Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reversing UK mobile rail tickets

eta.st

Post reply on HN
Print view View original

51–60 of 236 posts

Re: Reversing UK mobile rail tickets

#51

Post by jasonjayr »

TobyTheDog123 wrote: post #48

This reminds me of the time when I was a college student in Massachusetts and would always try to reverse-engineer the Massachusetts Bay Transportation Authority tickets, powered by JustRide (oh! Just noticed it's the same company as in the article) Unfortunately, my skills weren't quite there at that point in my life, and I no longer live in Massachusetts, but this was an incredible read regardless and I feel at lea…

I think the tickets had to be activated 'online', and iirc they are good for 60 minutes.

Additionally the color bar screen has an animated timestamp too, presumably to prevent a (basic) screenshot attack.

And; although I've never had it scanned, I think if the ticket checker suspects something is up, they scan the qrcode for an online verification.

I took a large family group with me on one ride, and they did consistently check that I activated the right number of tickets.

Re: Reversing UK mobile rail tickets

#52

Post by iudqnolq »

They invented a clever decentralized system based on public key cryptography, but it seems like they actually need centralized features. So they bolted some on, leaving an end result worse off than if they'd started with something simple and centralized.

For example, you can ask any UK rail operator to book you a trip that includes sections run by other operators. So your purchase needs to be fed through a centralized revenue-splitting system (called LENNON iirc) anyway.

Then they got the feature request that you should be able to book specific seats and someone else shouldn't be able to book the same seat, and so on. This just can't be decentralized.

This setup does have the advantage that they can check tickets without needing a network connection, but I'd guess there would be simpler ways to add that to a centralized system.

Re: Reversing UK mobile rail tickets

#53

Post by nkellenicki »

LtWorf wrote: post #27
scrollaway wrote: post #4

Earlier quoted context omitted.

Kids these days, how dare they use technology, am I right, fellow luddite on the internet? People lose paper tickets. People throw them on the ground. Stations are littered with them. Oh, and people do spend ages looking through their pockets, bags, coats and other places for where their paper ticket is at. You're just being contrarian because you're on a tech website, tbh.

If a mobile phone is now a prerequisite for living, governments should issue them to all citizens, and provide maintenance and replacement. Or just don't expect people who don't own a phone to own a ticket.

That's not what the OP claimed at all. Paper tickets still exist. A mobile phone is not requisite. People can choose the option that works for them.

Re: Reversing UK mobile rail tickets

#54

Post by bombcar »

iudqnolq wrote: post #52

They invented a clever decentralized system based on public key cryptography, but it seems like they actually need centralized features. So they bolted some on, leaving an end result worse off than if they'd started with something simple and centralized. For example, you can ask any UK rail operator to book you a trip that includes sections run by other operators. So your purchase needs to be fed through a centralize…

You could in theory make it decentralized-ish depending on the requirements. For example they could allocate blocks of seats to vendors and if you bought one of those seats you could buy it “offline” to be synced later.

But it’s probably not worth the hassle and once the ticket is sold you can have it be signed by the centralized system so you can verify the signature offline easily.

Re: Reversing UK mobile rail tickets

#55

Post by rippercushions »

nonrandomstring wrote: post #2

Nobody who cheers "mobile tickets" has ever watched a guard or ticket inspector do their job. In the UK, a guard with good eyesight and a sprightly, cheerful manner can almost run through the carriages shouting "tickets please!" and see, with a single glance, all s/he needs. Then she gets to the muppets with phones. They faff, fumble and fuss. They scowl at being interrupted watching videos, browsing social media and…

I went to an exhibition at a museum today. There's a distance of maybe 5 meters between the ticket office and the exhibition entrance. Instead of getting a paper ticket and handing it over at the gate, I had to tell the clerk my phone number, wait a few moments to receive one SMS for each person, click on a link in each SMS to retrieve a separate per-person QR code that could be scanned at the gate, and then click back and repeat individually for everybody in my group. Such efficiency!

Re: Reversing UK mobile rail tickets

#56

Post by iudqnolq »

bombcar wrote: post #54
iudqnolq wrote: post #52

They invented a clever decentralized system based on public key cryptography, but it seems like they actually need centralized features. So they bolted some on, leaving an end result worse off than if they'd started with something simple and centralized. For example, you can ask any UK rail operator to book you a trip that includes sections run by other operators. So your purchase needs to be fed through a centralize…

You could in theory make it decentralized-ish depending on the requirements. For example they could allocate blocks of seats to vendors and if you bought one of those seats you could buy it “offline” to be synced later. But it’s probably not worth the hassle and once the ticket is sold you can have it be signed by the centralized system so you can verify the signature offline easily.

I don't think that theory works out in practice because they have not that many seats in the trains, a lot of vendors, vendors that book very small and irregular numbers of tickets on routes, and sometimes very few or no extra seats. So you'd need to reallocate the blocks by demand quite frequently, at which point it's morally a shitty centralized system.

And with every clever decentralized solution there's another feature request that adds more complexity. I just remembered some trains have displays above seats that tell you if it's reserved.

Re: Reversing UK mobile rail tickets

#57

Post by larouxn »

totetsu wrote: post #39
NoZebra120vClip wrote: post #21

During the COVID outbreak, my public transit provider began to neglect their fareboxes (partly because everyone was boarding in the rear and didn't bother to pay fares anyway.) I noticed that the boxes were still broken and unmaintained. I put 2 and 2 together and realized that a mobile "upgrade" was coming soon, so I kept my eyes out. And sure enough, I got myself invited to participate in the pilot project with the…

Am I miss remembering or can the nfc mobile train passes in Japan be used even with a dead battery?

Yes, I believe this is correct as the terminal you tap/place your card/phone near transits enough power wirelessly to read the NFC (F) data or so I have read. The NFC (Felica) + Osaifu-Keitai + Suica/Passmo system is quite interesting and super reliable.

Source: on a train in Tokyo right now

Re: Reversing UK mobile rail tickets

#58

Post by netsharc »

totetsu wrote: post #39
NoZebra120vClip wrote: post #21

During the COVID outbreak, my public transit provider began to neglect their fareboxes (partly because everyone was boarding in the rear and didn't bother to pay fares anyway.) I noticed that the boxes were still broken and unmaintained. I put 2 and 2 together and realized that a mobile "upgrade" was coming soon, so I kept my eyes out. And sure enough, I got myself invited to participate in the pilot project with the…

Am I miss remembering or can the nfc mobile train passes in Japan be used even with a dead battery?

Sounds like an iPhone feature: https://www.techradar.com/news/apples-iphone-xs-has-a-game-c...

The Pasmo/Suica cards are intriguing, they are NFC, but also store the last few transactions on the card itself, there are also mobile apps for scanning these cards to see how much credit you have left and list the above-mentioned transactions.

Post reply on HN