Comment by crazygringo | Hacker News Reader

Comment by crazygringo | Hacker News Reader

Parent Full thread

It's both, and you can find the answer on Wikipedia. [1]

> During a swipe, the MetroCard is read, re-written to, then check-read to verify correct encoding... Each MetroCard stored value card is assigned a unique, permanent ten-digit serial number when it is manufactured. The value is stored magnetically on the card itself, while the card's transaction history is held centrally in the Automated Fare Collection (AFC) Database... Whenever the card is swiped at a turnstile, the value of the card is read, the new value is written, the customer is let through, and then the central database is updated with the new transaction as soon as possible. Cards are not validated in real time against the database when swiped to pay the fare.

There's also an old NYT article [2]:

> But since the main computer communicates regularly with both the turnstiles and the booth computers, false cards have so far all been invalidated after they have been used once... Some hackers believe that because the turnstiles, the token booth computers and the mainframe computer, respectively, upload and download information at six-minute intervals, the length of time that a passenger can transfer without paying may actually be 18 minutes more than the advertised two hours, if the timing is right... ''I believe that, fundamentally, a system as complicated as the Metrocard cannot be absolutely secure,'' he said. ''What we have to make sure is that the hack won't scale. If a few people ride for free, that's no big deal.''

[1] https://en.wikipedia.org/wiki/MetroCard#Technology

[2] https://www.nytimes.com/1997/08/11/nyregion/what-galls-a-hac...

That’s the thing with fraud. The goal is never to stop it all, but to keep it at some local minimum. The rest is just the cost of doing business.

In this case it just has to be harder to pull off than jumping the turnstile.

Which is unfathomably easy, so much so that it doesn’t even require physically jumping

It wouldn’t be easy with fare gates, but the cost is probably too high to justify for NYC (imagine having to rip out all the existing turnstiles and replace them).

To be fair there are already gates everywhere there's an entrance that doesn't have a manned booth.

There are only turnstiles that can be jumped at the entrances that are manned by an attendant 24/7.

I think it’s less cost than needing to process high passenger volume in old stations

Which is part of the reason why vienna doesn't have turnstiles. https://www.youtube.com/watch?v=kq-X25pH1XQ

Cops were actually catching and fining people a ton for this between about 2-4 months ago. First time I'd ever seen them proactively enforce it.

Haven't seen it in a few weeks though. It's expensive to be posting two cops near every turnstile entrance.

> It's expensive to be posting two cops near every turnstile entrance.

On that note: the city actually spends more on the NYPD for fare evasion than they could possibly recover from it[1]. I'd rather the city just give every teenager a free card instead, and spend the savings on a tipline for complaints about NYPD officers on their phones[2].

[1]: https://nyc.streetsblog.org/2019/11/14/mta-will-spend-249m-o...

[2]: https://www.thecity.nyc/2022/7/11/23204575/new-york-answered...

The harder and likely more relevant task is that of quantifying the amount of fare evasion preempted by policing, similar to many other law enforcement actions.

Anecdotally, I've never seen the police chase a farebeater. I've never even seen someone be particularly dissuaded by police presence at the gates; in my old neighborhood I would see people hop the gate with the police right there. It simply isn't worth their time, and all parties understand that.

That's what I'm saying changed 4 months ago here in NYC.

They were chasing and catching literally everyone. Well, the cops at the turnstile would radio the cops on the platform if they ran.

The people caught were really pissed about it too. Lotta loud arguing every time I went into the subway since they were catching people constantly. Granted I live in a neighborhood where people jump the turnstiles a lot.

Capitol One has been touting "With Capitol One, you're never responsible for fraudulent charges on your account!"

Yeah, no shit. Fraud is YOUR problem. Not mine.

This is an interesting legal question, but in this case answer is entirely dependent on the terms of service agreement that you signed when you obtained the card, along with any applicable regulations.

The thing Capital One is bragging about is enforced by law. Every American credit card has the same protection.

Similar scenario: chicken in the grocery store that advertises itself as "antibiotic and hormone free". No chicken in the grocery store has added antibiotics or hormones; it's illegal.

https://xkcd.com/641/

Federal law allows passing liability for up to $50 to the cardholder.

Not quite; https://www.law.cornell.edu/uscode/text/15/1643

A-F have to all apply.

Visa, Mastercard, Amex, and Discover all additionally enforce $0 credit card liability on the banks that use their networks.

You'll only see the $50 thing on debit cards, and every bank I've used has waived that to give credit card-style protection.

Yes, effectively the $50 are definitely not worth the hassle.

On debit cards, the statutory limit is actually significantly higher ($500) if you don't report the fraud within two business days, and unlimited after 60 days, but as you say, I don't know of any bank that actually makes use of that provision.

This is why swiping (read-write-read) MetroCard is much less reliable than swiping a (read-only) credit card transaction, and why you need to swipe a MetroCard slowly.

As someone who rode the subway daily for years, the proper swipe speed is almost the same as my walking speed. If I walked through the turnstile at the same speed as my swipe, it almost always worked without issue. It felt very seamless

Pretty neat to keep value on the card.

EMV (chip) bank cards can default to local authorization mode if the transaction value fits your profile if the pinpad can't communicate upstream.

Nothing worse than folks not able to buy/use your system because it is "offline".

Reply on news.ycombinator.com