New Tracker app being developed

[hybrid]

For those of you who have purchased the Meitrack trackers, I'm currently developing an app to make it easier to talk to the devices. The app will be called "Meitricks".
This will only ever be an android app, unless someone else develops for other platforms. Sorry Apple fanboys.

If you've had a look at the SMS protocol you have probably noticed it's not really user friendly.
This app will provide options in layman's terms and then send the nerdy stuff via SMS to the tracker in the background.

Once I have completed the SMS development, I will look at integrating it with the Mustrack website to show your cars current location on a map, and further along, maybe some History similar to what is shown on the website. Integration with the website will probably attract a "PRO" edition fee because of the time and effort involved, but the SMS only should stay free. It's going to burn many hours too, but it's also teaching me app development.

Here's couple of early screenshots:

Tracking Commands (these are working as of right now)


Command Sent


Settings Screen




Once I have all the SMS commands working, put your hand up if you want to test it and I can send through a package to install on your phone.
I don't want to put it in the Google Play store yet.

[mikes68]

Hey Jeff, once again I would be more than happy to make a contribution so let me know.

I do have a question on security as I'm sure I wouldn't be the only one that would be really concerned if someone else was able to start tracking my car.

[xpconnor]

I am still a way of installing my tracker but sounds like this is going to make it a lot easier for nuffys like myself to use. Good work Jeff

[hybrid]

Hey Jeff, once again I would be more than happy to make a contribution so let me know.

I do have a question on security as I'm sure I wouldn't be the only one that would be really concerned if someone else was able to start tracking my car.

If you're talking about the tracker itself:
As far as tracking via SMS goes, you configure the tracker with a PIN. Without this pin, you can't talk to the tracker.
On top of this, you can set an authorised phone, and only this phone can receive reports, even with the correct PIN.

The website:
The website uses SSL (encryption) and a username/password.
Any tracking website stores your location data to function correctly. If you are not comfortable with that, don't use web based tracking.
Now that I think about it, I might add a button to the website to remove ALL stored location data for a particular tracker.

The upcoming app:
When the app uses SMS, the security is the same as mentioned above. Nobody can just send a command to your tracker to find where it is.
1) They need to know the phone number first and foremost
2) They need to know your PIN
3) They need to know what kind of device it is to send the right command
4) All that is still no good to them if their phone number is not authorised.
The configuration details (including phone number and PIN) are all stored locally on your phone in standard Android preferences form, so that aren't accessible to anyone else.

When the app connects to the website...
That is a long way off yet, but the plan is to use SSL obviously so the traffic is encrypted.
I have been considering generating a fairly long random "key" on the website for each device that you would need to type into the app to allow it to talk.
There's also the existing username/password to the website, so I could use that instead.. or both.

[mikes68]

Hey Jeff, once again I would be more than happy to make a contribution so let me know.

I do have a question on security as I'm sure I wouldn't be the only one that would be really concerned if someone else was able to start tracking my car.

If you're talking about the tracker itself:
As far as tracking via SMS goes, you configure the tracker with a PIN. Without this pin, you can't talk to the tracker.
On top of this, you can set an authorised phone, and only this phone can receive reports, even with the correct PIN.

The website:
The website uses SSL (encryption) and a username/password.
Any tracking website stores your location data to function correctly. If you are not comfortable with that, don't use web based tracking.
Now that I think about it, I might add a button to the website to remove ALL stored location data for a particular tracker.

The upcoming app:
When the app uses SMS, the security is the same as mentioned above. Nobody can just send a command to your tracker to find where it is.
1) They need to know the phone number first and foremost
2) They need to know your PIN
3) They need to know what kind of device it is to send the right command
4) All that is still no good to them if their phone number is not authorised.
The configuration details (including phone number and PIN) are all stored locally on your phone in standard Android preferences form, so that aren't accessible to anyone else.

When the app connects to the website...
That is a long way off yet, but the plan is to use SSL obviously so the traffic is encrypted.
I have been considering generating a fairly long random "key" on the website for each device that you would need to type into the app to allow it to talk.
There's also the existing username/password to the website, so I could use that instead.. or both.

Thanks for the response Jeff. That pretty much covers it all. Just a question on the host server re who has access there in the way of administrators. Not suggesting anything untoward of course but are you the only administrator that can access the raw data which I presume is not encrypted at rest?

[hybrid]

At the moment it is hosted on my server, so yes I'm the only one who can access it.

There is no guarantee that the tracking server will stay there though, because I simply can't provide the same level of service on my server at home. At the moment it's fine because it's only a few people using it, but my internet connection and power infrastructure can't compete with that of a data centre. Even if I moved it to the Mustangtech server, the only other people who could potentially access the server are in Canada, and they only do so under my instruction in the event that I can't access the server.

The data is stored in a password protected database, it's not raw. However, if you have admin access to the server, and you REALLY wanted to, you could access the data.

[gbx78]

im happy to donate too hybrid. Let me know what i can do.

[mikes68]

At the moment it is hosted on my server, so yes I'm the only one who can access it.

There is no guarantee that the tracking server will stay there though, because I simply can't provide the same level of service on my server at home. At the moment it's fine because it's only a few people using it, but my internet connection and power infrastructure can't compete with that of a data centre. Even if I moved it to the Mustangtech server, the only other people who could potentially access the server are in Canada, and they only do so under my instruction in the event that I can't access the server.

The data is stored in a password protected database, it's not raw. However, if you have admin access to the server, and you REALLY wanted to, you could access the data.

Thanks heaps again for the complete response. Sounds secure enough as far as I'm concerned.

[hybrid]

No need for donations yet... just some testers once I get the SMS part of the app sorted.

[Ausjacko]

Hi Geoff
I have a friend who is a mobile apps developer. Did some cool stuff with cross platform mobile apps matching location to govt services nearby. He also plays on iOS (against my advice mind you). If you need a hand or a second set of eyes he is really helpful and likes cars.

Got the OnePlus 2 in the mail last week- very noooice

Cheers
Jacko

[hybrid]

Thanks Jacko,
I am actually stuck a little bit at the moment, but I'm going to plug away for a while because it's the best way to learn.

If I can't sort it out I will put my hand up.
I wonder how many of these trackers are out there around the world.
I guess most would be connected to a corporate type system for fleet tracking. Not sure how many people would be using them like we do.

[boofhead]

Most are a part of an Asset Management system or service delivery system. I built a tracker system 20+ years ago - way before Google maps and Phone Data networks. I had to put together GPS devices, into Radio modems (using UHF/VHF) and then into in car rugged laptops (using image maps and different layers - had to write the code to select the depth and detail on the maps and level). This all communicated over the radio using my own packed protocol I developed. This all went back to the server side which showed trucks on a main screen map or desktop maps for both - as well as send delivery instructions and jobs and status information forward and back. I was a very difficult job but very rewarding. I won an award for this work.

These days it is so easy to build such a system. I know it is relative though all the really difficult parts are easy to hook together. Then all you have is basic high level protocol and basic GUI.

Hybrid I think what your trying to do is excellent. I am watching in interest.

[hybrid]

Yeah developing that kind of thing these days is much easier with google maps, and even developing an app is not that difficult. It's in their interest to make it as easy as possible.

My main issue is that I don't know Java well (which is what most of Android is built on), and Android have some restrictions around what you can do with the UI so you don't slow it down (which is entirely understandable) so that a badly coded app doesn't make their o/s look slow.

[boofhead]

I have been suing Java (almost since it arrived on the scene) and C++ [less so lately - mainly Java + Web technologies]. I can help with the language no problem - Android specific issues less so though happy to give it a crack.

[hybrid]

I think I've finally cracked that part, so all good for now.