> The Ultralight chip has a few features beyond a printed ticket, though. The chips are manufactured with a unique 7-byte identification code (UID). Moreover, the UID is signed, ensuring that fake UIDs cannot be generated. The problem is, they can be just as easily cloned . Your average Flipper Zero can do that. If you want actual security, you have to go for a challenge-response scheme - i.e. every card is provision…
> If you want actual security, you have to go for a challenge-response scheme Another option is to just store used UIDs in a database. In fact, you could do a system with only UIDs. For a single use ticket, validate the UID signature and mark it as spent the first time it is used, then every use after that will be denied. A card can be cloned, and it will work, once, it means one could steal a ticket by walking by an…
Practical systems often are online these days, but only use that connection for eventual consistency style reconciliation.
> A card can be cloned, and it will work, once, it means one could steal a ticket by walking by and using appropriate equipment (not just a Flipper Zero as it is too short ranged) and use it before the legitimate owner does.
Even MIFARE Ultralight supports a basic password authentication scheme, where only legitimate readers know (or can derive) that password, so there a bit better protected against cloning than pure passive storage cards.