On 30 May, 08:24, Steve wrote:
I would expect the basic level of security is that if the "same" card is
used a distance apart at the same time then that id is blocked, this
couldn't really be realtime and would need to be done overnight. They
could have put more security in the datablock regarding the id, but I doubt
it, better to put it around the travel cards and the cash amount.

I suspect the pay as you go side would be most attractive to
criminals. They could just buy the cards as normal from ticket
offices, hack them and just put whatever amount of money they felt
like on the cards then sold them at much less than face value they
could make quite a few quid. Thinking about it, monthly or yearly
cards would probably be nice little earners too.

This will be hacked eventually, but the hard part is not getting caught.
Duplicates and cards with false cash/travelcards will be easy to spot, and

Duplicates you could spot , not sure how you'd spot the fake balance
or period unless the gate communicates with a database containing that
info for every ticket which I don't think it does. However even
duplicate id issues could be bypassed if you could update its software
- just use a rolling id system. Each time the card is used it rolls
over to another (hopefully valid) id. So if the gate won't let you out
first time just keep trying.

B2003

On 30 May 2007 01:30:27 -0700, Boltar wrote:


This will be hacked eventually, but the hard part is not getting caught.
Duplicates and cards with false cash/travelcards will be easy to spot, and

Duplicates you could spot , not sure how you'd spot the fake balance
or period unless the gate communicates with a database containing that
info for every ticket which I don't think it does.

The fake balance would be easy to spot overnight when the transactions are
balanced together, but that would give the user a free day. I don't know
if the main tube readers are linked to the main system, they could be, but
the extra cost of handling a fast transactual system Vs a nightly batch
system might not make it worthwhile. Of course in commerical use the doors
are normally linked to a digital video system, so everyone using a door is
recorded on camera. Think of the fun Big Brother could have using that
system on the tube!

However even
duplicate id issues could be bypassed if you could update its software
- just use a rolling id system. Each time the card is used it rolls
over to another (hopefully valid) id. So if the gate won't let you out
first time just keep trying.

I was thinking of that, a pocket scanner/writer that keeps pulling the ID's
from other cards and updating your one with them, mifare has a range of
several feet so its possible. That would be a clever hack. Still having
heard about the roulette wheel laser scanner , I wouldn't rule it out.

Steve

On Wed, 30 May 2007 14:07:13 GMT, Steve wrote:

This will be hacked eventually, but the hard part is not getting caught.
Duplicates and cards with false cash/travelcards will be easy to spot, and

Duplicates you could spot , not sure how you'd spot the fake balance
or period unless the gate communicates with a database containing that
info for every ticket which I don't think it does.

The fake balance would be easy to spot overnight when the transactions are
balanced together, but that would give the user a free day. I don't know
if the main tube readers are linked to the main system, they could be, but
the extra cost of handling a fast transactual system Vs a nightly batch
system might not make it worthwhile.

There'd be no point at all. The most you could "steal" in a single day
would be £12.70 worth of transportation (the Z1-6 peak cap).

On 30 May, 15:18, asdf wrote:
There'd be no point at all. The most you could "steal" in a single day
would be £12.70 worth of transportation (the Z1-6 peak cap).

For one day no it wouldn't be worth it , but if the card had been
hacked to update its id periodically and always have the maximum
amount of cash then in theory you could have free travel anywhere in
london for as long as you could get valid id numbers. And if Oyster
ever gets used as electronic money ....

B2003

On May 30, 4:28 pm, Boltar wrote:
On 30 May, 15:18, asdf wrote:

There'd be no point at all. The most you could "steal" in a single day
would be £12.70 worth of transportation (the Z1-6 peak cap).

For one day no it wouldn't be worth it , but if the card had been
hacked to update its id periodically and always have the maximum
amount of cash then in theory you could have free travel anywhere in
london for as long as you could get valid id numbers. And if Oyster
ever gets used as electronic money ....

B2003

....And soon Oyster cards are coming attached to Barclaycards.

On 30 May, 15:07, Steve wrote:
I was thinking of that, a pocket scanner/writer that keeps pulling the ID's
from other cards and updating your one with them

Now theres an idea. If you hung around in a crowded station or
platform you could grab hundreds of the things.

B2003