Activists release code to generate free public transportation tickets in U.K
reddit.com
reddit.com
Would there be any fool proof alternative to allow for offline ticket creation in a mobile app when that app can be reverse engineered?
Alternatively, Apply Pay works offline for NFC transactions - I've not tried doing an in-app purchase offline but that might work too.
Apple Pay is a little different in that the terminal is online - I was under the impression all contactless terminals perform auth in real-time, but I may be mistaken.
The terminals in London Underground stations might be constantly online, but I doubt very much there's a 100% guarantee for London Buses.
However, there is also a blacklist of card numbers that have outstanding balances against them. If you try to use a card that is declined, it will work the first day but not on subsequent days. If you go on TfL's website and clear the outstanding balance, the card will work again after 30 minutes (or in practice, less) once it is removed from the blacklist.
The card (on behalf of its owner) gets to say e.g.
"Hi, I am allowed to authorise $185 more offline before talking to my owner. I am allowed to do PIN transactions also I have a magstripe. What shall we do now?"
And a terminal could say "OK, let's do an online $28 transaction, with proof of PIN" or, "I'm good, $5.80 offline and no need for a PIN".
All this complexity opens up a bunch of potential problems (and EMV is guilty of not getting in a team of academics to figure out the cryptographic situation before shipping it, so it has had to be repeatedly patched and has a bunch of issues that needn't exist) but it allows Apple Pay to decide that e.g. you can spend up to $50 per time, and so long as you make an online transaction at least once per week and without spending more than $250 offline that's fine.
Both the issuer of the card and the terminal's owner get to decide on their appetite for risk. Probably if you sell $500 gold chains from a location with bars on the windows and an airlock entrance you want to do online proof-of-PIN transactions only, even if the card itself says it's happy to spend $500 offline contactless - and if your bank is trying to rehabilitate someone with spending problems (in a country where just exploiting them isn't legal) its card may tell the guy with a street cart that alas you need to go online and do a PIN transaction even for their $6 bagel.
For some debit cards, the situation is that they only allow Authorization to occur online, and it will validate your balance before authorizing the transaction AND it will respond to Settlements which are unauthorised by always reversing them.
Most people don't want this, because it's annoying, but it can be an option for people who have (some) money but can't be trusted with debt, for example some problem gamblers. It would never be reasonable to give them a card they can spend more than they have on, because they will spend uncontrollably.
The distinction between Authorization and Settlement has a variety of weird consequences. For example:
If you lose a card and it has to be blocked by the issuer, transactions you Authorized with that card can still be Settled hours, days or even very occasionally weeks later despite the block.
Some merchants who determine their exposure to fraud is very low just don't bother with Authorization at all. They only do Settlement, and it Just Works™ because none of their customers were trying to defraud them or queries the bill. This is a really nice user experience, super low friction.
Modern Authorization has anti-replay features, because it's built out of technologies where that was essentially free. So you can't execute any Authorization more than once (but Light Blue Touchpaper has an example incident where bad RNG allowed bad guys to attack this). But Settlement still acts like reel-to-reel tape is exciting new technology so it has no anti-replay, and periodically a batch of Settlements will accidentally be executed twice, taking money from customers and giving it to merchants until enough related complaints happen for somebody to realise the mistake and fix it.
Now when offline, they can create their tickets by linking a token to a fare and sign that with their private key.
At check-in, collect those tickets and when online again, charge the credit card.
That’s much better, though it’s subject to some edge cases similar to the London Underground, caused by the potential for using invalid payment methods. Not bad though; probably low-enough potential for abuse to ignore.
Also, historically bus tickets do not exist to keep passengers honest. They exist to keep the drivers honest. A valid ticket tells the bus company that the driver isn't taking passenger money but not declaring that money to the bus company.
Issue an asym key to a user upon them registering their official bank details. Backend holds one side of it (not sure whether to call this the pub or priv).
User uses the asym key to sign a message and shows that message to the inspector (in reality, QR code or similar).
If the user cheats you go after the account holder behind the key for reconciliation.
edit: Doesn't work as you need to enforce buying even if unchecked.
What does work is providing a way to check-in and out of transport via gates or poles not under the control of the traveller with a token like the Oyster card.
You have no way of detecting whether a user "bought a ticket" on seeing the inspector or not.
It has to be partially online, how do you pay without an online connection? Is there some kind of amount you have and then you can redeem them offline?
At one point you do require an online check in, that's for sure, that's when you find out whether the tickets were bought only when checked or not.
- Phone registers public key with backend during signup.
- Phone generates ticket signed with private key.
- Backend checks signed ticket against registered public key to charge customer.
Fraud is still possible but limited to individual customer accounts.
- phone displays the generated ticket to the ticket scanner in the bus. - the scanner connects to the backend to verify the ticket.
this way the phone can remain offline after registration, and only need to get online to send money for your account.
i see no way for possible fraud as in fact all the ticket is doing in that case is to verify your identity to the server.
now how can we do the same thing but without revealing your identity, but just verifying that you paid?
The vehicle ticket scanner would log all tickets and make sure they were charged.
I think the signed ticket scheme would have been better used for redeeming already issued tickets or tickets to identity verified previously.
Issuing a ticket with pre-signed identity token is essentially a good faith transaction - it is not guaranteed to be valid end to end - but you can compare against a blacklist of identities at redemption time to limit the impact of someone abusing the system.
The commuter rail lines in New York want to charge a premium for issuing a ticket onboard so they have this whole scheme where you have to activate an e-ticket before you leave the station and then it’s only good for an hour, and 90% of the time they don’t validate it - just see that a QR code is on your phone - the other ten percent of the time they want you to swipe or do something to prove it’s not just a screen shot. It can lead to a lot of drama in areas where the cell service is weak or none, or accidentally closed the app, and people don’t have cash on them. I think signing the tickets could solve a lot of the drama. If the conductor has internet connectivity he can validate and redeem tickets in real time, if not then the conductor can validate in real time, make sure no one else on the train has a duplicate ticket, and redeem in bulk when they get into cell range again.
So basically, as you can sign many times same token with different time value, there is no solution for offline generate and offline use scenario.
The UK makes travelling by public transport as tedious as possible.
This is trolling, right?
Free public transports just mean that you pay it through another way, and most likely mean that you remove the "use tax", thus increasing the contribution from people who don't actually use public transports.
In other words, free PT could save taxpayers money.
Absolutely, and that is in fact their political stance. They believe that there should be no use tax on public transport and that people who don't use it should still be responsible for financing it. Their reasoning is probably based on the assertion that public transport causes positive externalities even for non-users, and that the resulting benefit to society as a whole outweighs the purported unfairness against individuals. You may or may not agree, it may or may not be a good policy, but it is a legitimate political stance.
A separate issue is whether guerrilla tactics/direct actions such as these can be justified to attain a political goal in a liberal democracy, and yet another debate is whether these methods are even tactically useful in getting closer to their stated goal.
> they believe that there should be no use tax on public transport and that people who don't use it should still be responsible for financing it
I don't know for Manchester specifically but any public transport I'm familiar with is payed in huge part with tax money, so people who don't use public transports are already paying for it. But not the 100%, instead it's balanced with the use tax. So, is that the contention point, that it should be paid only by tax money? I don't understand what benefits that would bring. With this system, people using public transports the most (thus get the most value) would pay the less (if averaged per trip), how do you balance such a system?
Concerning their action, what's the idea behind sharing their exploit other than simplifying the work of free-rider? That it is too expensive to design a use-tax system that works, thus make the 100% government funded solution more attractive?
On the whole, this is probably one of the least harmful things they could have released publicly.
Depends the actions you’re thinking about, but I would guess that’s likely to be the case, yes.
> On the whole, this is probably one of the least harmful things they could have released publicly.
Could you elaborate?
Because their position is naive and lacks any serious economic or political justification. Even assuming that their beliefs are sincerely held, this would not be the correct course of action to go about inciting change.
When was the last time that stopped anybody from taking a political stance?
this would not be the correct course of action to go about inciting change
See question above.
It may bring them more publicity though by the media that will talk about them, but they are also labeling this cause as being the criminal side.... which isn't really good (that's actually the strategy that multiple government use to push their agenda, making the opposite side seems like they are infringing the law).
It's said that it's a net benefice for everyone:
- people move more, because it's free
- shop sells more because more people
- less cost induced by individual transport (less car on road = less damages, less pollution..)
Although...just to nit pick a little. If you mean less road damage then keep in mind that road damage is proportional to the 4th power of vehicle weight. So buses cause enormously more road damage than cars.
People who claim to like markets tend these days to subscribe to a quasi-religious faith that markets are maintained by some ethereal force rather than human institutions. Free markets are an absolutely vital and fundamental aspect of the wealth and power of the developed world, but they cannot exist in their highest form apart from the centralized machinery that enables people to trust each other and easily buy and sell. If anarcho-libertarians were to break that down, perhaps society could still function at some level, but it would be vastly poorer until everything was rebuilt in some other form.
Collecting and accounting for payment is overhead. If something is "free", then that overhead can be reduced or eliminated. On the other hand the basic purpose of charging for anything is to allocate limited resources, so the task is how to match supply and demand.
But saying it is "grossly inefficient" not to charge for something makes no sense to me. That's not the issue at all.
The thing that is grossly inefficient is the manner in which services are paid for when it involves doing it indirectly via tax authorities. The overhead can't be eliminated when it is done that way - it requires a contingent of administrators and petty bureaucrats.
The obvious problem with providing stuff at no charge is that it will cost too much to supply it, and people will waste it, but that isn't what I would call overhead, and I don't think you are talking about that.
Presumably you support per-mile metering on public roads then?
I.e those not on benefits, over the age of 18, under the age of 60 etc.
Now count how long the bus idles while people line up so the driver can validate their ticket / check they tapped in on their Oyster card.
Now add in all of the infrastructure and staff required to collect fees and account for them.
Then add in all of the external costs of charging for public transport (more cars, less productivity)
The argument for charging isn’t that strong.
Long distance: Paid
Urban FDB: Free
Urban ADB: PaidYou mention Oyster cards so I'll assume you're talking about London in which case the operator (TfL) clearly states that "Fares are the single largest source of our income (projected to be 47% in 2019/20)". [0]
This income more than covers the operational costs, with the difference being used to support new infrastructure projects and upgrades such as the Elizabeth Line (as well as concessions for students, the elderly, etc).
Clearly there is a very strong argument for charging.
[0] https://tfl.gov.uk/corporate/about-tfl/how-we-work/how-we-ar...
And let’s say you scope this only to buses (which are used less by commuters, and have real impacts on the environment)
Honestly I think not charging for buses in London would net out positively financially, and be better for all involved (faster, less cars on the road, easier to design buses for disabled access and prams etc.)
Although the administration cost is not zero, it is almost certainly negligible enough that moving to a taxpayer funded model would increase these costs. This is particularly true given that transport budgets are operated at the regional level and would require the introduction of new regional taxes rather than simply relying on exiting tax revenue. (The politics of passing any new tax legislation would be a monumental hurdle in the first instance).
Then there is the question of whether a broad tax is more equitable then the current model. I fail to see how this could be the case given the current system retains the price signal and through a system of concessions ensures that those who most benefit from the provision (e.g. professional working in the inner city) contribute the most and effectively subsidise fares for the rest of society.
Then you have all the ticket machines, barriers, stations, staff etc that would be completely unnecessary.
The only real bonus of collecting fares is that tfl acts as a treasury with millions of pounds in funds to invest.
I have observed that this is false in London at least 30 times.
You're talking about the time it takes as you step onto the vehicle. That's not zero, but it's not half of the cost. You also have to fill the card to begin with, but most importantly it causes people to incur an incremental cost for using public transportation, which discourages its use. That's very bad.
> Although the administration cost is not zero, it is almost certainly negligible enough that moving to a taxpayer funded model would increase these costs. This is particularly true given that transport budgets are operated at the regional level and would require the introduction of new regional taxes rather than simply relying on exiting tax revenue.
There are surely existing regional taxes. The collection cost is therefore sunk and the overhead of adjusting the rate is nominal. Moreover, people don't like paying taxes, but people don't like paying fares either, so it balances out -- or comes out in favor of using taxes because in that case the cost is lower when you don't have the overhead of doing fare collection (and you have the overhead of tax collection either way).
> Then there is the question of whether a broad tax is more equitable then the current model. I fail to see how this could be the case given the current system retains the price signal and through a system of concessions ensures that those who most benefit from the provision (e.g. professional working in the inner city) contribute the most and effectively subsidise fares for the rest of society.
Professionals working in the inner city don't pay different transit fares than janitors working in the inner city (and if they did you're just imposing income tax but calling it something else and paying more overhead to collect it), and you don't want a pricing signal here because pricing is a method of rationing scarce resources but we want people to use public transit as much as possible.
Any bank card works, so does Apple/Android pay. Even the prepaid card can be purchased from a self-service machine in less than a minute and topped up via an app.
> There are surely existing regional taxes.
The only broadly administered regional tax in the UK is the council tax. This only covers property owners. There is no other regional taxation - certainly not one that is broader. You also vastly underestimate the public opposition to taxes versus fare increases.
> Professionals working in the inner city don't pay different transit fares than janitors working in the inner city. ...and you don't want a pricing signal...
People pay different rates based on how close to the centre they commute to. Typically professionals commute further because the white collar jobs are located in the centre, blue collar workers on the other hand tend look for work close to where they live and are more likely to travel outside of peak hours.
As for the price signal, it plays a hugely important part. It enables fares to change depending on demand in order to spread out congestion rather than having everyone commute at rush hour (infrastructure cannot support unlimited travellers and public transport is most certainly a scarce resource that requires rationing). The price signal also provides a strong incentive to cycle/walk by imposing a marginal cost on each journey. This incentive would be completely lost if you'd already been taxed, leading to over-consumption and environmental costs.
Your plan would also mean that residents would effectively subsidise the travel of all outsiders - which for cities like London (which get huge amounts of tourists and external commuters) would impose an unfair cost on the residents.
A little bit here, a little bit there. So easy to tap your card, only then you get a statement at the end of the month with 50 charges on it and have to reconcile each one with your actual usage to make sure none of the charges are fraudulent or in erroneous amounts.
Multiply by a couple million people and you're wasting a whole lot of people's time.
> The only broadly administered regional tax in the UK is the council tax. This only covers property owners.
Tax is tax. If it's property tax then it filters through to rents, which filters through to local consumer prices etc. There is a lot to be said about which ones are better from an economic and efficiency standpoint, but that really has nothing to do with transit -- if you have a bad tax system then switch to a better one regardless of how you fund public transit. But property tax for local services is far from the worst.
> You also vastly underestimate the public opposition to taxes versus fare increases.
Not wanting to do something that benefits people because people oppose it is just begging the question. If it benefits people then they shouldn't oppose it, so then the issue becomes convincing them, which is separate from the question of what the best policy is to begin with.
> People pay different rates based on how close to the centre they commute to. Typically professionals commute further because the white collar jobs are located in the centre, blue collar workers on the other hand tend look for work close to where they live and are more likely to travel outside of peak hours.
Blue collar workers avoid jobs with expensive commutes because they can't afford it -- but that's the problem.
> As for the price signal, it plays a hugely important part. It enables fares to change depending on demand in order to spread out congestion rather than having everyone commute at rush hour (infrastructure cannot support unlimited travellers and public transport is most certainly a scarce resource that requires rationing).
Use of public transport increases efficiency and become more attractive to everyone the more people use it, because then you get e.g. train service every 10 minutes rather than 30 because there are three times as many trains to carry three times as many people. If there isn't enough of it the answer is to increase capacity, not deter usage with pricing.
> The price signal also provides a strong incentive to cycle/walk by imposing a marginal cost on each journey. This incentive would be completely lost if you'd already been taxed, leading to over-consumption and environmental costs.
The environmental impact of an incremental passenger using mass transit is negligible and completely dwarfed by the efficiency improvement of people getting to their destination faster. The only real trade off is saving time vs. getting exercise, but that's a decision each individual can make for themselves. And you could easily be deterring someone from saving time that they could then use to engage in a more balanced exercise routine than 100% cycling and 0% any other exercise.
Moreover, many of the other alternatives to mass transit are things like driving or accepting a closer, lower paying job with lower overall economic efficiency, or having to waste hours a day to leave for work early and get home late to avoid congestion charges. Which are all costs we don't want to impose when there is a better alternative in building enough mass transit capacity to meet the peak demand without having to ration it.
> Your plan would also mean that residents would effectively subsidise the travel of all outsiders - which for cities like London (which get huge amounts of tourists and external commuters) would impose an unfair cost on the residents.
On the other hand, then it's cheaper to go into the city and patronize businesses there (so business make more money) and cheaper to live a little further outside the city and commute in (which lowers rents for people in the city), which could easily more than outweigh those costs.
Not something I'd want.
What do they do when there's an increase in bad behaviour which was previously addressed by fines?
No, that I didn't say that. I said there are no fines. You cannot check anything out if you have something over due and after a certain number of days it goes to collections. The library doesn't deal with fines. Which part of that policy would you be negatively affected by?
If you are being sarcastic in order to make that point, that may be too subtle to communicate with most people that don't think of it on their own.
Why do you think people claiming benefits get free transport?
[0] https://en.wikipedia.org/wiki/Farebox_recovery_ratio
Still I agree that public transportation is a common good and I'm happy to live in a country with above-average networks (both at the local and national levels).
Under the covers, it's an invitation to have a go at transport operators who are unpopular and have a reputation for offering low-quality services at high cost.
Not questioning the title of the HN post, rather, wondering if I missed something going on I have missed in the news which would justify the term (instead of "hackers" or, even "security researchers", though the later seems to stretch the definition of responsible disclosure)
Even if this guy objected to it, unless he quit his job straight after implementing this, you can be sure it came back down on him.
This is the kind of situation where you have to clearly argue your case and stand your ground.
Mgmt: Can we do this? Eng: Yes, but... Mgmt: [Tunes out after Yes] Do it
Saying 'No' instead of 'Yes, but' is hard but a really valuable ability.
> Even if this guy objected to it, unless he quit his job straight after implementing this, you can be sure it came back down on him.
> This is the kind of situation where you have to clearly argue your case and stand your ground.
Hopefully the theoretical person stated their objections in writing. Would be useful in avoiding the fallout.
Although, it redirects after a few seconds, but you should be able to see the link.
http://2dpue32kldx6sm24r2lbisilqhzlglffssgyjgqwwq7masm74rliw...
I'm not sure if I'm allowed to post this on HN – I think it should be legal to post a link.
Introducing a fixed price gates the poor the most (eg. a wealthy individual can afford to spend a couple hundred pounds on a yearly subscription without much thought), and often incentivises trade-offs in favour of individual transportation (i.e. cars), which is less desirable in terms of pollution and traffic.
The poor already get free travel. As do pensioners.