5 ms·

How is it possible that the magnetic stripe encoding is a secret? Surely you can just run the card through a reader before and after taking some journeys and re

How is it possible that the magnetic stripe encoding is a secret? Surely you can just run the card through a reader before and after taking some journeys and reverse engineer from there? Is the balance actually stored on the card, or is it just basically a primary key in a database somewhere that gets queried on each ride?

crazygringo 4y ago
It's both, and you can find the answer on Wikipedia. [1] > During a swipe, the MetroCard is read, re-written to, then check-read to verify correct encoding... Each MetroCard stored value card is assigned a unique, permanent ten-digit serial number when it is manufactured. The value is stored magnetically on the card itself, while the card's transaction history is held centrally in the Automated Fare Collection (AFC) Database... Whenever the card is swiped at a turnstile, the value of the card is read, the new value is written, the customer is let through, and then the central database is updated with the new transaction as soon as possible. Cards are not validated in real time against the database when swiped to pay the fare. There's also an old NYT article [2]: > But since the main computer communicates regularly with both the turnstiles and the booth computers, false cards have so far all been invalidated after they have been used once... Some hackers believe that because the turnstiles, the token booth computers and the mainframe computer, respectively, upload and download information at six-minute intervals, the length of time that a passenger can transfer without paying may actually be 18 minutes more than the advertised two hours, if the timing is right... ''I believe that, fundamentally, a system as complicated as the Metrocard cannot be absolutely secure,'' he said. ''What we have to make sure is that the hack won't scale. If a few people ride for free, that's no big deal.'' [1] https://en.wikipedia.org/wiki/MetroCard#Technology https://en.wikipedia.org/wiki/MetroCard#Technology [2] https://www.nytimes.com/1997/08/11/nyregion/what-galls-a-hacker-most-the-metrocard.html https://www.nytimes.com/1997/08/11/nyregion/what-galls-a-hac...
- ardel95 4y ago
  That’s the thing with fraud. The goal is never to stop it all, but to keep it at some local minimum. The rest is just the cost of doing business.
  - roywiggins 4y ago
    In this case it just has to be harder to pull off than jumping the turnstile.
    - kingkawn 4y ago
      Which is unfathomably easy, so much so that it doesn’t even require physically jumping
      - Tijdreiziger 4y ago
        It wouldn’t be easy with fare gates, but the cost is probably too high to justify for NYC (imagine having to rip out all the existing turnstiles and replace them).
        crazygringo 4y ago
        To be fair there are already gates everywhere there's an entrance that doesn't have a manned booth. There are only turnstiles that can be jumped at the entrances that are manned by an attendant 24/7.
        kingkawn 4y ago
        I think it’s less cost than needing to process high passenger volume in old stations
      - Akronymus 4y ago
        Which is part of the reason why vienna doesn't have turnstiles. https://www.youtube.com/watch?v=kq-X25pH1XQ https://www.youtube.com/watch?v=kq-X25pH1XQ
    - crazygringo 4y ago
      Cops were actually catching and fining people a ton for this between about 2-4 months ago. First time I'd ever seen them proactively enforce it. Haven't seen it in a few weeks though. It's expensive to be posting two cops near every turnstile entrance.
- lupire 4y ago
  This is why swiping (read-write-read) MetroCard is much less reliable than swiping a (read-only) credit card transaction, and why you need to swipe a MetroCard slowly.
  - primis 4y ago
    As someone who rode the subway daily for years, the proper swipe speed is almost the same as my walking speed. If I walked through the turnstile at the same speed as my swipe, it almost always worked without issue. It felt very seamless
- tibbydudeza 4y ago
  Pretty neat to keep value on the card. EMV (chip) bank cards can default to local authorization mode if the transaction value fits your profile if the pinpad can't communicate upstream. Nothing worse than folks not able to buy/use your system because it is "offline".
dehrmann 4y ago
> Surely you can just run the card through a reader before and after taking some journeys and reverse engineer from there? I doubt they do this, but if the data's encrypted with a good cipher used correctly, all you'll be able to detect is that it's changed.
- lxgr 4y ago
  That does not prevent replay attacks, though. To thwart these, a stored-value system needs to eventually go online and synchronize a compromised card list, use (actively tamper and replay resistant) smartcards, or both.
walrus01 4y ago
they're in the process of replacing the whole magnetic stripe system right now with a modern contactless system similar to london, vancouver, seattle, etc.

crazygringo 4y ago

It's both, and you can find the answer on Wikipedia. [1] > During a swipe, the MetroCard is read, re-written to, then check-read to verify correct encoding... Each MetroCard stored value card is assigned a unique, permanent ten-digit serial number when it is manufactured. The value is stored magnetically on the card itself, while the card's transaction history is held centrally in the Automated Fare Collection (AFC) Database... Whenever the card is swiped at a turnstile, the value of the card is read, the new value is written, the customer is let through, and then the central database is updated with the new transaction as soon as possible. Cards are not validated in real time against the database when swiped to pay the fare. There's also an old NYT article [2]: > But since the main computer communicates regularly with both the turnstiles and the booth computers, false cards have so far all been invalidated after they have been used once... Some hackers believe that because the turnstiles, the token booth computers and the mainframe computer, respectively, upload and download information at six-minute intervals, the length of time that a passenger can transfer without paying may actually be 18 minutes more than the advertised two hours, if the timing is right... ''I believe that, fundamentally, a system as complicated as the Metrocard cannot be absolutely secure,'' he said. ''What we have to make sure is that the hack won't scale. If a few people ride for free, that's no big deal.'' [1] https://en.wikipedia.org/wiki/MetroCard#Technology https://en.wikipedia.org/wiki/MetroCard#Technology [2] https://www.nytimes.com/1997/08/11/nyregion/what-galls-a-hacker-most-the-metrocard.html https://www.nytimes.com/1997/08/11/nyregion/what-galls-a-hac...

ardel95 4y ago
That’s the thing with fraud. The goal is never to stop it all, but to keep it at some local minimum. The rest is just the cost of doing business.
- roywiggins 4y ago
  In this case it just has to be harder to pull off than jumping the turnstile.
  - kingkawn 4y ago
    Which is unfathomably easy, so much so that it doesn’t even require physically jumping
    - Tijdreiziger 4y ago
      It wouldn’t be easy with fare gates, but the cost is probably too high to justify for NYC (imagine having to rip out all the existing turnstiles and replace them).
      - crazygringo 4y ago
        To be fair there are already gates everywhere there's an entrance that doesn't have a manned booth. There are only turnstiles that can be jumped at the entrances that are manned by an attendant 24/7.
      - kingkawn 4y ago
        I think it’s less cost than needing to process high passenger volume in old stations
    - Akronymus 4y ago
      Which is part of the reason why vienna doesn't have turnstiles. https://www.youtube.com/watch?v=kq-X25pH1XQ https://www.youtube.com/watch?v=kq-X25pH1XQ
  - crazygringo 4y ago
    Cops were actually catching and fining people a ton for this between about 2-4 months ago. First time I'd ever seen them proactively enforce it. Haven't seen it in a few weeks though. It's expensive to be posting two cops near every turnstile entrance.
lupire 4y ago
This is why swiping (read-write-read) MetroCard is much less reliable than swiping a (read-only) credit card transaction, and why you need to swipe a MetroCard slowly.
- primis 4y ago
  As someone who rode the subway daily for years, the proper swipe speed is almost the same as my walking speed. If I walked through the turnstile at the same speed as my swipe, it almost always worked without issue. It felt very seamless
tibbydudeza 4y ago
Pretty neat to keep value on the card. EMV (chip) bank cards can default to local authorization mode if the transaction value fits your profile if the pinpad can't communicate upstream. Nothing worse than folks not able to buy/use your system because it is "offline".

dehrmann 4y ago

> Surely you can just run the card through a reader before and after taking some journeys and reverse engineer from there? I doubt they do this, but if the data's encrypted with a good cipher used correctly, all you'll be able to detect is that it's changed.

lxgr 4y ago
That does not prevent replay attacks, though. To thwart these, a stored-value system needs to eventually go online and synchronize a compromised card list, use (actively tamper and replay resistant) smartcards, or both.

walrus01 4y ago

they're in the process of replacing the whole magnetic stripe system right now with a modern contactless system similar to london, vancouver, seattle, etc.