Re: [89attendees] Oyster card balance

[Derek Atkins <[e-mail]>]

On Tue, 2014-03-11 at 03:06 -0700, Stefan Winter wrote:

> It escapes my why an online top-up can't stand on its own? It is after
> all an UDPATE in some DB of the accounting system. Unless the balance is
> actually kept on the card, not in a central DB. If it is on the card, I
> wonder if messing with the card is a worthwhile hacker's target for, uh,
> "self-service" top-up.

I don't know specifically about Oyster, but the Boston MBTA Charlie Card
which appears to use similar technologies definitely has the balance
stored on the card itself.  Although it is *possible* that it uses a
database for reconciliation to detect fraud/tampering.  I'm pretty sure
the SF-Bay-Area Clipper Card works similarly, too, and indeed I recall
hearing about a ring of counterfitters that were generating fake cards
with balances.

Before the MBTA moved to the contact card they used mag swipe cards, and
those were very easy to rewrite/hack with a card-reader-writer machine.

-derek