counterfeit season ticket

[jon0844]

But offering such a capability will make it impossible to use very secure closed encryption to protect the card. Basically if you can read it so an a criminal who can write the details read onto a blank card.

As a general rule security and convenience are mutually exclusive, most real world applications require an appropriate trade off between security and convenience.

It doesn't work like that. Read a chip and you'll see lots of different banks of data, some encrypted and some public.

I can read my passport. I can see all the details on the photo page - including the photo. But the majority of information, like my fingerprints, is encrypted.

Your passport contains that data too!

You can already read many smartcards to see what the balance is, or tickets loaded (not necessarily here, but abroad) as there's certain data that doesn't need to be encrypted. But there would be other data that you'd not see, but the TOC would when validating it.

Like a passport, there's nothing to stop your photo ID being included and a RPI being able to see a photo of you when you present the card. That same data could even be used, in theory, to validate passing a gateline with a camera - rather like the system being introduced at airports. For now it's too slow, but that will change in time.

 

[telstarbox]

With any ticketing system there will be a certain level of fraud/fare evasion, because it reaches a point where the cost of detecting the fraud exceeds the revenue which would be recovered.

 

[Deerfold]

That same data could even be used, in theory, to validate passing a gateline with a camera - rather like the system being introduced at airports. For now it's too slow, but that will change in time.

I'd led to believe that (some?) buses in Rio already do this - you can get on the bus with your smartcard in your pocket and your image will be checked against the one recorded on it.

 

[DelayRepay]

I can also, off the top of my head think of at least two simple ways to defeat your approach, I am confident a determined criminal would with a little more time come up with more (just as they defeat the systems banks have in place to detect fraudulent card use).

Would you care to share?

 

[theageofthetra]

One that I see regularly on buses in London is some kid under 20 putting an oyster on the reader and it flashes up "Freedom Pass". As these cards are only available to those over 60 it annoys me why bus drivers don't kick them off (I suspect fear of violence?) . I have on a couple of occasions taken pictures of the fraudsters on my phone and then mailed the bus operator of the time and date of the offence.

 

[sheff1]

One that I see regularly on buses in London is some kid under 20 putting an oyster on the reader and it flashes up "Freedom Pass". As these cards are only available to those over 60 it annoys me why bus drivers don't kick them off ...

You do not have to be over 60 and I really doubt whether bus drivers should be interrogating people to see which of the other eligible categories someone may fall in to. .

 

[theageofthetra]

Interesting, what other reasons are freedom passes issued for?

 

[transportphoto]

One that I see regularly on buses in London is some kid under 20 putting an oyster on the reader and it flashes up "Freedom Pass". As these cards are only available to those over 60 it annoys me why bus drivers don't kick them off (I suspect fear of violence?) . I have on a couple of occasions taken pictures of the fraudsters on my phone and then mailed the bus operator of the time and date of the offence.

Interesting, what other reasons are freedom passes issued for?

You do not need to be over sixty to get a Freedom Pass, I have the non-London equivalent and I still qualify for child fares! When I present my ITSO ENCTS pass to an ITSO reader on a bus I often get a driver asking to see my card, I have no problem with this however I also know that it comes up on their screen 'Disabled' so often they don't bat an eye lid.

Okay, there is a chance that some try it on, I'm sure some do, however I seriously doubt that it is as high as you may think. Here are the disabled eligibility criteria from the London Councils Website where further details can also be found:

1) People who are blind or partially sighted
2) People who are profoundly or severely deaf
3) People without speech
4) People who have a disability, or have suffered an injury, which has left them with a substantial and long-term adverse effect on their ability to walk
5) People who do not have arms or have a long-term loss of the use of both arms
6) People who have a learning disability that is defined as 'a state of arrested or incomplete development of mind which includes significant impairment of intelligence and social functioning'
7) People who, if they applied for the grant of a licence to drive a motor vehicle under Part III of the Road Traffic Act 1988, would have their application refused pursuant to section 92 of the Act (physical fitness) otherwise than on the ground of persistent misuse of drugs or alcohol.

TP.

 

[theageofthetra]

Thats great, thanks. I would have still thought it would come up with something other than "freedom pass" on the reader. I will e-mail TfL and see what they say.

 

[sheff1]

Why should it come up as something other than "freedom pass" when it is a Freedom Pass ?

 

[samxool]

my sister has a freedom pass as she suffers from narcolepsy and epilepsy, so she had to hand in her drivers licence and is utterly reliant on public transport. The reasons may not be obvious why they have a freedom pass.
Though, if they're a 20year old chav, chances are its nicked admittedly!

 

[bb21]

Why should it come up as something other than "freedom pass" when it is a Freedom Pass ?

Maybe what category the Freedom Pass falls into: elderly, disabled or other.

That is assuming that such categories exist.

Though, if they're a 20year old chav, chances are its nicked admittedly!

What does a chav look like? This has been asked before and no one has yet managed to come up with a good enough description.

 

[island]

"The attack uses an electronic device as a "man-in-the-middle" in order to prevent the PIN verification message from getting to the card, and to always respond that the PIN is correct. Thus, the terminal thinks that the PIN was entered correctly, and the card assumes that a signature was used to authenticate the transaction (see bottom part of above figure)."

So that's "chip and sign" not "chip and pin". The attack would not exist if only chip and pin was allowed.

Which is an entirely theoretical state of affairs. There will never be a state of affairs when only chip & PIN transactions are allowed, as banks are required by the DDA to issue chip & signature cards to anyone who says they have a disability preventing them from using a PIN, and terminals must have a signature option for these cards, for old cards, and for when the equipment isn't working.

I can read my passport. I can see all the details on the photo page - including the photo. But the majority of information, like my fingerprints, is encrypted.

Your passport contains that data

No it doesn't. I have never given my fingerprints to the authorities of the country that issued my passport.

You do not have to be over 60 and I really doubt whether bus drivers should be interrogating people to see which of the other eligible categories someone may fall in to. .

They should be asking some of the people from around my parts to take their children's Oyster card out of the wallet to show it for photo verification!

 

[jon0844]

No it doesn't. I have never given my fingerprints to the authorities of the country that issued my passport.

I guess you don't have a biometric passport then. Maybe I should add 'might' then!

I wonder if the passport also stores data on when/where it was last scanned/read for immigration purposes or if that's only stored on the computers used by immigration officers.

 

[Clip]

I guess you don't have a biometric passport then. Maybe I should add 'might' then!

I wonder if the passport also stores data on when/where it was last scanned/read for immigration purposes or if that's only stored on the computers used by immigration officers.

Dunno but the scanners never seem to work at Stanstead so it appears I go places and dont return

 

[island]

I guess you don't have a biometric passport then.

Yes I have actually. Got it less than six months ago.

 

[headshot119]

I've just receivers my new passport which is biometric. It can't have my finger prints on it as I've never given them out ?

 

[Flamingo]

Biometric does not mean fingerprints, but measurements of the facial features taken from the photograph http://www.nidirect.gov.uk/sm/what-are-biometric-passports

 

[snail]

I wonder if the passport also stores data on when/where it was last scanned/read for immigration purposes or if that's only stored on the computers used by immigration officers.

The passport chip stores nothing you can't physically read on the personal details page. It has measurements taken from the photograph to enable automatic recognition at e-passport gates. Anything else is mere conspiracy!

 

[island]

I think the chip is read-only.

 

[87electric]

http://www.parliament.uk/briefing-papers/sn04126

It seems the Coalition Government went against EU regulations for fingerprints to be added onto the passport chip.

 

[jon0844]

Ah, should have possibly mentioned that I have a Swedish passport and I did give my fingerprints!

 

[jon0844]

The passport chip stores nothing you can't physically read on the personal details page. It has measurements taken from the photograph to enable automatic recognition at e-passport gates. Anything else is mere conspiracy!

I didn't mean to suggest a conspiracy - I actually thought it would be a good idea!

 

[DarloRich]

This is a perfect reason why people should not be waved through manual gates with a flash of their season. It's not going to kill them to take it out of the wallet twice a day.

mine wont survive extraction. In fact it wont come out at all!

It has been through the washing machine and is now held together by the backing card of the wallet to which i assume the ticket is stuck and the plastic cover that has melted and sealed at the top!

 

[island]

Then you should get it replaced

 

[34D]

Then you should get it replaced

Assuming darlorich lives near Darlington, then I wouldn't want to be him when EC or Northern do one of their occasional stings

 

[gooner88]

On Thursday I was presented with one of the newer fakes going around at the moment which was a weekly and included london zones 1-6, and rather it was rather unfortunate for the guy that i was working with a BTP officer so didnt have to wait 6 weeks for them to arrive. But there was only really one major flaw with the ticket and a minor one which could have been missed when checking, and although the magnetic strip was encoded it didnt quite match up with the info on the front of the ticket. but compared to the fakes of a couple of years ago they are not far away from being flawless.

Plus the effort of including a photocard number which the passenger was carrying, its a trivial thing but it does or could make it less suspicious.

 

[DarloRich]

Then you should get it replaced

It is hardly worth the bother as it runs out in less than 3 weeks. I am surprised it took nearly 48 weeks to go through the wash!

Assuming darlorich lives near Darlington, then I wouldn't want to be him when EC or Northern do one of their occasional stings

It is perfectly valid, still very clear etc. You just cant handle it for fear of destruction!

I dont live anywhere near Darlo now, more is the pity. I live in leafy Buckinghamshire now!