• Our new ticketing site is now live! Using either this or the original site (both powered by TrainSplit) helps support the running of the forum with every ticket purchase! Find out more and ask any questions/give us feedback in this thread!

Why I avoid e-tickets

35B

Established Member
Joined
19 Dec 2011
Messages
5,362
Put it in your Google or Apple Wallet. The app is indeed an inconvenient way to use these cards, but fortunately all smartphones, however basic, have wallet functionality.

Do the same with e-tickets (and if you think you might double-use one by accident, simply delete them from there after use).

This just goes back to people not using smartphones as they are designed to be used and then moaning about them being a faff to use in the incorrect manner. Spend a few minutes learning to use one as it is intended and you will find it to be a smooth and convenient experience.

Also why would you need a laptop for 2 Factor Authentication? It is usually a text message to your phone. What sort of 2FA are you using that runs on a laptop?
A number of sites use email, which can be a pain (though on iPhone, toggling between apps is easy). More generally, 2FA can be a pain - especially when integrating between an app and my iPhone (especially PingID, Authenticator and Outlook - but that's a special circle of hell for corporate implementation of tech!)

Text message 2FA is very old school and increasingly regarded as insecure.
 
Sponsor Post - registered members do not see these adverts; click here to register, or click here to log in
R

RailUK Forums

Adam Williams

Established Member
Joined
2 Jan 2018
Messages
3,498
Location
Warks
Put it in your Google or Apple Wallet. The app is indeed an inconvenient way to use these cards, but fortunately all smartphones, however basic, have wallet functionality.
Alas, the Tesco shopping list functionality doesn't work on the scan-as-you-shop handsets if you use the barcode saved to Google Wallet!
 

SargeNpton

Established Member
Joined
19 Nov 2018
Messages
1,704
Type "how to use Android" in your browser and you will find a wealth of instructional videos on how smartphones work best. You don't need a paper manual, which would be intimidating for most non technical people anyway.
Well yes, but sometimes having a manual with an index is better than having to type in random phrases that you think just might be relevant. If you don't know what is possible then how do you search for it on the off-chance?
 

35B

Established Member
Joined
19 Dec 2011
Messages
5,362
Well yes, but sometimes having a manual with an index is better than having to type in random phrases that you think just might be relevant. If you don't know what is possible then how do you search for it on the off-chance?
I find that I type in random words that might be relevant, and then hone in on those depending on the way that the manual is set up.
 

Haywain

Veteran Member
Joined
3 Feb 2013
Messages
24,480
Well yes, but sometimes having a manual with an index is better than having to type in random phrases that you think just might be relevant. If you don't know what is possible then how do you search for it on the off-chance?
I see your point but a manual explaining everything you can do with a smartphone would be enormous.
 

AlterEgo

Verified Rep - Wingin' It! Paul Lucas
Joined
30 Dec 2008
Messages
29,184
Location
LBK
Well yes, but sometimes having a manual with an index is better than having to type in random phrases that you think just might be relevant. If you don't know what is possible then how do you search for it on the off-chance?
My 74 year old mum does not know what Apple Wallet is. A manual will not tell her that becuase she would need to know what Apple Wallet was to bother reading the section about how to store passes and tickets.
 

Wallsendmag

Established Member
Joined
11 Dec 2014
Messages
6,258
Location
Wallsend or somewhere on the ECML
My 74 year old mum does not know what Apple Wallet is. A manual will not tell her that becuase she would need to know what Apple Wallet was to bother reading the section about how to store passes and tickets.
My 81 year old Mum does as she needed to use it for a concert. Press the side button twice was much easier to explain as how to find the ticket.
 

Bletchleyite

Veteran Member
Joined
20 Oct 2014
Messages
112,941
Location
"Marston Vale mafia"
Well yes, but sometimes having a manual with an index is better than having to type in random phrases that you think just might be relevant. If you don't know what is possible then how do you search for it on the off-chance?

Oh, behave. You know you have an Android phone, so searching for "how to use an Android phone" is a breathtakingly obvious search term to use. Even if you don't know you have an Android phone you know you have a Samsung or whatever because it says on it.

== Doublepost prevention - post automatically merged: ==

My 74 year old mum does not know what Apple Wallet is. A manual will not tell her that becuase she would need to know what Apple Wallet was to bother reading the section about how to store passes and tickets.

"How do I access my theatre tickets on my Apple phone?"

This stuff really isn't difficult.

== Doublepost prevention - post automatically merged: ==

Alas, the Tesco shopping list functionality doesn't work on the scan-as-you-shop handsets if you use the barcode saved to Google Wallet!

How bizarre! Tesco need to fix that then.
 

AlterEgo

Verified Rep - Wingin' It! Paul Lucas
Joined
30 Dec 2008
Messages
29,184
Location
LBK
"How do I access my theatre tickets on my Apple phone?"
Well yes, that's how she found out. And also she asked me of course.

The current method having help online and searchable is vastly preferable to reading a manual.
 

TUC

Established Member
Joined
11 Nov 2010
Messages
5,021

== Doublepost prevention - post automatically merged: ==

You don't even have to do that if your phone is set up for transit mode, just hold it near the reader.
I was answering the point about supermarket checkouts.
Put it in your Google or Apple Wallet. The app is indeed an inconvenient way to use these cards, but fortunately all smartphones, however basic, have wallet functionality.

Do the same with e-tickets (and if you think you might double-use one by accident, simply delete them from there after use).

This just goes back to people not using smartphones as they are designed to be used and then moaning about them being a faff to use in the incorrect manner. Spend a few minutes learning to use one as it is intended and you will find it to be a smooth and convenient experience.

Also why would you need a laptop for 2 Factor Authentication? It is usually a text message to your phone. What sort of 2FA are you using that runs on a laptop?
It would be very helpful if railcards could be added to Wallet but, slightly surprisingly, there does not seem to be a ready way to do that.
 

Bletchleyite

Veteran Member
Joined
20 Oct 2014
Messages
112,941
Location
"Marston Vale mafia"
It would be very helpful if railcards could be added to Wallet but, slightly surprisingly, there does not seem to be a ready way to do that.

It certainly would! The issue there is that the technology doesn't support how the railway wants to do them, i.e. with the ability to retract one. I also don't *think* Apple Wallet can show a photograph, but may be wrong.

I expect it'll come in time as what the features offer improves. In the meantime anyone who doesn't like apps should just take a plastic or paper Railcard as an alternative. Sure, it's not offered on the 26-30, but not many 26-30 year olds are anti-tech.
 

TUC

Established Member
Joined
11 Nov 2010
Messages
5,021
It certainly would! The issue there is that the technology doesn't support how the railway wants to do them, i.e. with the ability to retract one. I also don't *think* Apple Wallet can show a photograph, but may be wrong.

I expect it'll come in time as what the features offer improves. In the meantime anyone who doesn't like apps should just take a plastic or paper Railcard as an alternative. Sure, it's not offered on the 26-30, but not many 26-30 year olds are anti-tech.
I have had expired cards stored in my Wallet which say after their expiry date that they cannot be used, and have no functionality, so it is hard to see why the same could not apply for railcards
 

Bletchleyite

Veteran Member
Joined
20 Oct 2014
Messages
112,941
Location
"Marston Vale mafia"
I have had expired cards stored in my Wallet which say after their expiry date that they cannot be used, and have no functionality, so it is hard to see why the same could not apply for railcards

There has to be a means of deactivating one mid-validity if you move it to another device to prevent people copying them even if a device does not connect to the Internet. Apple Wallet does not provide a robust means to do this. This is because they are verified by looking at them.

In essence they are a form of m-ticket.
 

pokemonsuper9

Established Member
Joined
20 Dec 2022
Messages
4,586
Location
Greater Manchester
There has to be a means of deactivating one mid-validity if you move it to another device to prevent people copying them even if a device does not connect to the Internet. Apple Wallet does not provide a robust means to do this. This is because they are verified by looking at them.

In essence they are a form of m-ticket.
Surely the answer to that is for the ticket inspectors to scan the code on the railcard.
Like you could theoretically print off an e-ticket the refund it, or give someone else a copy - the solution is in the scan data.
 

TUC

Established Member
Joined
11 Nov 2010
Messages
5,021
There has to be a means of deactivating one mid-validity if you move it to another device to prevent people copying them even if a device does not connect to the Internet. Apple Wallet does not provide a robust means to do this. This is because they are verified by looking at them.

In essence they are a form of m-ticket.
Digital railcards include a QR code (or QR-type equivalent). Does this not enable validity to be checked alongside scanning a ticket rather than just visual inspection?
 

Bletchleyite

Veteran Member
Joined
20 Oct 2014
Messages
112,941
Location
"Marston Vale mafia"
Digital railcards include a QR code (or QR-type equivalent). Does this not enable validity to be checked alongside scanning a ticket rather than just visual inspection?

Things are moving this way but aren't quite there yet.

I would expect it to be possible to add Railcards to the wallet in due course, just not quite yet. Probably within 5 years, certainly within 10.
 

sheff1

Established Member
Joined
24 Dec 2009
Messages
6,059
Location
Sheffield
A user manual is a bit 2007. Now you just look up the thing you want to do online.
Not much use if you don't know what is possible.

Despite working in technology for many years; much of it was when DOS commands and backing up things to floppy discs was de rigeur. The mobile phone I was provided with had an extendable aerial and certainly no email access. Indeed, internet access at work with a very large nationwide employer was for some time via a standalone PC with dial-up access. I had retired long before smartphones became mainstream.

My background does give me an advantage over many of my age, but still find in easier to ask my son "can I do this on my phone" rather than try and scroll through a ream of search results, many of which have no relevance to the question I asked.

Posters berating less fortunate people for "not using a smartphone properly" seems rather unnecessary.
 

AlterEgo

Verified Rep - Wingin' It! Paul Lucas
Joined
30 Dec 2008
Messages
29,184
Location
LBK
Not much use if you don't know what is possible.
You're not going to know what is possible in 2026 by way of a manual unless you read hundreds of pages from front to back. But you will come across the concept that tickets can be stored on your phone quite naturally, like when sites ask you if you want to do that. And for most people I think that would prompt them to look up the answer if they didn't know.

Despite working in techology for many years much of it was when DOS commands and backing up things to floppy discs was de rigeur. The mobile phone I was provided with had an extendable aerial and certainly no email access. Indeed, internet access at work with a very large nationwide employer was for some time via a standalone PC with dial up access. I had retired long before smartphones became mainstream.
My background does give me an advantage over many of my age, but still find in easier to ask my son "can I do this on my phone" rather than try and scroll through a ream of search results, many of which have no relevance to the question I asked.
I think a lot of this has to do with how people of different generations parse information. I find it very easy to discover reliable answers by using search engines. Likewise, many older people perhaps might like to know everything about a product before using it. "I will adapt to this piece of technology" mindset. Someone of my age will expect devices to adapt to my needs "I will use it in an intuitive way and anything that does not seem intuitive, I will Google and find the answer in 30 seconds".

Posters berating less fortunate people for "not using a smartphone properly" seems rather unnecessary.
I don't really think anyone has done any such thing in the thread. But equally it seems a bit strange to criticise a technology for not being able to do X Y or Z having never taken even 30 seconds to explore whether it does in fact do that.
 

sheff1

Established Member
Joined
24 Dec 2009
Messages
6,059
Location
Sheffield
I don't really think anyone has done any such thing in the thread.
Fair enough, but I am not the only one to feel some have.

I think a lot of this has to do with how people of different generations parse information.
A lot of truth in that.
What my son finds intuitive with 'smart' technology for example doesn't come intuitively to me at all. Conversely, various non-technical things I have done instinctively have been a surprise to him - "how did you know to do that ?"
 
Last edited:

Joe Paxton

Established Member
Joined
12 Jan 2017
Messages
2,958
[...]
Posters berating less fortunate people for "not using a smartphone properly" seems rather unnecessary.
I don't really think anyone has done any such thing in the thread. [...]

Hmm... I've only scanned through the thread, but some of say Bletchlyite's responses do kinda come across that way, probably likewise for others too.
 
Last edited:

crablab

Established Member
Joined
8 Feb 2020
Messages
1,288
Location
UK
It certainly would! The issue there is that the technology doesn't support how the railway wants to do them, i.e. with the ability to retract one.
I don't think this is true now. Apple provides APIs to live update passes; Eurostar uses them amongst others.
It's probably not robust enough for what RDG want to use it for here, but then again neither is their implicit trusting of a client presented credential via the Railcard app. We don't know how long the signature in the Aztec is valid for, but there's no way of revoking that once passed to the client and any client side logic can be tampered with.
Last I checked with TTK, that scan doesn't actually go anywhere and there's no way to put anything in the eTVD for the railcard's ticket number either.
Yeah this is the issue. If you're concerned about repudiating a credential you need to have some way of consulting a trusted source. The fact the client has presented a signed token that's valid doesn't mean it can be trusted!

Recent example from the world of IT: https://www.theregister.com/devops/...till-usable-23-minutes-after-deletion/5244504

From the time a user deletes the Google API key to when it can no longer be used propagates gradually across Google's infrastructure, he said. Some servers reject the key within seconds while others keep accepting it for 23 minutes.

What this means is that an attacker holding a deleted key can repeatedly send requests until one reaches a server that has not caught up

This is a well known and acknowledged issue with so many things: JWTs, SSL certs etc. That's why we have CRLs (Certificate Revocation Lists)

A bit like TfL maintain their own blocklist of card PANs which have failed revenue inspection etc. They don't rely on the card telling them that.
 
Last edited:

Bletchleyite

Veteran Member
Joined
20 Oct 2014
Messages
112,941
Location
"Marston Vale mafia"
I don't think this is true now. Apple provides APIs to live update passes; Eurostar uses them amongst others.
It's probably not robust enough for what RDG want to use it for here, but then again neither is their implicit trusting of a client presented credential via the Railcard app. We don't know how long the signature in the Aztec is valid for, but there's no way of revoking that once passed to the client and any client side logic can be tampered with.

What it does though is to automatically withdraw after a period if it hasn't been confirmed online. Apple Wallet doesn't do that.
 

35B

Established Member
Joined
19 Dec 2011
Messages
5,362
What it does though is to automatically withdraw after a period if it hasn't been confirmed online. Apple Wallet doesn't do that.
A behaviour that is at the heart of some of the issues reported here, and which is driven by a security model that presumes distrust unless otherwise satisfied.

It’s hard to see how revocation by the industry, on the pattern of TfL manage cards would materially worsen security for the industry
 

Top