Context: this is a gross privacy negligence I noticed on OMNY’s site and tried reporting to them to no avail. Joseph Cox from 404 Media did a stellar job inves

Context: this is a gross privacy negligence I noticed on OMNY’s site and tried reporting to them to no avail. Joseph Cox from 404 Media did a stellar job investigating and contacting the MTA & Apple - it even looks like the MTA will re-evaluate their stance. I predict/hope they’ll remove the public trip history page [0] soon. Forcing users to create an account wouldn’t make anything more secure as you could still add any other person’s card to your account… adding a verification of the credit card’s billing address would also be pretty ineffectual. Unsure of what to do (except not offer this feature). See this past conversation (and detailed tech explanation) here some months ago [1]. [0] https://omny.info/trip-history https://omny.info/trip-history [1] https://news.ycombinator.com/item?id=35698169 https://news.ycombinator.com/item?id=35698169