Unfortunately every organisation is capable of cockups…
At Aero Friedrichshafen they declared that the UK has already left the EU (do they read the Guardian too?) and that UK people cannot share a minibus with the locals 
The UK CAA has finally woken up after I wrote to their chief exec and started processing my IR renewal from Aug 2018. But they still failed to read some of the pages, saying they don’t exist (luckily I shot everything to a PDF before posting it). To their credit they are very reliable in always taking 4 days from a letter being signed to it being posted, which must take considerable internal organisation, which despite having been in business for 41 years I am totally unfamiliar with
This Home Office GAR cockup probably indicates a misallocation of staff qualifications to the sensitivity of the job function
Peter wrote:
At Aero Friedrichshafen they declared that the UK has already left the EU (do they read the Guardian too?) and that UK people cannot share a minibus with the locals
Could they ever as the UK is not in Schengen?
They needed passport checks, sure, but the funny bit was asserting this is because the UK “has already left” which was news to me Also the separate transport was hilarious.
Well, no suprise, the leakage of their entire email database has already resulted in somebody trying to hack my account there
Presumably looking for personal data e.g. passport details. It would make sense for people to sign up to these sites if they want to steal data, and now they got a nice opening. It won’t get them anywhere unless they can also hack your email, but with many people, especially on gmail, this is easy – hence the now widespread “here are my new bank details” fraud.
I hope Carl’s onlinegar site does stay up, I trust his site a lot more than anything the Home Office does.
I think the problem is that any GAR storage system is holding passport details, which make fraud really easy. It also causes extra problems if compromised because changing a passport is a massive hassle.
And fake passports is a big business. Some 20% of signups on EuroGA are fake passport sellers! I should say “attempted signups” because, for those who miss the regular huge posts offering fake passports they don’t get anywhere nowadays due to some system changes…
As I see it, you have two options:
) and then you need a secure login, which is protected from the client device getting stolen and compromised. The govt implemented this by sending you an email, which is dumb due to antispam/delivery issues; they should have used SMSPersonally I use the second one. I would especially not use the Autorouter storage option.
It is a bit like would you store GAR forms on say dropbox? Many do, but it is dumb because anybody can access your db account from anywhere, with credentials which are often easy to guess.
There will never be an easy solution if you want cloud storage, which is inevitable if you want just a website where you can enter regular passenger details and pull them down to create a new GAR form. You can do internet banking with just an app which asks for one password, because you do extra security steps to configure new payees, which effectively prevents fraud. Not sure whether banking apps rely on the phone lock and the one pwd only, when creating new payees. With the GAR case, just somebody getting the data means it is game over for all your passengers, past and present.
I hope the email option is never removed. If it is, it will be really hard for non UK pilots to fly to the UK. Creating the profile etc on the horrible govt site takes ages, and all pilots hate airports which require you to create an account on some stupid website, like e.g. Myhandling which is used by a number of French ones. If the email option is removed, nobody will fly to the UK unless they really have to.
For 2FA (two factor authentication) it’s a lot easier now and all sites that can reveal personal data should be using 2FA. There is an IETF standard with several free implementations (e.g. Google authenticator) that can be integrated with a site. It’s more secure than SMS based 2FA and it’s cheaper for the site owner to operate (no need to be able to send SMS messages). For a site doing GARs, for convenience the 2FA can be needed only if you’re going to view or change the details of people stored.
I still hope the email option is never removed, for the sake of anyone visiting the UK.
The GAR form is a great system but they could totally f—k it with this.
Out of interest, where is the insecurity of SMS? I don’t think there is any way to break that, short of having access to the GSM system, which is really doable only for a government (or major organised crime) player.
Obviously if somebody steals your phone, and unlocks it, they can get around that.
I wonder if there has been a change. My last two GARs were lost. I got polite emails from the police asking me for a copy of the GAR. One today, a few hours after landing from France. Luckily I am careful about keeping copies of emails including the CCd copies to myself, and sent them screenshots.
I wonder if the ncu @ hmrc.gsi.gov.uk email has been changed?
I haven’t the time to go through 83 pages of postings regarding GAR, though my Search didn’t turn up Sky Demon / GAR.
My only comment is to use Sky Demon for GAR transmission – I’ve never had a problem.
