4 ms·

I don't think the password authentication helps against cloning. You could start a transaction and stop after you get the password. Then you could clone the car

• lxgr 2y ago
  You could do that, but it still greatly raises the cost for an attacker, since they need to hang around a ticket validator for every ticket they want to clone, as opposed to e.g. a QR code ticket, which can be trivially copied by a simple screenshot. Also, many of these transit systems are eventually consistent (they're usually offline-capable for resilience, but usually manage to send all validation transactions to a backoffice system within at most a day, and often minutes). This allows detecting duplicate usage fairly quickly. In systems where you need to tap out as well as tap in to leave the turnstile, that's where ticket inspectors might take a sudden interest in you if you tap out with a cloned ticket. In the end, as with most security systems, the goal is not to make fraud absolutely impossible, but to make it economically non-viable.
  • szundi 2y ago
    You have to hang out to get the id of a simple 125khz tag too - this is what cloning means