3 ms·
Expensive. Expensive expensive expensive. They would have to replace all of the turnstiles (for some reason I doubt they could retrofit them) which is a ton o
by Fej 10y ago
Expensive.
Expensive expensive expensive.
They would have to replace all of the turnstiles (for some reason I doubt they could retrofit them) which is a ton of turnstiles. The MTA subway is BIG (as far as I know, bigger than SF and Boston, in terms of number of stations).
They would need dedicated central servers to handle everything, unlike they have now, which the article says "complements" the existing system but which is not required for operation.
MetroCard came out over a decade before CharlieCard (Boston) so they have tons of infrastructure that would cost an absurd amount of money to replace. I imagine they figure it isn't worth it, especially when there are so many other subway projects that need money.
- tjohns 10y agoCentral servers are not required for contactless cards. The card itself holds the current balance inside a tamper-proof secure element, and it's updated with every ride. A central server can be used for things like web-based reloads and auditing, complementing the system... but it's entirely possible for a terminal to remain in offline-mode and just check-in at the end of the day to get any pending messages and upload logs. This is why it takes longer to reload/unblock a SF Clipper card using a reader in a bus (offline mode) as opposed to at a BART turnstile (online mode).
- tetrep 10y ago> ...tamper-proof secure element... It doesn't even need to be held in anything secure, you just need to sign the balance when writing and check the signature when it's used.
- shaftway 10y agoWhat's your replay attack mitigation strategy?
- throwanem 10y agoIf your turnstiles can't talk to a server, they can't check key revocation lists, and I tend to imagine that in a city the size of New York somebody's going to leak a key every now and again - it's been known to happen with physical keys; why not digital ones, too?
- dsr_ 10y agoBut they don't need to have a realtime revocation list -- it's fine if a broken card works until the end of the day, or even the end of the week, as long as it stops working faster than keys are leaked or cracked. So a bus turnstile can do transactions when it returns to the garage, and turnstiles in locations where it's hard to run data for whatever reason can get a plug-in every so often on a regular maintenance run.