3 ms·

I've never used a QR code based system, but it seems to me like it could be the best of both worlds. > I find the physical cards easier since you don't have to

I've never used a QR code based system, but it seems to me like it could be the best of both worlds. > I find the physical cards easier since you don't have to fumble with the phone's UI, they aren't dependent on batteries, and you can shove them in your phone case and forget about them. So... print out the QR code and shove it in your phone case and forget about it? And if you forget / lose / break the print-out, but still have your phone, you're good to go.

dheera 5y ago
> So... print out the QR code and shove it in your phone case and forget about it? That won't work. WeChat and AliPay QR codes change every minute for security, if you are paying from an account with a QR code. You can pay to a statically printed QR code by scanning it with your camera (streetside food sellers do this), but you cannot pay from a static code.
- vladvasiliu 5y ago
  That's too bad... Are they generated by a central server or are they based on a fixed seed, like OTP codes? I'm wondering whether this could be implemented on some kind of low-powered e-ink device like some OTP tokens.
  - dheera 5y ago
    I'm pretty sure it's a weird hybrid of a mostly centralized system and some on-device for the case where the user has momentary reception loss but the merchant still has a solid internet connection. I'm pretty sure you can't be without reception for too long, it's not like an OTP key. The mobile app is very opaque and not decompiler-friendly, so I can't say with 100% certainty what it is. As far as a low-powered electronic device I think that's exactly what an RFID card is, and they work very well. The only real downside is lack of inter-city recognition of RFID systems, but I suppose the reality is most people only travel frequently between a consistent set of 1-3 cities and not usually more than that. My RFID "brick" of 20+ cards is quite the exception, and I'm more of a public transit enthusiast than most people, who usually just take taxis/rideshares when they travel to unfamiliar cities.
    - umeshunni 5y ago
      Typically how these work is that the client caches some small number (i.e. 5-10) offline tokens for use when you have no connectivity. They also expire after 24 hours.

dheera 5y ago

> So... print out the QR code and shove it in your phone case and forget about it? That won't work. WeChat and AliPay QR codes change every minute for security, if you are paying from an account with a QR code. You can pay to a statically printed QR code by scanning it with your camera (streetside food sellers do this), but you cannot pay from a static code.

vladvasiliu 5y ago
That's too bad... Are they generated by a central server or are they based on a fixed seed, like OTP codes? I'm wondering whether this could be implemented on some kind of low-powered e-ink device like some OTP tokens.
- dheera 5y ago
  I'm pretty sure it's a weird hybrid of a mostly centralized system and some on-device for the case where the user has momentary reception loss but the merchant still has a solid internet connection. I'm pretty sure you can't be without reception for too long, it's not like an OTP key. The mobile app is very opaque and not decompiler-friendly, so I can't say with 100% certainty what it is. As far as a low-powered electronic device I think that's exactly what an RFID card is, and they work very well. The only real downside is lack of inter-city recognition of RFID systems, but I suppose the reality is most people only travel frequently between a consistent set of 1-3 cities and not usually more than that. My RFID "brick" of 20+ cards is quite the exception, and I'm more of a public transit enthusiast than most people, who usually just take taxis/rideshares when they travel to unfamiliar cities.
  - umeshunni 5y ago
    Typically how these work is that the client caches some small number (i.e. 5-10) offline tokens for use when you have no connectivity. They also expire after 24 hours.