3 ms·

This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I

This is a serious security problem for San Francisco public transit... "in addition to being able to read cards, also have the capability to emulate a card". I had considered duplicating a card, since it's a tag based system. So two or more people could share things like a month Caltrain pass, or two people riding together on the bus could both tag and only pay once. Using this program would be certainly easier, than what I was thinking.

davidmathers 16y ago
How is it a security problem? The article doesn't say anything about a security problem. On the contrary it says the security of some older fare cards has been compromised possibly allowing someone to alter their balance, though I am unaware of any attacks against DESFire.
- megaframe 16y ago
  I don't believe card in SF carry the balance information I thought that was on their side, issue is if people duplicate cards then they could share unlimited month passes.
phlux 16y ago
Assuming NFC works the same way Lockheeds RFID system works - you havea tag ID which is read against a back-end DB which holds the tags value, where the tag/card holds no value data itself, how can this work with SF Transit police checking cards? Assume you dupe your friends card, then both go through the turn style -- wont the system error as the system will say that the second read is either "tagged for exit" or maybe it will read it as a 90-minute transfer read? If you get stopped by the transit police, assuming you got through the turn style, you'd have to have a valid ticket/clipper on you, no?
- megaframe 16y ago
  It's tag only so if you tag again because lets say you were unsure you tagged, the second tag is disregarded, it's the same idea if I ride a bus but have to transfer I tag again but I don't pay again. It's just to verify I've tagged once since getting on. Can't say I've ever seen transit police but could be the buses I ride, and their's a fine for not being able to show you paid, but buses and muni is just tag as you get on. So theirs a risk of course.
  - dfghjkfgh 16y ago
    Usually the reader has a local log of the last few cards read. If it detects the same card again within a certain time window it assumes it either read it twice - or two people are sharing a card - and ignores the second read
gcb 16y ago
because limiting that misdemeanor to people that bought from dealextreme.com a $20 RFID duplicator kit instead of a $500 phone makes the world so much more secure.
furyg3 16y ago
Honestly, this is a problem for a) The transit authority which implemented a broken system and b) the person who gets caught counterfeiting a card / riding for free. It doesn't take much of a security expert to warn you that the system is insecure when you're implementing something which trusts the card (not a central database), and the protocol is proprietary and uses weak encryption (mifare is 48-bit or so?). Implementing a system which trusts the card is just asking for trouble, certainly considering the amount of horepower your average commuters are carying around in their pockets nowadays.

davidmathers 16y ago

How is it a security problem? The article doesn't say anything about a security problem. On the contrary it says the security of some older fare cards has been compromised possibly allowing someone to alter their balance, though I am unaware of any attacks against DESFire.

megaframe 16y ago
I don't believe card in SF carry the balance information I thought that was on their side, issue is if people duplicate cards then they could share unlimited month passes.

phlux 16y ago

Assuming NFC works the same way Lockheeds RFID system works - you havea tag ID which is read against a back-end DB which holds the tags value, where the tag/card holds no value data itself, how can this work with SF Transit police checking cards? Assume you dupe your friends card, then both go through the turn style -- wont the system error as the system will say that the second read is either "tagged for exit" or maybe it will read it as a 90-minute transfer read? If you get stopped by the transit police, assuming you got through the turn style, you'd have to have a valid ticket/clipper on you, no?

megaframe 16y ago
It's tag only so if you tag again because lets say you were unsure you tagged, the second tag is disregarded, it's the same idea if I ride a bus but have to transfer I tag again but I don't pay again. It's just to verify I've tagged once since getting on. Can't say I've ever seen transit police but could be the buses I ride, and their's a fine for not being able to show you paid, but buses and muni is just tag as you get on. So theirs a risk of course.
- dfghjkfgh 16y ago
  Usually the reader has a local log of the last few cards read. If it detects the same card again within a certain time window it assumes it either read it twice - or two people are sharing a card - and ignores the second read

gcb 16y ago

because limiting that misdemeanor to people that bought from dealextreme.com a $20 RFID duplicator kit instead of a $500 phone makes the world so much more secure.

furyg3 16y ago

Honestly, this is a problem for a) The transit authority which implemented a broken system and b) the person who gets caught counterfeiting a card / riding for free. It doesn't take much of a security expert to warn you that the system is insecure when you're implementing something which trusts the card (not a central database), and the protocol is proprietary and uses weak encryption (mifare is 48-bit or so?). Implementing a system which trusts the card is just asking for trouble, certainly considering the amount of horepower your average commuters are carying around in their pockets nowadays.