The New York subway’s ride tracker has a scary security loophole /

"Easily purchased credit card details on the Dark Web"

Well, yes, but if someone got ahold of my credit card deets, then there are 99 ways for them to ruin me, and watching me board a train ain't high on that list.

No, it's not a unique identifier. No, it's not adequate authentication. But this is not exactly a gaping loophole, IMHO.