3 ms·

For various reasons, the contactless system sadly still lags behind Oyster, with basic functionality like NR discount entitlements missing and showing no signs

by lol768 2y ago

For various reasons, the contactless system sadly still lags behind Oyster, with basic functionality like NR discount entitlements missing and showing no signs of emerging anytime soon. The physical infrastructure, like the gatelines, are all still controlled by Cubic as well. Even in terms of security, you have TfL deciding to adopt SMS for multi-factor authentication (no TOTP/HOTP/push-based MFA) for their contactless portal. Which they only started enforcing a year ago. I don't get how anybody can defend decisions like these. We've known SMS is unsuitable for this use-case for years.

inferiorhuman 2y ago
SMS is the de facto standard for MFA. Everyone's favorite ISP darling Sonic recently enabled SMS MFA on all accounts with no warning. Pretty much every financial institution I deal with offers SMS MFA (few offer any way to disable it). Retailers like Home Depot eschewed passwords in favor of SMS OTP. I wish it weren't so, but that's just how things are these days.
- paulryanrogers 2y ago
  SMS MFA is better than no MFA. SMS as SFA is bad since it's easily spoofed.
  - ikekkdcjkfke 2y ago
    SMS MFA is usually used to reset password so it's almost always de facto SFA. Recent Veritasium video says overtaking anyones phone number costs just hundreds of dollars
avianlyric 2y ago
> For various reasons, the contactless system sadly still lags behind Oyster, with basic functionality like NR discount entitlements missing and showing no signs of emerging anytime soon. It’ll happen eventually. The Oyster system has already hit breaking point. There’s now a number of stations around London that only accept contactless and not Oyster, due to memory constrains on the Oyster cards that prevents support. TfL’s long term goal is to migrate the entire Oyster system onto the contactless backed end, so the cards cease to be stored value cards, and simply become unique account identifiers. TfL have did part of this migration a few years ago when they phased out older Oyster cards that couldn’t correct support the new ID based system. I assume that when they introduced weekly caps on the Oyster cards, that was partly enabled by their migration efforts to the contactless backed end. For them to complete the migration, they’ll need to support railcards on the contactless system. Although exactly how they’ll do that I have no idea. But either way the capabilities of the two different systems continue to diverge, and that’s going rapidly become unsustainable. > The physical infrastructure, like the gatelines, are all still controlled by Cubic as well. Sure, but so what? I don’t think TfL should be getting into the game of building and running their own barriers, there’s no point. It would be like expecting TfL to build and run all their own trains. They’re much better of contracting that work out to other companies that specialise in that work. The only reason why TfL built its own contactless system was because there was simply no commercial offering out there that met their needs. Ticketing is probably one of TfLs most important skills, and part of building the contactless system involved negotiating with Mastercard and Visa to introduce specific new features into all card systems and contracts to support transport ticketing. Something which every other transport system in the world that also support contactless payments has directly benefited from.

by lol768 2y ago

inferiorhuman 2y ago

SMS is the de facto standard for MFA. Everyone's favorite ISP darling Sonic recently enabled SMS MFA on all accounts with no warning. Pretty much every financial institution I deal with offers SMS MFA (few offer any way to disable it). Retailers like Home Depot eschewed passwords in favor of SMS OTP. I wish it weren't so, but that's just how things are these days.

paulryanrogers 2y ago
SMS MFA is better than no MFA. SMS as SFA is bad since it's easily spoofed.
- ikekkdcjkfke 2y ago
  SMS MFA is usually used to reset password so it's almost always de facto SFA. Recent Veritasium video says overtaking anyones phone number costs just hundreds of dollars

avianlyric 2y ago

> For various reasons, the contactless system sadly still lags behind Oyster, with basic functionality like NR discount entitlements missing and showing no signs of emerging anytime soon. It’ll happen eventually. The Oyster system has already hit breaking point. There’s now a number of stations around London that only accept contactless and not Oyster, due to memory constrains on the Oyster cards that prevents support. TfL’s long term goal is to migrate the entire Oyster system onto the contactless backed end, so the cards cease to be stored value cards, and simply become unique account identifiers. TfL have did part of this migration a few years ago when they phased out older Oyster cards that couldn’t correct support the new ID based system. I assume that when they introduced weekly caps on the Oyster cards, that was partly enabled by their migration efforts to the contactless backed end. For them to complete the migration, they’ll need to support railcards on the contactless system. Although exactly how they’ll do that I have no idea. But either way the capabilities of the two different systems continue to diverge, and that’s going rapidly become unsustainable. > The physical infrastructure, like the gatelines, are all still controlled by Cubic as well. Sure, but so what? I don’t think TfL should be getting into the game of building and running their own barriers, there’s no point. It would be like expecting TfL to build and run all their own trains. They’re much better of contracting that work out to other companies that specialise in that work. The only reason why TfL built its own contactless system was because there was simply no commercial offering out there that met their needs. Ticketing is probably one of TfLs most important skills, and part of building the contactless system involved negotiating with Mastercard and Visa to introduce specific new features into all card systems and contracts to support transport ticketing. Something which every other transport system in the world that also support contactless payments has directly benefited from.