6 ms·

I Tracked an NYC Subway Rider's Movements with an MTA ‘Feature’

35 points by isaacfrond 3y ago

gregsadetsky 3y ago
Breaking news! OMNY caved after I tipped off Joseph Cox about this and he published the story for 404 Media. It took the MTA/OMNY ~24 hours from story to reaction. The public trip history page is not working any more! (weirdly, you can still access it from the mobile menu - but the functionality has been neutered there as well) https://omny.info/trip-history https://omny.info/trip-history Yes!! --- Also see https://news.ycombinator.com/item?id=37321595 https://news.ycombinator.com/item?id=37321595
chrisbolt 3y ago
> With their consent, I had entered the rider’s credit card information—data that is often easy to buy from criminal marketplaces
- netsharc 3y ago
  At first I do think this site is being sensationalist again (3rd story from 404media I've seen on HN lately), but for the stereotypical guy meets girl, guy stalks girl, storyline: I can imagine a guy working in a store seeing a girl he finds attractive, getting her CC number through some sleight of hand while she was paying, or something like a camera pointed at the payment machine, and then using this number to figure out what station she usually gets off on at what time in the evening. I wonder what protection can be built in. An online CC transaction needs the exp. date, CVV and ZIP of the customer, could OMNY ask for these values before showing people the ride data associated with the card? The people might be wary "wait, what are they making me buy?", but maybe a big fat warning that they just need this info "for your protection" is sufficient... Then again, those values are also easy to buy from "criminal marketplaces", and the guy above can just tell the girl that the store is doing a survey where their customers live, and what her ZIP is (the other info are on the card he took a good peek at)
  - J_tt 3y ago
    It’d be great if they could trigger 3D-Secure without a purchase, but that would probably be a whole mess to work out. Edit: looks like it might be in the spec from some very brief research, or at least “coming soon”: https://3dsecure2.com/non-payment-authentication/ https://3dsecure2.com/non-payment-authentication/
ehhthing 3y ago
I think the issue has been rather overblown. Realistically I think the solution to this problem is to make riders more aware of the existence of this website, so if they feel that they may be tracked by an abusive partner they'll know how it's happening. It is not a security issue in itself.
- op00to 3y ago
  Are you cool with sharing your Amazon purchase history with random strangers who have your credit card number?
  - ehhthing 3y ago
    I'm confused, these are completely different situations. But also, yes? If a random stranger has my credit card info, I feel like I have much bigger problems than people knowing my Amazon purchase history.
    - jayknight 3y ago
      Every time you hand your card to someone they could grab the info. If they use it to buy something, that's fraud and they'll hopefully get in lots of trouble. But if they just use it to track you to your home neighborhood or place of work, is that illegal?
      - ehhthing 3y ago
        Sorry I'm not American, I don't just hand my card to random strangers. Kinda forgot that was a thing at restaurants there. My perspective comes purely from a person that exclusively uses Google Pay and occasionally Chip + PIN when my purchases go over the limit for that.
        trimethylpurine 3y ago
        Yeah, no one really cares here because we're not responsible for someone else stealing the money. We just call the bank and they give it all back. The worst part is waiting for a new card to ship and then updating all your payment information with the new card number wherever you're using auto payment.
oplav 3y ago
Does anyone know how this was done for payments made with Apple Pay? I thought the card numbers were anonymized when Apple Pay is used.
- gruez 3y ago
  It's only "anonymized " insofar as a different, but static card number is used
  - oplav 3y ago
    I understand that, but shouldn't OMNY only receive the anonymized static card number? If I use the OMNY tool [0] and enter in the un-anonymized card number from my physical card, I can still see my ride history even though I paid using Apple Pay. [0] https://omny.info/trip-history https://omny.info/trip-history
trimethylpurine 3y ago
You can also call up any phone provider or mortgager and they will "verify" if you give them an address and credit card number. Society is built on the reality that most people won't, not that they can't.
ChrisArchitect 3y ago
Great, now we've got Verge doing stories on 404 stories....... https://news.ycombinator.com/item?id=37332563 https://news.ycombinator.com/item?id=37332563
- ChrisArchitect 3y ago
  Also, [dupe] https://news.ycombinator.com/item?id=37321595 https://news.ycombinator.com/item?id=37321595
Wowfunhappy 3y ago
> 404 Media found that MTA’s trip history feature still works even when the user pays with Apple Pay. Apple told 404 Media it does not store or have access to the used card numbers, and does not provide these to merchants, including transit systems. Apple did not respond when asked to clarify how the MTA website feature works when a rider uses Apple Pay. This, uh, seems strange? Something doesn't add up.

35 points by isaacfrond 3y ago

Breaking news! OMNY caved after I tipped off Joseph Cox about this and he published the story for 404 Media. It took the MTA/OMNY ~24 hours from story to reaction. The public trip history page is not working any more! (weirdly, you can still access it from the mobile menu - but the functionality has been neutered there as well) https://omny.info/trip-history https://omny.info/trip-history Yes!! --- Also see https://news.ycombinator.com/item?id=37321595 https://news.ycombinator.com/item?id=37321595

chrisbolt 3y ago

> With their consent, I had entered the rider’s credit card information—data that is often easy to buy from criminal marketplaces

netsharc 3y ago
At first I do think this site is being sensationalist again (3rd story from 404media I've seen on HN lately), but for the stereotypical guy meets girl, guy stalks girl, storyline: I can imagine a guy working in a store seeing a girl he finds attractive, getting her CC number through some sleight of hand while she was paying, or something like a camera pointed at the payment machine, and then using this number to figure out what station she usually gets off on at what time in the evening. I wonder what protection can be built in. An online CC transaction needs the exp. date, CVV and ZIP of the customer, could OMNY ask for these values before showing people the ride data associated with the card? The people might be wary "wait, what are they making me buy?", but maybe a big fat warning that they just need this info "for your protection" is sufficient... Then again, those values are also easy to buy from "criminal marketplaces", and the guy above can just tell the girl that the store is doing a survey where their customers live, and what her ZIP is (the other info are on the card he took a good peek at)
- J_tt 3y ago
  It’d be great if they could trigger 3D-Secure without a purchase, but that would probably be a whole mess to work out. Edit: looks like it might be in the spec from some very brief research, or at least “coming soon”: https://3dsecure2.com/non-payment-authentication/ https://3dsecure2.com/non-payment-authentication/

ehhthing 3y ago

I think the issue has been rather overblown. Realistically I think the solution to this problem is to make riders more aware of the existence of this website, so if they feel that they may be tracked by an abusive partner they'll know how it's happening. It is not a security issue in itself.

op00to 3y ago
Are you cool with sharing your Amazon purchase history with random strangers who have your credit card number?
- ehhthing 3y ago
  I'm confused, these are completely different situations. But also, yes? If a random stranger has my credit card info, I feel like I have much bigger problems than people knowing my Amazon purchase history.
  - jayknight 3y ago
    Every time you hand your card to someone they could grab the info. If they use it to buy something, that's fraud and they'll hopefully get in lots of trouble. But if they just use it to track you to your home neighborhood or place of work, is that illegal?
    - ehhthing 3y ago
      Sorry I'm not American, I don't just hand my card to random strangers. Kinda forgot that was a thing at restaurants there. My perspective comes purely from a person that exclusively uses Google Pay and occasionally Chip + PIN when my purchases go over the limit for that.
      - trimethylpurine 3y ago
        Yeah, no one really cares here because we're not responsible for someone else stealing the money. We just call the bank and they give it all back. The worst part is waiting for a new card to ship and then updating all your payment information with the new card number wherever you're using auto payment.

oplav 3y ago

Does anyone know how this was done for payments made with Apple Pay? I thought the card numbers were anonymized when Apple Pay is used.

gruez 3y ago
It's only "anonymized " insofar as a different, but static card number is used
- oplav 3y ago
  I understand that, but shouldn't OMNY only receive the anonymized static card number? If I use the OMNY tool [0] and enter in the un-anonymized card number from my physical card, I can still see my ride history even though I paid using Apple Pay. [0] https://omny.info/trip-history https://omny.info/trip-history

trimethylpurine 3y ago

You can also call up any phone provider or mortgager and they will "verify" if you give them an address and credit card number. Society is built on the reality that most people won't, not that they can't.

ChrisArchitect 3y ago

Great, now we've got Verge doing stories on 404 stories....... https://news.ycombinator.com/item?id=37332563 https://news.ycombinator.com/item?id=37332563

ChrisArchitect 3y ago
Also, [dupe] https://news.ycombinator.com/item?id=37321595 https://news.ycombinator.com/item?id=37321595

Wowfunhappy 3y ago

> 404 Media found that MTA’s trip history feature still works even when the user pays with Apple Pay. Apple told 404 Media it does not store or have access to the used card numbers, and does not provide these to merchants, including transit systems. Apple did not respond when asked to clarify how the MTA website feature works when a rider uses Apple Pay. This, uh, seems strange? Something doesn't add up.