

Anyone facing issue that No Siri Leson Kompeten tidak sepadan during registration at mySikap? I have key in for more than 10 times d.

proly u need to go JPJ.

im glad that they restricted the registration of the apps.

Renew my car insurance/roadtax today. So, also try MyJPJ App.
During registration, stuck at "no siri lesen kompeten tidak sepadan".
A Google search shows me this thread. So, I want to share resolution.

The serial number is mixture of 8 random alpha-numeric big small cap, and printing is rather small.
i.e. high chance to read wrong.
I took a picture then enlarge it only to realize the '8' is actually B.

Noted. Thanks. Will put at front page

Confirm takde typo dan silap cam huruf (tiada nombor), tapi masih tak boleh. Masih stuck di "no siri lesen kompeten tidak sepadan"

First time login. Key in the answers for the security questions but then it display error after clicking 'Enter'. Pretty frustrated by the app.

phone number no problem. most ppl cannot move beyond serial number verification bcoz salah key in between big I as in ikan and small l as in lelaki