4 ms·

I Tracked an NYC Subway Rider's Movements with an MTA ‘Feature’

14 points by gregsadetsky 3y ago

gregsadetsky 3y ago
Context: this is a gross privacy negligence I noticed on OMNY’s site and tried reporting to them to no avail. Joseph Cox from 404 Media did a stellar job investigating and contacting the MTA & Apple - it even looks like the MTA will re-evaluate their stance. I predict/hope they’ll remove the public trip history page [0] soon. Forcing users to create an account wouldn’t make anything more secure as you could still add any other person’s card to your account… adding a verification of the credit card’s billing address would also be pretty ineffectual. Unsure of what to do (except not offer this feature). See this past conversation (and detailed tech explanation) here some months ago [1]. [0] https://omny.info/trip-history https://omny.info/trip-history [1] https://news.ycombinator.com/item?id=35698169 https://news.ycombinator.com/item?id=35698169
danso 3y ago
This is an interesting situation. At first I was confused why anyone in the MTA bureaucracy would green light a "trip history" feature that didn't require the user to first create an account [0], but then I realized that a not-unsignifcant number of OMNY users simply want to get a subway card, and not go through the hassle of setting up a username/email/password with OMNY. It would be obviously problematic to require every subway card purchaser to have an email and/or phone number. While the OMNY "Trip history" feature would make it even trivial (it's not unheard of for ex-parterns to have seen each other's credit cards during the relatinoship) for someone to stalk their ex's movements, I'm also thinking that requiring an OMNY account would be a minor friction point for a bad actor. Assuming most OMNY users don't register an account, a stalker who knows their ex's credit card number could simply create an OMNY account using any email address they want — in the scenario where their ex never registered their OMNY card with an account. A complicated situation...I guess one compromise could be for OMNY to only give access to the Trip History feature for registered users. After all, if we can assume most subway riders don't want to bother with an OMNY account, we might also assume most don't need to check their own trip history. In the case of a financial dispute, they can bring their card to a subway teller in person (yes this creates a hassle, but everything security-related has tradeoffs) [0] https://omny.info/trip-history https://omny.info/trip-history
ericzawo 3y ago
Great reporting here.
mattpavelle 3y ago
The thing I find most interesting is the final snippet of the article: 404 Media found that MTA’s trip history feature still works even when the user pays with Apple Pay. Apple told 404 Media it does not store or have access to the used card numbers, and does not provide these to merchants, including transit systems. Apple did not respond when asked to clarify how the MTA website feature works when a rider uses Apple Pay. Per https://www.apple.com/apple-pay/ https://www.apple.com/apple-pay/ marketing, "When you make a purchase, Apple Pay uses a device-specific number and unique transaction code. So your card number is never stored on your device or on Apple servers. And when you pay, your card numbers are never shared by Apple with merchants. Your purchases stay private." So something strange is going on for sure...
- gregsadetsky 3y ago
  Sorry to repeat the link (posted in my comment below yours) but this very technical & informed explanation from @rswail explains what's going on: https://news.ycombinator.com/item?id=35698169 https://news.ycombinator.com/item?id=35698169 TLDR: Omny gets a hash of the Apple Pay card, and later, they can one way hash a card (that you give them) and match it to past purchases/travels. They (OMNY/MTA) presumably do not have access to the original card number that Apple Pay is 'masking'. But I agree with you that the language on Apple's site makes it seem like it's more anonymous than it really is (as this hash exception makes obvious)
  - noman-land 3y ago
    I've yet to read the technical explanation but how is not adding a salt or nonce to the hash a good idea? It doesn't seem very hard to iterate through all possible credit hard numbers and hash them all. I'm sure I'm missing something.
leotravis10 3y ago
This is great reporting From Joseph Cox on the privacy and human rights dangers of tap and pay systems, especially OMNY. It echoes the well documented privacy issues that OMNY has over the years. [0][1] [0] https://www.stopspying.org/omny https://www.stopspying.org/omny [1] https://www.fastcompany.com/90788367/the-mtas-switch-to-omny-machines-is-a-privacy-nightmare https://www.fastcompany.com/90788367/the-mtas-switch-to-omny...

14 points by gregsadetsky 3y ago

Context: this is a gross privacy negligence I noticed on OMNY’s site and tried reporting to them to no avail. Joseph Cox from 404 Media did a stellar job investigating and contacting the MTA & Apple - it even looks like the MTA will re-evaluate their stance. I predict/hope they’ll remove the public trip history page [0] soon. Forcing users to create an account wouldn’t make anything more secure as you could still add any other person’s card to your account… adding a verification of the credit card’s billing address would also be pretty ineffectual. Unsure of what to do (except not offer this feature). See this past conversation (and detailed tech explanation) here some months ago [1]. [0] https://omny.info/trip-history https://omny.info/trip-history [1] https://news.ycombinator.com/item?id=35698169 https://news.ycombinator.com/item?id=35698169

danso 3y ago

This is an interesting situation. At first I was confused why anyone in the MTA bureaucracy would green light a "trip history" feature that didn't require the user to first create an account [0], but then I realized that a not-unsignifcant number of OMNY users simply want to get a subway card, and not go through the hassle of setting up a username/email/password with OMNY. It would be obviously problematic to require every subway card purchaser to have an email and/or phone number. While the OMNY "Trip history" feature would make it even trivial (it's not unheard of for ex-parterns to have seen each other's credit cards during the relatinoship) for someone to stalk their ex's movements, I'm also thinking that requiring an OMNY account would be a minor friction point for a bad actor. Assuming most OMNY users don't register an account, a stalker who knows their ex's credit card number could simply create an OMNY account using any email address they want — in the scenario where their ex never registered their OMNY card with an account. A complicated situation...I guess one compromise could be for OMNY to only give access to the Trip History feature for registered users. After all, if we can assume most subway riders don't want to bother with an OMNY account, we might also assume most don't need to check their own trip history. In the case of a financial dispute, they can bring their card to a subway teller in person (yes this creates a hassle, but everything security-related has tradeoffs) [0] https://omny.info/trip-history https://omny.info/trip-history

ericzawo 3y ago

Great reporting here.

mattpavelle 3y ago

The thing I find most interesting is the final snippet of the article: 404 Media found that MTA’s trip history feature still works even when the user pays with Apple Pay. Apple told 404 Media it does not store or have access to the used card numbers, and does not provide these to merchants, including transit systems. Apple did not respond when asked to clarify how the MTA website feature works when a rider uses Apple Pay. Per https://www.apple.com/apple-pay/ https://www.apple.com/apple-pay/ marketing, "When you make a purchase, Apple Pay uses a device-specific number and unique transaction code. So your card number is never stored on your device or on Apple servers. And when you pay, your card numbers are never shared by Apple with merchants. Your purchases stay private." So something strange is going on for sure...

gregsadetsky 3y ago
Sorry to repeat the link (posted in my comment below yours) but this very technical & informed explanation from @rswail explains what's going on: https://news.ycombinator.com/item?id=35698169 https://news.ycombinator.com/item?id=35698169 TLDR: Omny gets a hash of the Apple Pay card, and later, they can one way hash a card (that you give them) and match it to past purchases/travels. They (OMNY/MTA) presumably do not have access to the original card number that Apple Pay is 'masking'. But I agree with you that the language on Apple's site makes it seem like it's more anonymous than it really is (as this hash exception makes obvious)
- noman-land 3y ago
  I've yet to read the technical explanation but how is not adding a salt or nonce to the hash a good idea? It doesn't seem very hard to iterate through all possible credit hard numbers and hash them all. I'm sure I'm missing something.

leotravis10 3y ago

This is great reporting From Joseph Cox on the privacy and human rights dangers of tap and pay systems, especially OMNY. It echoes the well documented privacy issues that OMNY has over the years. [0][1] [0] https://www.stopspying.org/omny https://www.stopspying.org/omny [1] https://www.fastcompany.com/90788367/the-mtas-switch-to-omny-machines-is-a-privacy-nightmare https://www.fastcompany.com/90788367/the-mtas-switch-to-omny...