Create your link
Use the same learner ID and password as in the ComfortDelGro Driving Centre app. They're encrypted right here in your browser, and then the link gets one test run, so you can see it working before you subscribe. Curious how it works? It's all explained below.
Your link is ready
Prefer to add it yourself?
iPhone or iPad. Go to Settings, then Apps, then Calendar, then Calendar Accounts, then Add Account, then Other, then Add Subscribed Calendar, and paste the link.
Mac. In Calendar, choose File, then New Calendar Subscription, and paste the link. You'll see an Auto-refresh menu: every 15 minutes is the shortest setting worth picking, because bookings are cached here for that long anyway.
Google Calendar. On a computer, open Other calendars, then From URL, and paste the link. Google is slow to refresh subscribed calendars, sometimes only once a day.
Outlook. Choose Add calendar, then Subscribe from web, and paste the link.
Reminders. Every booking comes with a reminder an
hour ahead. Want two hours instead? Add &alarm=120
to the end of the link. For no reminder at all, add
&alarm=0.
What happens to your password
This page, in your browser
Reads your ID and password and encrypts them. This is the only place you type them, and it happens before anything is sent.
your encrypted details, inside the link your calendar app sends each time it refreshes
This site's server
Decrypts your details, signs in to ComfortDelGro Driving Centre as you, builds your calendar, then forgets your ID and password. The only thing it keeps for good is its private key.
your ID and password, as the driving centre expects them
ComfortDelGro Driving Centre
Sends back your bookings: the same list you'd see if you checked them yourself. This part belongs to the driving centre, not to this site.
The encryption, step by step
-
This page asks the server for its public key (a P-256 elliptic-curve key). A public key can only encrypt. The matching private key is the only thing that can decrypt, and it never leaves the server.
-
Your browser makes an ephemeral key pair of its own, used for this one message and then discarded. It combines its private half with the server's public key (ECDH) to derive a shared secret. The server can compute the same secret from the other two halves, but nobody watching the link go past can compute it from the public keys alone.
-
That shared secret is expanded into a 256-bit key (HKDF-SHA256), and your ID and password are encrypted with it using AES-256-GCM. GCM also authenticates the result, so a link that's been altered fails to decrypt.
-
The ephemeral public key is bound into both the key derivation and that authentication tag. That means your encrypted details can't be lifted out of one link and attached to a different key: they only decrypt as the whole piece they were encrypted as.
In one line: ECIES over P-256, HKDF-SHA256, AES-256-GCM. The browser's half is about a hundred lines in /app.js.
How you're protected
What you can count on
-
Your password stays hidden inside the link
Wherever your link is saved or sent, your password can't be read from it.
-
There's no account and no database
This site keeps no list of who uses it. The link is the only lasting record, and you're the one holding it. Your bookings are cached for fifteen minutes, under a one-way hash of your credentials rather than the credentials themselves, so an eager calendar app doesn't pester the driving centre on your behalf. A second copy is kept for 48 hours and only used if the driving centre can't be reached, so an outage there doesn't empty your calendar.
-
You can switch a link off any time
Change your ComfortDelGro Driving Centre password, and every link made with the old one stops working the next time it refreshes. Then pop back here and make a new one.
Two things to know
-
The server sees your password for a moment
To sign in for you, the server has to decrypt your password. It holds it in memory for the second or two each refresh takes, and never stores it. The encryption keeps it hidden everywhere else.
-
Treat your link like a password
Anyone who has your link can see your bookings. They can't read your password, sign in to the driving centre, or book or cancel anything. So keep the link to yourself, and if it ever gets out, changing your password switches it off.
It's all open source
Every line of this site is public, so you can see exactly what it does.
The part that runs in your browser is
/app.js: the
exact file your browser downloaded, unminified, about two hundred
lines of it. The four steps above are its
encryptCredentials function. The server's code sits
alongside it
on GitHub, so you can follow your details at every step.
Ready? Back to the form.
Questions people ask
- Is this ComfortDelGro Driving Centre's own app?
- No. It's unofficial: it isn't built by or connected to ComfortDelGro Driving Centre, and it has no arrangement with them. It signs in with your own account and reads the same booking list you see yourself. You still book and cancel in the CDC app. This just copies the result into your calendar.
- Which calendars does it work with?
- Anything that takes a subscription URL: iPhone, iPad and Mac, Google Calendar, Outlook, Fastmail, Thunderbird. The link gives back an ordinary iCalendar feed, so if your calendar can subscribe to one at all, it can subscribe to this.
- How quickly does a new booking show up?
- That depends on your calendar app, and on a Mac it's up to you. When you subscribe on a Mac, Calendar's Auto-refresh menu lets you pick anything from every five minutes to weekly. iPhone and iPad don't give you a choice, and check roughly once an hour. Google Calendar is slower still, sometimes only once a day. Bookings are cached here for fifteen minutes, so picking anything shorter than that on a Mac just asks more often for the same answer.
- Does it cost anything?
- No, it's free. There's no account, no sign-up and no payment.
- How do I remove it?
- Delete the subscription in your calendar app, and the events go with it. To stop the link itself from working, anywhere and for anyone, change your ComfortDelGro Driving Centre password.
- Is my password safe?
- Your learner ID and password are encrypted in your browser before they're sent, and they travel only inside your calendar link. The server decrypts them just long enough to sign in for you, and never stores them. How you're protected has the details.
- Does this site use cookies?
-
Only for counting visits. The page uses Google Analytics, loaded
from
googletagmanager.comandgoogle-analytics.com, which sets two cookies,_gaand_ga_3MJPXZTQFV, so that a return visit is recognised. Analytics is never told your learner ID, your password, your bookings or your calendar link.