Post

A thread 🧵 of _terrible_ design decisions for the internal APIs of the two Italian high speed train operators, Italo and Trenitalia. Hardcoded passwords, terrible translations, spelling mistakes, xml in json (but utf8 encoded and transmitted as an array of numbers), it's all here. Enjoy!

Italo's app sends a "Login" request on startup with a hardcoded username and password, which coincidentially also is entirely unnecessary, because the data it fetches with the returned data is available without authentication!

Trenitalia's internal API for getting the real-time travel info for a train has a beautiful translation error: the platform identifier field is called `binary`, because in Italian, platform is "binario".

This endpoint has another great design choice: the departure and arrival data is stored in two arrays with fields with a description of either "Scheduled departure", "Actual Departure", "Scheduled Arrival", or "Actual Arrival". Note the capitalization difference between "departure" and "arrival".

On startup, the Italo app also fetches a list of all stations Italo can sell tickets to/from. This file is 2.3 MB, but not because of the list of stations. No, it's because it contains for every station, the list of every other station that is reachable from that station (and much more garbage)

That date thing has many hits on GH. Why can't the world just accept rfc3339 🤬 github.com/search?q=%22...

That's the JSON date format that older .NET versions used, iirc

That explains a lot of things.

On startup, the Italo app also fetches a various XML encoded bits of content from it's CDN that it uses to display ads and such on the index page. This XML is UTF-8 encoded, and then sent as a JSON array of integers in the range 0-255. This increases transfer size by slightly over 3.5x!

Trenitalia also really doesn't want anyone to reverse engineer their app to get public information, so they certificate pin lol - do they really think that is going to stop me? I think they are just embarrased by the quality of their API endpoints lol And Italo clearly has never had a pen test done

Did you find security vulnerabilities?

Looking at the PUBLIC JS files for the departure boards from RFI (the 100% public company that maintains the track and station infrastructure) shows it was written by someone from Genoa "Belin che cavolo" = "WTF", but only in Liguria Also, the body here is entirely commented out!