Comment by furyg3 | Hacker News Reader

Comment by furyg3 | Hacker News Reader

What frustrates me is how fragile this can quickly become.

I recently was traveling with my 7 year old daughter on public transit, and her card was denied... something was wrong with the 'kids free travel' product loaded on her card. Since her card is actually issued by a train company, I had to login to their website. Since I hadn't logged into their site (as her) in a while, I had to verify my account with a password reset link. The site then sends a create password link to HER email (they would not let me use my email since I was already a user), which I had also not used in a while, so I needed to answer some security questions. The email was severely delayed so cue lots of refreshing. I then had to 'pick up' the product at a terminal in the back of the bus, thankfully this bus had a working one, and then 'check in' at the front.

Thankfully it was a long bus ride but the driver was clear I would need to pay if I couldn't arrange it. This is all totally insane as kids ride free and you don't need an RFID card to see that at 7 year old is under 14. And the worst part is that since it's a bus pass loaded on a train card linked to an email address you need to access on your mobile phone... there is just no accountability.

A similar event happened when my bank just decided I couldn't login since I accidentally used a VPN once, with no error message. Congrats, you won the lottery, you get to play the 3 hour call support game.

If you're technically illiterate, disabled, poor, or have little time, you just can't play these games with companies and are totally screwed.

The biggest problem is mediocre business people at all these companies for whom digitalization means copy-pasting the order process from an e-commerce site. I want to see a museum, why ask me for 8 different fields of data you won’t use ever?

Taking the example of the transit card, a simple login with the card number (in your hand) and a PIN number (in your head) should suffice to view card status and order a new balance top up (without storing CC numbers). Same as when you do a top up in a 7-11 with cash. Just don’t show any confidential information or hide those under an additional authentication request.

Many mediocre companies and organizations bought the “data is money” mantra and soak up useless information they will never use but make their clients life difficult for it.

I just keep 3 fake personas in Bitwarden and roll with them for these services.

It is also plausible that since these businesses are unlikely to have their own software development capability, they outsource the job to providers that are experienced at bringing up e-commerce sites and simply apply a project template without much thought.

Or, worse, build a marginally competent completely bespoke website on an ancient toolset they are comfortable with and that’s impossible to maintain or integrate with anything that wasn’t part of the original specs.

Also possible the providers have a side business selling the data their hapless customers are collecting.

My take is we're seeing the same sort of abuses and risk that we had with credit reporting agencies. And we need the same sorts of regulation. And those rules need to be onerous enough that most companies will try hard to stay out from under them.

> This is all totally insane as kids ride free and you don't need an RFID card to see that at 7 year old is under 14. And the worst part is that since it's a bus pass loaded on a train card linked to an email address you need to access on your mobile phone... there is just no accountability.

Sounds like the person who should be held accountable is the driver. They should have just let her on, or if they're going to dodge accountability, they should do it by raising the problem to their management, or at least promised they will and given you a phone number/email address or something.

> they should do it by raising the problem to their management

Unfortunately, many people on immigrant visas can’t afford to raise problems to their management and risk getting fired for being “troublemakers”

your bank story reminds me of an issue friends of mine ran into. their bank website has a section about security where they helpfully show the finger print of the tls key of the online banking website. except, it's wrong or outdated. so my friend called the bank, because the instructions even said so: if this key doesn't match, then do call the bank. he did, and promptly got his bank account locked, because obviously the problem must be on his end (his computer could be compromised), and not on the banks side. he had to walk into the local bank branch to resolve the issue in person.

Reply on news.ycombinator.com