I doubt it a "I don't know what the hell I'm doing" fuckup. Probably more of a "I warned my higherups, and they overruled me because they wanted the feature more than they wanted the app to be secure, and so they can handle the fallout" fuckup.
I've seen that work out the opposite way, where “Yes, but” gets the part after “but” listened to, and “No, because” with a reason that isn't really a can’t be done reason but a cost to consider gets you not only ignored on the specific point but also frozen out of being involved in business and upper management contact because you are seen as projecting an air of laziness/inflexibility.
I've used these apps before in the UK, and it is great being able to generate a ticket offline, but it appears they've achieved that by including the private keys in the app. Oh dear.
Would there be any fool proof alternative to allow for offline ticket creation in a mobile app when that app can be reverse engineered?
I don’t understand how offline ticket creation could work in any scenario, full-stop. Surely you need to have a data connection in order to purchase the ticket in the first place, right?
Oh, sure - I mean you could carry a balance, but that would be inherently insecure (clearly not something they are particularly fussed about).
Apple Pay is a little different in that the terminal is online - I was under the impression all contactless terminals perform auth in real-time, but I may be mistaken.
It wouldn't necessarily be insecure - the bus could reject an offline-generated ticket at the time the user tries to get on the bus if the user's account is unable to pay for it.
Sure, if the scanners are online that makes a great deal of sense (though you would have to perform that transaction in real-time, which would be slow)
Buses are online. I’ve seen them authenticate a new card in real-time (they charge £0.10 on a card they haven’t seen recently to check if it’s cancelled).
London Underground and London Buses are both "semi-online". They don't generally try to immediately validate a transaction with your bank the moment you touch your card. Transactions are batched and applied overnight, after applying any discounts like daily/weekly fare caps, out-of-station interchanges, and the bus "hopper fare". The batching means that transactions can still be accepted if the terminal is offline for some reason.
However, there is also a blacklist of card numbers that have outstanding balances against them. If you try to use a card that is declined, it will work the first day but not on subsequent days. If you go on TfL's website and clear the outstanding balance, the card will work again after 30 minutes (or in practice, less) once it is removed from the blacklist.
The EMV system (that makes contactless card payment work as well as "chip cards") has the card act as a representative for its owner (the card company, not you, you don't own the card and it tells you that when you get it) and it negotiates with the terminal for each transaction.
The card (on behalf of its owner) gets to say e.g.
"Hi, I am allowed to authorise $185 more offline before talking to my owner. I am allowed to do PIN transactions also I have a magstripe. What shall we do now?"
And a terminal could say "OK, let's do an online $28 transaction, with proof of PIN" or, "I'm good, $5.80 offline and no need for a PIN".
All this complexity opens up a bunch of potential problems (and EMV is guilty of not getting in a team of academics to figure out the cryptographic situation before shipping it, so it has had to be repeatedly patched and has a bunch of issues that needn't exist) but it allows Apple Pay to decide that e.g. you can spend up to $50 per time, and so long as you make an online transaction at least once per week and without spending more than $250 offline that's fine.
Both the issuer of the card and the terminal's owner get to decide on their appetite for risk. Probably if you sell $500 gold chains from a location with bars on the windows and an airlock entrance you want to do online proof-of-PIN transactions only, even if the card itself says it's happy to spend $500 offline contactless - and if your bank is trying to rehabilitate someone with spending problems (in a country where just exploiting them isn't legal) its card may tell the guy with a street cart that alas you need to go online and do a PIN transaction even for their $6 bagel.
Surely Apple pay works offline because your balance is checked by the card reader before the transaction is approved, in the same way it is when you use a contactless debit card?
They don't really check your balance on the contactless debit card. They just try to charge you. (This may mean authorising an outline transaction they try to execute later) It either works or not. But basically if it works, it's now between you and the bank.
There are two separate transactions for payment cards. Authorization and Settlement. Only Authorization involves all this clever technology like encryption and PINs, only Settlement actually moves any money anywhere.
For some debit cards, the situation is that they only allow Authorization to occur online, and it will validate your balance before authorizing the transaction AND it will respond to Settlements which are unauthorised by always reversing them.
Most people don't want this, because it's annoying, but it can be an option for people who have (some) money but can't be trusted with debt, for example some problem gamblers. It would never be reasonable to give them a card they can spend more than they have on, because they will spend uncontrollably.
The distinction between Authorization and Settlement has a variety of weird consequences. For example:
If you lose a card and it has to be blocked by the issuer, transactions you Authorized with that card can still be Settled hours, days or even very occasionally weeks later despite the block.
Some merchants who determine their exposure to fraud is very low just don't bother with Authorization at all. They only do Settlement, and it Just Works™ because none of their customers were trying to defraud them or queries the bill. This is a really nice user experience, super low friction.
Modern Authorization has anti-replay features, because it's built out of technologies where that was essentially free. So you can't execute any Authorization more than once (but Light Blue Touchpaper has an example incident where bad RNG allowed bad guys to attack this). But Settlement still acts like reel-to-reel tape is exciting new technology so it has no anti-replay, and periodically a batch of Settlements will accidentally be executed twice, taking money from customers and giving it to merchants until enough related complaints happen for somebody to realise the mistake and fix it.
What happens if you uninstall the app before going back online? You'd need to rely on the ticket being scanned at some point to ensure the person was charged, which isn't guaranteed on many transport systems (including the British rail network.)
While still online, let people download a bunch of signed tokens from a server in exchange for their public key, which is linked to their phone number and thus identity and credit card.
Now when offline, they can create their tickets by linking a token to a fare and sign that with their private key.
At check-in, collect those tickets and when online again, charge the credit card.
Off the top of my head, if the backend holds either the payment details or an alias to them from a payment service provider, you could also implement a solution where the turnstile/conductor is connected to a network and the payment gets done on the backend once a ticket generated offline gets scanned/used
Ah, so essentially require the inclusion of a pre-signed, server-generated token identifying the user in the ticket’s QR code and perform the actual charge when the ticket is used.
That’s much better, though it’s subject to some edge cases similar to the London Underground, caused by the potential for using invalid payment methods. Not bad though; probably low-enough potential for abuse to ignore.
A bus ticket just says you've paid some money to get on a bus. It's not a booked seat or anything else like it.
Also, historically bus tickets do not exist to keep passengers honest. They exist to keep the drivers honest. A valid ticket tells the bus company that the driver isn't taking passenger money but not declaring that money to the bus company.
Issue an asym key to a user upon them registering their official bank details. Backend holds one side of it (not sure whether to call this the pub or priv).
User uses the asym key to sign a message and shows that message to the inspector (in reality, QR code or similar).
If the user cheats you go after the account holder behind the key for reconciliation.
edit: Doesn't work as you need to enforce buying even if unchecked.
You can't detect cheating if the user is using a custom client in this scenerio. At most, the software client used by the inspector could mark your ticket with the backend as 'checked', which would mean that any checked ticket that doesn't get reported as actually purchased at some point could indicate fraud. A sophisticated custom client could just actually purchase any ticket that gets checked though. It would still net you a rather significant discount depending on the coverage of ticket inspections.
What does work is providing a way to check-in and out of transport via gates or poles not under the control of the traveller with a token like the Oyster card.
You can do statistical analysis if certain users get checked unusually often (I.e. generate tickets only when checked). After some time you can force those users into online only mode.
I have nearly no information about this scheme because the post got removed.
It has to be partially online, how do you pay without an online connection? Is there some kind of amount you have and then you can redeem them offline?
At one point you do require an online check in, that's for sure, that's when you find out whether the tickets were bought only when checked or not.
This is only a problem if you want gate-less tickets, i.e. get on a bus/train without scanning at a reader or network comms, which seems an overly strict requirement.
And no comms between client device and internet endpoint for several minutes? Is so, you can say 'network down, manual scan required'. If client can get network, it buys a ticket online.
By offline do we just mean the passenger's device? If the POS is online, then what might work would be to hash the ticket's details (user id, journey, time) with a per customer secret. Embed that in the QR code and it's basically a claim that, yes, this passenger would like to be billed for this ticket. The POS would then check the passenger's account balance or for a previously authorized credit card or whatever.
You'd have to generate "tickets" that actually just link to your account so you can be charged for them by the transport company when you scan them on entry to the vehicle.
The vehicle ticket scanner would log all tickets and make sure they were charged.
I can’t think of an infallible means of issuing a ticket completely offline, that usually gets into security by obscurity and eventually someone will be motivated to break that.
I think the signed ticket scheme would have been better used for redeeming already issued tickets or tickets to identity verified previously.
Issuing a ticket with pre-signed identity token is essentially a good faith transaction - it is not guaranteed to be valid end to end - but you can compare against a blacklist of identities at redemption time to limit the impact of someone abusing the system.
The commuter rail lines in New York want to charge a premium for issuing a ticket onboard so they have this whole scheme where you have to activate an e-ticket before you leave the station and then it’s only good for an hour, and 90% of the time they don’t validate it - just see that a QR code is on your phone - the other ten percent of the time they want you to swipe or do something to prove it’s not just a screen shot. It can lead to a lot of drama in areas where the cell service is weak or none, or accidentally closed the app, and people don’t have cash on them. I think signing the tickets could solve a lot of the drama. If the conductor has internet connectivity he can validate and redeem tickets in real time, if not then the conductor can validate in real time, make sure no one else on the train has a duplicate ticket, and redeem in bulk when they get into cell range again.
Problem is reuse of existing ticket. I guess Ticket has 2 parts, some token (which you buy when you are online) and some time part (for validity), app signs this token, when you are using with some private key.
So basically, as you can sign many times same token with different time value, there is no solution for offline generate and offline use scenario.
They could adopt a different model like in Prague where a ticket is time-based and ticket inspectors roam and fine people. The tickets cover buses, trams, metro, funicular, ferries and you can buy a yearly ticket for about £150.
The UK makes travelling by public transport as tedious as possible.
If this is activism, what is political goal here? It seems like all this does is enable people with a highly-paid skill (accessing tor, then deploying/running scripts) to not pay for transport.
I'm not sure that making public transportation free is the right idea to make more public transportation available, since the public transportation networks use the money from fares to function (in addition to money from the gov, any network with farebox recovery ratio [0] < 100% will need an external money source)
Still I agree that public transportation is a common good and I'm happy to live in a country with above-average networks (both at the local and national levels).
The public version is to demonstrate that large enterprises looking after public infrastructure & contracts still fail spectacularly to implement basic security practices in their products.
Under the covers, it's an invitation to have a go at transport operators who are unpopular and have a reputation for offering low-quality services at high cost.
So the goal is to say "look, your security is stupid, we will all have free rides until you fix it"? That's most likely to result in more money being spent by the public transport company to counter the bad PR and fix the issue.
"The reason we’ve decided not to go down the responsible disclosure path is being strong believers in public transportation being a common good that should be free for everyone, and this research is our contribution to get us closer to that end."
It's a way to steal from the local community given that public transports are financed mostly by tax money and by tickets (a tax based on your usage of the infrastructure). They present it as if it was a political action. That's rather ironic IMHO.
Free public transports just mean that you pay it through another way, and most likely mean that you remove the "use tax", thus increasing the contribution from people who don't actually use public transports.
In one of the Nordic countries (at work so can't do research) they made PT free because ticketing maintenance costs were more expensive than ticket revenue.
In other words, free PT could save taxpayers money.
>Free public transports just mean that you pay it through another way, and most likely mean that you remove the "use tax", thus increasing the contribution from people who don't actually use public transports.
Absolutely, and that is in fact their political stance. They believe that there should be no use tax on public transport and that people who don't use it should still be responsible for financing it. Their reasoning is probably based on the assertion that public transport causes positive externalities even for non-users, and that the resulting benefit to society as a whole outweighs the purported unfairness against individuals. You may or may not agree, it may or may not be a good policy, but it is a legitimate political stance.
A separate issue is whether guerrilla tactics/direct actions such as these can be justified to attain a political goal in a liberal democracy, and yet another debate is whether these methods are even tactically useful in getting closer to their stated goal.
To be honest, I haven't checked the content of the onion link so I don't know what their position is (or if they even communicate it), I will assume that you're describing their it accurately.
> they believe that there should be no use tax on public transport and that people who don't use it should still be responsible for financing it
I don't know for Manchester specifically but any public transport I'm familiar with is payed in huge part with tax money, so people who don't use public transports are already paying for it. But not the 100%, instead it's balanced with the use tax. So, is that the contention point, that it should be paid only by tax money? I don't understand what benefits that would bring. With this system, people using public transports the most (thus get the most value) would pay the less (if averaged per trip), how do you balance such a system?
Concerning their action, what's the idea behind sharing their exploit other than simplifying the work of free-rider? That it is too expensive to design a use-tax system that works, thus make the 100% government funded solution more attractive?
Because their position is naive and lacks any serious economic or political justification. Even assuming that their beliefs are sincerely held, this would not be the correct course of action to go about inciting change.
"Blacks should just sit in the back and petition for the law to be changed. There is after all a correct course of action to go about inciting change."
I'll grant that the comparison is way out of proportion but would you have held this position in the 60's?
Simply because looking at vulnerabilities in a ticket system won't actually bring them any closer to actual free public transit.
It may bring them more publicity though by the media that will talk about them, but they are also labeling this cause as being the criminal side.... which isn't really good (that's actually the strategy that multiple government use to push their agenda, making the opposite side seems like they are infringing the law).
Whenever I see someone talk about something like that being "free" my initial reaction is also that they must be trolling. Sadly, it usually turns out they are not.
As long as you put the word "free" in quotes then I am with you.
Although...just to nit pick a little. If you mean less road damage then keep in mind that road damage is proportional to the 4th power of vehicle weight. So buses cause enormously more road damage than cars.
Low transaction costs are an essential factor for free markets to function well, so when the government provides services at no charge, just because they are operating at a loss from an accounting perspective doesn't mean they aren't unlocking large amounts of wealth in the private sector.
People who claim to like markets tend these days to subscribe to a quasi-religious faith that markets are maintained by some ethereal force rather than human institutions. Free markets are an absolutely vital and fundamental aspect of the wealth and power of the developed world, but they cannot exist in their highest form apart from the centralized machinery that enables people to trust each other and easily buy and sell. If anarcho-libertarians were to break that down, perhaps society could still function at some level, but it would be vastly poorer until everything was rebuilt in some other form.
Enlightened self interest is wanting to raise your own taxes to pool money for common goods and services. Wanting to raise someone else's taxes for your personal benefit is just regular old self interest.
The people I am referring typically just think it is somehow free. They don't seem to understand that somebody is paying for it, and that it might even be them. And that it is being paid for in a round-about and grossly inefficient manner compared to paying directly at the point of service.
Nobody is unaware that somebody is paying for it. The issues are more subtle than that.
Collecting and accounting for payment is overhead. If something is "free", then that overhead can be reduced or eliminated. On the other hand the basic purpose of charging for anything is to allocate limited resources, so the task is how to match supply and demand.
But saying it is "grossly inefficient" not to charge for something makes no sense to me. That's not the issue at all.
I beg to differ. At best, many people just don't really give it much thought. Many others think that when the government does something it is free, not understanding that the people pay for everything the government does.
The thing that is grossly inefficient is the manner in which services are paid for when it involves doing it indirectly via tax authorities. The overhead can't be eliminated when it is done that way - it requires a contingent of administrators and petty bureaucrats.
It doesn't matter how many administrators you have, you need more if you bill people and less if you don't. This would apply to private or public sectors. Don't you think this has something to do with why we see private companies giving away stuff instead of implementing microtransactions?
The obvious problem with providing stuff at no charge is that it will cost too much to supply it, and people will waste it, but that isn't what I would call overhead, and I don't think you are talking about that.
You mention Oyster cards so I'll assume you're talking about London in which case the operator (TfL) clearly states that "Fares are the single largest source of our income (projected to be 47% in 2019/20)". [0]
This income more than covers the operational costs, with the difference being used to support new infrastructure projects and upgrades such as the Elizabeth Line (as well as concessions for students, the elderly, etc).
Clearly there is a very strong argument for charging.
Right but how much of those operating costs go away if you don’t have to charge?
And let’s say you scope this only to buses (which are used less by commuters, and have real impacts on the environment)
Honestly I think not charging for buses in London would net out positively financially, and be better for all involved (faster, less cars on the road, easier to design buses for disabled access and prams etc.)
What percentage of operating costs are paid for with fares has basically nothing to do with what percentage should be paid for with fares. If paying 100% with taxes results in lower costs per rider because you don't have to pay for fare collection costs and higher use of public transport because there is less friction (which benefits even those who don't use it via lower traffic and pollution etc.), why shouldn't we do that instead?
Fare collection in London is almost frictionless. Almost all public transport can be paid for with contactless debit/credit or prepaid cards. Drivers have no requirement to verify fares and all stations have self-service terminals.
Although the administration cost is not zero, it is almost certainly negligible enough that moving to a taxpayer funded model would increase these costs. This is particularly true given that transport budgets are operated at the regional level and would require the introduction of new regional taxes rather than simply relying on exiting tax revenue. (The politics of passing any new tax legislation would be a monumental hurdle in the first instance).
Then there is the question of whether a broad tax is more equitable then the current model. I fail to see how this could be the case given the current system retains the price signal and through a system of concessions ensures that those who most benefit from the provision (e.g. professional working in the inner city) contribute the most and effectively subsidise fares for the rest of society.
Not in London. You can use card readers at all doors and drivers tend to start driving once everyone is on board, not only once everyone has checked in.
That’s only on the new route masters in zone1, outside of zone 1 there’s one door and everyone must enter through that door, tap in while the driver watches and the driver will not leave until everyone who gets on has paid
> Almost all public transport can be paid for with contactless debit/credit or prepaid cards. Drivers have no requirement to verify fares and all stations have self-service terminals.
You're talking about the time it takes as you step onto the vehicle. That's not zero, but it's not half of the cost. You also have to fill the card to begin with, but most importantly it causes people to incur an incremental cost for using public transportation, which discourages its use. That's very bad.
> Although the administration cost is not zero, it is almost certainly negligible enough that moving to a taxpayer funded model would increase these costs. This is particularly true given that transport budgets are operated at the regional level and would require the introduction of new regional taxes rather than simply relying on exiting tax revenue.
There are surely existing regional taxes. The collection cost is therefore sunk and the overhead of adjusting the rate is nominal. Moreover, people don't like paying taxes, but people don't like paying fares either, so it balances out -- or comes out in favor of using taxes because in that case the cost is lower when you don't have the overhead of doing fare collection (and you have the overhead of tax collection either way).
> Then there is the question of whether a broad tax is more equitable then the current model. I fail to see how this could be the case given the current system retains the price signal and through a system of concessions ensures that those who most benefit from the provision (e.g. professional working in the inner city) contribute the most and effectively subsidise fares for the rest of society.
Professionals working in the inner city don't pay different transit fares than janitors working in the inner city (and if they did you're just imposing income tax but calling it something else and paying more overhead to collect it), and you don't want a pricing signal here because pricing is a method of rationing scarce resources but we want people to use public transit as much as possible.
Any bank card works, so does Apple/Android pay. Even the prepaid card can be purchased from a self-service machine in less than a minute and topped up via an app.
> There are surely existing regional taxes.
The only broadly administered regional tax in the UK is the council tax. This only covers property owners. There is no other regional taxation - certainly not one that is broader. You also vastly underestimate the public opposition to taxes versus fare increases.
> Professionals working in the inner city don't pay different transit fares than janitors working in the inner city. ...and you don't want a pricing signal...
People pay different rates based on how close to the centre they commute to. Typically professionals commute further because the white collar jobs are located in the centre, blue collar workers on the other hand tend look for work close to where they live and are more likely to travel outside of peak hours.
As for the price signal, it plays a hugely important part. It enables fares to change depending on demand in order to spread out congestion rather than having everyone commute at rush hour (infrastructure cannot support unlimited travellers and public transport is most certainly a scarce resource that requires rationing). The price signal also provides a strong incentive to cycle/walk by imposing a marginal cost on each journey. This incentive would be completely lost if you'd already been taxed, leading to over-consumption and environmental costs.
Your plan would also mean that residents would effectively subsidise the travel of all outsiders - which for cities like London (which get huge amounts of tourists and external commuters) would impose an unfair cost on the residents.
> Any bank card works, so does Apple/Android pay. Even the prepaid card can be purchased from a self-service machine in less than a minute and topped up via an app.
A little bit here, a little bit there. So easy to tap your card, only then you get a statement at the end of the month with 50 charges on it and have to reconcile each one with your actual usage to make sure none of the charges are fraudulent or in erroneous amounts.
Multiply by a couple million people and you're wasting a whole lot of people's time.
> The only broadly administered regional tax in the UK is the council tax. This only covers property owners.
Tax is tax. If it's property tax then it filters through to rents, which filters through to local consumer prices etc. There is a lot to be said about which ones are better from an economic and efficiency standpoint, but that really has nothing to do with transit -- if you have a bad tax system then switch to a better one regardless of how you fund public transit. But property tax for local services is far from the worst.
> You also vastly underestimate the public opposition to taxes versus fare increases.
Not wanting to do something that benefits people because people oppose it is just begging the question. If it benefits people then they shouldn't oppose it, so then the issue becomes convincing them, which is separate from the question of what the best policy is to begin with.
> People pay different rates based on how close to the centre they commute to. Typically professionals commute further because the white collar jobs are located in the centre, blue collar workers on the other hand tend look for work close to where they live and are more likely to travel outside of peak hours.
Blue collar workers avoid jobs with expensive commutes because they can't afford it -- but that's the problem.
> As for the price signal, it plays a hugely important part. It enables fares to change depending on demand in order to spread out congestion rather than having everyone commute at rush hour (infrastructure cannot support unlimited travellers and public transport is most certainly a scarce resource that requires rationing).
Use of public transport increases efficiency and become more attractive to everyone the more people use it, because then you get e.g. train service every 10 minutes rather than 30 because there are three times as many trains to carry three times as many people. If there isn't enough of it the answer is to increase capacity, not deter usage with pricing.
> The price signal also provides a strong incentive to cycle/walk by imposing a marginal cost on each journey. This incentive would be completely lost if you'd already been taxed, leading to over-consumption and environmental costs.
The environmental impact of an incremental passenger using mass transit is negligible and completely dwarfed by the efficiency improvement of people getting to their destination faster. The only real trade off is saving time vs. getting exercise, but that's a decision each individual can make for themselves. And you could easily be deterring someone from saving time that they could then use to engage in a more balanced exercise routine than 100% cycling and 0% any other exercise.
Moreover, many of the other alternatives to mass transit are things like driving or accepting a closer, lower paying job with lower overall economic efficiency, or having to waste hours a day to leave for work early and get home late to avoid congestion charges. Which are all costs we don't want to impose when there is a better alternative in building enough mass transit capacity to meet the peak demand without having to ration it.
> Your plan would also mean that residents would effectively subsidise the travel of all outsiders - which for cities like London (which get huge amounts of tourists and external commuters) would impose an unfair cost on the residents.
On the other hand, then it's cheaper to go into the city and patro...
> So bad behaviour goes unpunished due to economic upside?
No, that I didn't say that. I said there are no fines. You cannot check anything out if you have something over due and after a certain number of days it goes to collections. The library doesn't deal with fines. Which part of that policy would you be negatively affected by?
I am not being sarcastic. It has been great in out city. For some reason everyone outside the city tries to jump through a lot of hoops on why not charging fines to citizens is a bad idea. You people are interested in availability issues I suggest you reach out to the library and ask if it has been a problem. The number 619-236-5800.
The actual outcomes are irrelevant to my point, which is that you need to consider the effect on people's behavior when evaluating a policy (prospectively or retrospectively). You made it sound as if this was not done.
"Free" as in "free at the point of use", which is a perfectly valid political position. Obviously they don't think there is zero cost in providing public transportation.
Depends on how you account for benefits that offset the costs. Obviously you have to pay for fuel, drivers, trains etc. But if they add value to the local economy in excess of the costs then that money gets collected back as tax + benefits to the local people.
I’m sympathetic to the idea that public transit should have means tested fares, but outright free is a bad idea. It costs something to provide, quite a bit actually, and has limited capacity so there needs to be some mechanism to gate access. Price, which forces users to consider trade-offs, is the most straightforward way to do so.
Gates access to whom? Trade-offs in favour of what?
Introducing a fixed price gates the poor the most (eg. a wealthy individual can afford to spend a couple hundred pounds on a yearly subscription without much thought), and often incentivises trade-offs in favour of individual transportation (i.e. cars), which is less desirable in terms of pollution and traffic.
Technical cock-up aside, why the term "activists"?
Not questioning the title of the HN post, rather, wondering if I missed something going on I have missed in the news which would justify the term (instead of "hackers" or, even "security researchers", though the later seems to stretch the definition of responsible disclosure)
Ahh, this reminds me of BT Cellnet storing those first pay-as-you-go credit ledgers locally on the Philips C12 / Diga handsets, and just hoping nobody would notice.
130 comments
[ 4.3 ms ] story [ 173 ms ] threadEven if this guy objected to it, unless he quit his job straight after implementing this, you can be sure it came back down on him.
This is the kind of situation where you have to clearly argue your case and stand your ground.
Mgmt: Can we do this? Eng: Yes, but... Mgmt: [Tunes out after Yes] Do it
Saying 'No' instead of 'Yes, but' is hard but a really valuable ability.
> Even if this guy objected to it, unless he quit his job straight after implementing this, you can be sure it came back down on him.
> This is the kind of situation where you have to clearly argue your case and stand your ground.
Hopefully the theoretical person stated their objections in writing. Would be useful in avoiding the fallout.
Would there be any fool proof alternative to allow for offline ticket creation in a mobile app when that app can be reverse engineered?
Alternatively, Apply Pay works offline for NFC transactions - I've not tried doing an in-app purchase offline but that might work too.
Apple Pay is a little different in that the terminal is online - I was under the impression all contactless terminals perform auth in real-time, but I may be mistaken.
The terminals in London Underground stations might be constantly online, but I doubt very much there's a 100% guarantee for London Buses.
However, there is also a blacklist of card numbers that have outstanding balances against them. If you try to use a card that is declined, it will work the first day but not on subsequent days. If you go on TfL's website and clear the outstanding balance, the card will work again after 30 minutes (or in practice, less) once it is removed from the blacklist.
The card (on behalf of its owner) gets to say e.g.
"Hi, I am allowed to authorise $185 more offline before talking to my owner. I am allowed to do PIN transactions also I have a magstripe. What shall we do now?"
And a terminal could say "OK, let's do an online $28 transaction, with proof of PIN" or, "I'm good, $5.80 offline and no need for a PIN".
All this complexity opens up a bunch of potential problems (and EMV is guilty of not getting in a team of academics to figure out the cryptographic situation before shipping it, so it has had to be repeatedly patched and has a bunch of issues that needn't exist) but it allows Apple Pay to decide that e.g. you can spend up to $50 per time, and so long as you make an online transaction at least once per week and without spending more than $250 offline that's fine.
Both the issuer of the card and the terminal's owner get to decide on their appetite for risk. Probably if you sell $500 gold chains from a location with bars on the windows and an airlock entrance you want to do online proof-of-PIN transactions only, even if the card itself says it's happy to spend $500 offline contactless - and if your bank is trying to rehabilitate someone with spending problems (in a country where just exploiting them isn't legal) its card may tell the guy with a street cart that alas you need to go online and do a PIN transaction even for their $6 bagel.
For some debit cards, the situation is that they only allow Authorization to occur online, and it will validate your balance before authorizing the transaction AND it will respond to Settlements which are unauthorised by always reversing them.
Most people don't want this, because it's annoying, but it can be an option for people who have (some) money but can't be trusted with debt, for example some problem gamblers. It would never be reasonable to give them a card they can spend more than they have on, because they will spend uncontrollably.
The distinction between Authorization and Settlement has a variety of weird consequences. For example:
If you lose a card and it has to be blocked by the issuer, transactions you Authorized with that card can still be Settled hours, days or even very occasionally weeks later despite the block.
Some merchants who determine their exposure to fraud is very low just don't bother with Authorization at all. They only do Settlement, and it Just Works™ because none of their customers were trying to defraud them or queries the bill. This is a really nice user experience, super low friction.
Modern Authorization has anti-replay features, because it's built out of technologies where that was essentially free. So you can't execute any Authorization more than once (but Light Blue Touchpaper has an example incident where bad RNG allowed bad guys to attack this). But Settlement still acts like reel-to-reel tape is exciting new technology so it has no anti-replay, and periodically a batch of Settlements will accidentally be executed twice, taking money from customers and giving it to merchants until enough related complaints happen for somebody to realise the mistake and fix it.
Now when offline, they can create their tickets by linking a token to a fare and sign that with their private key.
At check-in, collect those tickets and when online again, charge the credit card.
That’s much better, though it’s subject to some edge cases similar to the London Underground, caused by the potential for using invalid payment methods. Not bad though; probably low-enough potential for abuse to ignore.
Also, historically bus tickets do not exist to keep passengers honest. They exist to keep the drivers honest. A valid ticket tells the bus company that the driver isn't taking passenger money but not declaring that money to the bus company.
Issue an asym key to a user upon them registering their official bank details. Backend holds one side of it (not sure whether to call this the pub or priv).
User uses the asym key to sign a message and shows that message to the inspector (in reality, QR code or similar).
If the user cheats you go after the account holder behind the key for reconciliation.
edit: Doesn't work as you need to enforce buying even if unchecked.
What does work is providing a way to check-in and out of transport via gates or poles not under the control of the traveller with a token like the Oyster card.
You have no way of detecting whether a user "bought a ticket" on seeing the inspector or not.
It has to be partially online, how do you pay without an online connection? Is there some kind of amount you have and then you can redeem them offline?
At one point you do require an online check in, that's for sure, that's when you find out whether the tickets were bought only when checked or not.
- Phone registers public key with backend during signup.
- Phone generates ticket signed with private key.
- Backend checks signed ticket against registered public key to charge customer.
Fraud is still possible but limited to individual customer accounts.
- phone displays the generated ticket to the ticket scanner in the bus. - the scanner connects to the backend to verify the ticket.
this way the phone can remain offline after registration, and only need to get online to send money for your account.
i see no way for possible fraud as in fact all the ticket is doing in that case is to verify your identity to the server.
now how can we do the same thing but without revealing your identity, but just verifying that you paid?
The vehicle ticket scanner would log all tickets and make sure they were charged.
I think the signed ticket scheme would have been better used for redeeming already issued tickets or tickets to identity verified previously.
Issuing a ticket with pre-signed identity token is essentially a good faith transaction - it is not guaranteed to be valid end to end - but you can compare against a blacklist of identities at redemption time to limit the impact of someone abusing the system.
The commuter rail lines in New York want to charge a premium for issuing a ticket onboard so they have this whole scheme where you have to activate an e-ticket before you leave the station and then it’s only good for an hour, and 90% of the time they don’t validate it - just see that a QR code is on your phone - the other ten percent of the time they want you to swipe or do something to prove it’s not just a screen shot. It can lead to a lot of drama in areas where the cell service is weak or none, or accidentally closed the app, and people don’t have cash on them. I think signing the tickets could solve a lot of the drama. If the conductor has internet connectivity he can validate and redeem tickets in real time, if not then the conductor can validate in real time, make sure no one else on the train has a duplicate ticket, and redeem in bulk when they get into cell range again.
So basically, as you can sign many times same token with different time value, there is no solution for offline generate and offline use scenario.
The UK makes travelling by public transport as tedious as possible.
[0] https://en.wikipedia.org/wiki/Farebox_recovery_ratio
Still I agree that public transportation is a common good and I'm happy to live in a country with above-average networks (both at the local and national levels).
Under the covers, it's an invitation to have a go at transport operators who are unpopular and have a reputation for offering low-quality services at high cost.
This is trolling, right?
Free public transports just mean that you pay it through another way, and most likely mean that you remove the "use tax", thus increasing the contribution from people who don't actually use public transports.
In other words, free PT could save taxpayers money.
Absolutely, and that is in fact their political stance. They believe that there should be no use tax on public transport and that people who don't use it should still be responsible for financing it. Their reasoning is probably based on the assertion that public transport causes positive externalities even for non-users, and that the resulting benefit to society as a whole outweighs the purported unfairness against individuals. You may or may not agree, it may or may not be a good policy, but it is a legitimate political stance.
A separate issue is whether guerrilla tactics/direct actions such as these can be justified to attain a political goal in a liberal democracy, and yet another debate is whether these methods are even tactically useful in getting closer to their stated goal.
> they believe that there should be no use tax on public transport and that people who don't use it should still be responsible for financing it
I don't know for Manchester specifically but any public transport I'm familiar with is payed in huge part with tax money, so people who don't use public transports are already paying for it. But not the 100%, instead it's balanced with the use tax. So, is that the contention point, that it should be paid only by tax money? I don't understand what benefits that would bring. With this system, people using public transports the most (thus get the most value) would pay the less (if averaged per trip), how do you balance such a system?
Concerning their action, what's the idea behind sharing their exploit other than simplifying the work of free-rider? That it is too expensive to design a use-tax system that works, thus make the 100% government funded solution more attractive?
On the whole, this is probably one of the least harmful things they could have released publicly.
Depends the actions you’re thinking about, but I would guess that’s likely to be the case, yes.
> On the whole, this is probably one of the least harmful things they could have released publicly.
Could you elaborate?
Because their position is naive and lacks any serious economic or political justification. Even assuming that their beliefs are sincerely held, this would not be the correct course of action to go about inciting change.
When was the last time that stopped anybody from taking a political stance?
this would not be the correct course of action to go about inciting change
See question above.
I'll grant that the comparison is way out of proportion but would you have held this position in the 60's?
It may bring them more publicity though by the media that will talk about them, but they are also labeling this cause as being the criminal side.... which isn't really good (that's actually the strategy that multiple government use to push their agenda, making the opposite side seems like they are infringing the law).
It's said that it's a net benefice for everyone:
- people move more, because it's free
- shop sells more because more people
- less cost induced by individual transport (less car on road = less damages, less pollution..)
Although...just to nit pick a little. If you mean less road damage then keep in mind that road damage is proportional to the 4th power of vehicle weight. So buses cause enormously more road damage than cars.
People who claim to like markets tend these days to subscribe to a quasi-religious faith that markets are maintained by some ethereal force rather than human institutions. Free markets are an absolutely vital and fundamental aspect of the wealth and power of the developed world, but they cannot exist in their highest form apart from the centralized machinery that enables people to trust each other and easily buy and sell. If anarcho-libertarians were to break that down, perhaps society could still function at some level, but it would be vastly poorer until everything was rebuilt in some other form.
Collecting and accounting for payment is overhead. If something is "free", then that overhead can be reduced or eliminated. On the other hand the basic purpose of charging for anything is to allocate limited resources, so the task is how to match supply and demand.
But saying it is "grossly inefficient" not to charge for something makes no sense to me. That's not the issue at all.
The thing that is grossly inefficient is the manner in which services are paid for when it involves doing it indirectly via tax authorities. The overhead can't be eliminated when it is done that way - it requires a contingent of administrators and petty bureaucrats.
The obvious problem with providing stuff at no charge is that it will cost too much to supply it, and people will waste it, but that isn't what I would call overhead, and I don't think you are talking about that.
Presumably you support per-mile metering on public roads then?
I.e those not on benefits, over the age of 18, under the age of 60 etc.
Now count how long the bus idles while people line up so the driver can validate their ticket / check they tapped in on their Oyster card.
Now add in all of the infrastructure and staff required to collect fees and account for them.
Then add in all of the external costs of charging for public transport (more cars, less productivity)
The argument for charging isn’t that strong.
You mention Oyster cards so I'll assume you're talking about London in which case the operator (TfL) clearly states that "Fares are the single largest source of our income (projected to be 47% in 2019/20)". [0]
This income more than covers the operational costs, with the difference being used to support new infrastructure projects and upgrades such as the Elizabeth Line (as well as concessions for students, the elderly, etc).
Clearly there is a very strong argument for charging.
[0] https://tfl.gov.uk/corporate/about-tfl/how-we-work/how-we-ar...
And let’s say you scope this only to buses (which are used less by commuters, and have real impacts on the environment)
Honestly I think not charging for buses in London would net out positively financially, and be better for all involved (faster, less cars on the road, easier to design buses for disabled access and prams etc.)
Although the administration cost is not zero, it is almost certainly negligible enough that moving to a taxpayer funded model would increase these costs. This is particularly true given that transport budgets are operated at the regional level and would require the introduction of new regional taxes rather than simply relying on exiting tax revenue. (The politics of passing any new tax legislation would be a monumental hurdle in the first instance).
Then there is the question of whether a broad tax is more equitable then the current model. I fail to see how this could be the case given the current system retains the price signal and through a system of concessions ensures that those who most benefit from the provision (e.g. professional working in the inner city) contribute the most and effectively subsidise fares for the rest of society.
Then you have all the ticket machines, barriers, stations, staff etc that would be completely unnecessary.
The only real bonus of collecting fares is that tfl acts as a treasury with millions of pounds in funds to invest.
I have observed that this is false in London at least 30 times.
You're talking about the time it takes as you step onto the vehicle. That's not zero, but it's not half of the cost. You also have to fill the card to begin with, but most importantly it causes people to incur an incremental cost for using public transportation, which discourages its use. That's very bad.
> Although the administration cost is not zero, it is almost certainly negligible enough that moving to a taxpayer funded model would increase these costs. This is particularly true given that transport budgets are operated at the regional level and would require the introduction of new regional taxes rather than simply relying on exiting tax revenue.
There are surely existing regional taxes. The collection cost is therefore sunk and the overhead of adjusting the rate is nominal. Moreover, people don't like paying taxes, but people don't like paying fares either, so it balances out -- or comes out in favor of using taxes because in that case the cost is lower when you don't have the overhead of doing fare collection (and you have the overhead of tax collection either way).
> Then there is the question of whether a broad tax is more equitable then the current model. I fail to see how this could be the case given the current system retains the price signal and through a system of concessions ensures that those who most benefit from the provision (e.g. professional working in the inner city) contribute the most and effectively subsidise fares for the rest of society.
Professionals working in the inner city don't pay different transit fares than janitors working in the inner city (and if they did you're just imposing income tax but calling it something else and paying more overhead to collect it), and you don't want a pricing signal here because pricing is a method of rationing scarce resources but we want people to use public transit as much as possible.
Any bank card works, so does Apple/Android pay. Even the prepaid card can be purchased from a self-service machine in less than a minute and topped up via an app.
> There are surely existing regional taxes.
The only broadly administered regional tax in the UK is the council tax. This only covers property owners. There is no other regional taxation - certainly not one that is broader. You also vastly underestimate the public opposition to taxes versus fare increases.
> Professionals working in the inner city don't pay different transit fares than janitors working in the inner city. ...and you don't want a pricing signal...
People pay different rates based on how close to the centre they commute to. Typically professionals commute further because the white collar jobs are located in the centre, blue collar workers on the other hand tend look for work close to where they live and are more likely to travel outside of peak hours.
As for the price signal, it plays a hugely important part. It enables fares to change depending on demand in order to spread out congestion rather than having everyone commute at rush hour (infrastructure cannot support unlimited travellers and public transport is most certainly a scarce resource that requires rationing). The price signal also provides a strong incentive to cycle/walk by imposing a marginal cost on each journey. This incentive would be completely lost if you'd already been taxed, leading to over-consumption and environmental costs.
Your plan would also mean that residents would effectively subsidise the travel of all outsiders - which for cities like London (which get huge amounts of tourists and external commuters) would impose an unfair cost on the residents.
A little bit here, a little bit there. So easy to tap your card, only then you get a statement at the end of the month with 50 charges on it and have to reconcile each one with your actual usage to make sure none of the charges are fraudulent or in erroneous amounts.
Multiply by a couple million people and you're wasting a whole lot of people's time.
> The only broadly administered regional tax in the UK is the council tax. This only covers property owners.
Tax is tax. If it's property tax then it filters through to rents, which filters through to local consumer prices etc. There is a lot to be said about which ones are better from an economic and efficiency standpoint, but that really has nothing to do with transit -- if you have a bad tax system then switch to a better one regardless of how you fund public transit. But property tax for local services is far from the worst.
> You also vastly underestimate the public opposition to taxes versus fare increases.
Not wanting to do something that benefits people because people oppose it is just begging the question. If it benefits people then they shouldn't oppose it, so then the issue becomes convincing them, which is separate from the question of what the best policy is to begin with.
> People pay different rates based on how close to the centre they commute to. Typically professionals commute further because the white collar jobs are located in the centre, blue collar workers on the other hand tend look for work close to where they live and are more likely to travel outside of peak hours.
Blue collar workers avoid jobs with expensive commutes because they can't afford it -- but that's the problem.
> As for the price signal, it plays a hugely important part. It enables fares to change depending on demand in order to spread out congestion rather than having everyone commute at rush hour (infrastructure cannot support unlimited travellers and public transport is most certainly a scarce resource that requires rationing).
Use of public transport increases efficiency and become more attractive to everyone the more people use it, because then you get e.g. train service every 10 minutes rather than 30 because there are three times as many trains to carry three times as many people. If there isn't enough of it the answer is to increase capacity, not deter usage with pricing.
> The price signal also provides a strong incentive to cycle/walk by imposing a marginal cost on each journey. This incentive would be completely lost if you'd already been taxed, leading to over-consumption and environmental costs.
The environmental impact of an incremental passenger using mass transit is negligible and completely dwarfed by the efficiency improvement of people getting to their destination faster. The only real trade off is saving time vs. getting exercise, but that's a decision each individual can make for themselves. And you could easily be deterring someone from saving time that they could then use to engage in a more balanced exercise routine than 100% cycling and 0% any other exercise.
Moreover, many of the other alternatives to mass transit are things like driving or accepting a closer, lower paying job with lower overall economic efficiency, or having to waste hours a day to leave for work early and get home late to avoid congestion charges. Which are all costs we don't want to impose when there is a better alternative in building enough mass transit capacity to meet the peak demand without having to ration it.
> Your plan would also mean that residents would effectively subsidise the travel of all outsiders - which for cities like London (which get huge amounts of tourists and external commuters) would impose an unfair cost on the residents.
On the other hand, then it's cheaper to go into the city and patro...
Not something I'd want.
What do they do when there's an increase in bad behaviour which was previously addressed by fines?
No, that I didn't say that. I said there are no fines. You cannot check anything out if you have something over due and after a certain number of days it goes to collections. The library doesn't deal with fines. Which part of that policy would you be negatively affected by?
If you are being sarcastic in order to make that point, that may be too subtle to communicate with most people that don't think of it on their own.
Why do you think people claiming benefits get free transport?
Introducing a fixed price gates the poor the most (eg. a wealthy individual can afford to spend a couple hundred pounds on a yearly subscription without much thought), and often incentivises trade-offs in favour of individual transportation (i.e. cars), which is less desirable in terms of pollution and traffic.
The poor already get free travel. As do pensioners.
Link here: https://www.immuniweb.com/mobile/?id=hprUh4hL
Although, it redirects after a few seconds, but you should be able to see the link.
http://2dpue32kldx6sm24r2lbisilqhzlglffssgyjgqwwq7masm74rliw...
I'm not sure if I'm allowed to post this on HN – I think it should be legal to post a link.
Not questioning the title of the HN post, rather, wondering if I missed something going on I have missed in the news which would justify the term (instead of "hackers" or, even "security researchers", though the later seems to stretch the definition of responsible disclosure)