Reversing UK mobile rail tickets

https://eta.st/2023/01/31/rail-tickets.html

484 225 3 years ago

Nobody who cheers "mobile tickets" has ever watched a guard or ticket inspector do their job.

In the UK, a guard with good eyesight and a sprightly, cheerful manner can almost run through the carriages shouting "tickets please!" and see, with a single glance, all s/he needs.

Then she gets to the muppets with phones. They faff, fumble and fuss. They scowl at being interrupted watching videos, browsing social media and listening to music. They can't load their app. They huff and sigh disrespectfully. The guard can't get focus. For a moment they point phones at each other like cowboys in a gunfight standoff. She doesn't have a wifi signal, so now there's a long and embarrassing delay while passenger and guard stare at each others feet.

Finally a joyful beep releases them from technological tension. Everyone in the car sighs with relief and she moves on to the next grinning smombie.

The whole technology is a festering shitshow foisted on people by over-zealous tech peddlers.

Paper tickets rule.

tom_• 3 years ago

This doesn't match up with my experience. The "tickets please" acts as a warning to phone-ticket users that they need to get the QR code visible.

Could depend on when you travel I suppose.

scrollaway3• 3 years ago

Kids these days, how dare they use technology, am I right, fellow luddite on the internet?

People lose paper tickets. People throw them on the ground. Stations are littered with them. Oh, and people do spend ages looking through their pockets, bags, coats and other places for where their paper ticket is at.

You're just being contrarian because you're on a tech website, tbh.

nonrandomstring3• 3 years ago

littered with them.

I don't see that. The ticket barriers are programmed to retain used tickets. And please lay-off the "contrarian" slurs, I'm just telling you what I see with my eyes each day. If you looked up from your phone you might notice too :)

LtWorf5• 3 years ago

If a mobile phone is now a prerequisite for living, governments should issue them to all citizens, and provide maintenance and replacement.

Or just don't expect people who don't own a phone to own a ticket.

TEP_Kim_Il_Sung2• 3 years ago

People lose phones, or steal them, or hack them. Oh, and people do spend ages looking through their pockets, bags, coats, and other places for their phones too. But paper tickets are less likely to be hacked, and don't run out of power.

nkrisc2• 3 years ago

The e-tickets I use on my local commuter rail are nothing like what you described. When I want to use a ticket, I activate when I get in the train and then the conductor glances at it and sees whatever they need to see. Zero difference from paper ticket. They just walk down the carriage looking at paper tickets and phones all the same.

nonrandomstring3• 3 years ago

I'm on SWT. Where do you have ones that are eyes-on? Our guards have to do the scan-beep dance and it slows everything to a crawl.

IanCal2• 3 years ago

Have you ever actually been on a train in the UK? Ticket inspectors will go on to do anyone that's ready and come back - they're not bemused by someone without their ticket ready. And people constantly also fumble for their tickets then present an old ticket, then the return instead of the outgoing one, then the seat reservation not the ticket etc.

My local station doesn't sell tickets. It has no office. I can buy an advance then drive miles to a totally different station to print them out or just buy it on my phone even on the way to the station and be done with it. I guarantee you buying from the ticket inspector is slower than showing them my phone.

ghaff4• 3 years ago

I don't remember it being so bad on my last trip, but a number of years back two of us were doing a long distance walk in England. I remember train tickets being this exercise of "Which of these cards are the right ones to feed into the turnstile?" while people were piling up behind us.

In general, transit systems do a pretty terrible job of usability testing for people who aren't so used to the system that it's second nature and may not even read the language.

Symbiote11• 3 years ago

That ticket inspector can also turn a blind eye to invalid tickets (apply their own discretion/favours/whatever), while they'll probably need to follow the official policy with an app-based ticket scan.

From the article, it seems unlikely that a data connection is required to validate a ticket, except to prevent the same ticket being shown twice to different inspectors within a short timeframe.

OJFord2• 3 years ago

They definitely need a data connection for a ticket sale, (but they'll go ahead and come back or whatever) I'm not sure about validating digital advance sales.

ilammy• 3 years ago

What stops the inspector from turning a blind eye to app-based tickets?

If you want a true technological dystopia solution then the train car should be engineered in a way that nobody gets in or out of the car without a valid ticket. Like, make entrances a double-door, then you gotta swipe your ticket to board, deboard, go between cars while enroute, etc.

OJFord2• 3 years ago

Weird, that's not my experience at all.

I have my digital ticket ready when the guard's behind me, interrupting my video/HNing far longer than is necessary to do so, and everyone else is asking for 'X from <last station they can remember> please', cursing that this train actually had someone to call 'tickets please', as I feel like a mug for actually paying in advance every time.

madeofpalk3• 3 years ago

Paper tickets rule.

Paper tickets suck. It's already a pain having to navigation the station to find your platform, and then add onto it trying to find a ticket machine. Make sure you get the right ticket machine because multiple train companies operate from this station!

And then you have to hold on to it for the duration of your journey and not lose it, otherwise you'll face the fine.

lozenge3• 3 years ago

You can buy any ticket from any machine, it's only the first screen that's different. If you go to type your destination then it allows you to buy any ticket.

nly7• 3 years ago

I feel the same way about people who use mobile phone NFC payment at ticket barriers on the tube instead of a plastic cards (again via NFC)

Using your phone is much slower and there's a significant chance it'll just fail and hold up the person behind you (me).

brewdad2• 3 years ago

Last April, I did the credit card tap in NYC. Last month I was there again and tapped my iPhone and never had an issue. It felt just as fast or even faster since my phone is usually more accessible than a given card in my wallet.

I wonder if the Tube’s tap in tap out setup contributes to the issues you see.

djhworld• 3 years ago

That hasn't been my experience at all, at least in London, UK.

There used to be a time where the oyster card was slightly faster than the phone in terms of registering at the barrier but that's improved a lot over time.

I don't live in London anymore but when I've visited it's been so good just tapping your phone through everything.

Additionally the hold ups at the barriers in my experience are more down to people's misunderstanding of the cadence required between each passenger. This applies to both oyster/card and phone, and is more of a UX problem of the barrier rather than the technology used to activate it

NoZebra120vClip4• 3 years ago

Last week I was picked up by a bus that had technically already departed, so the operator told me to take a seat quickly. I really needed to test out the mobile fare for the pilot project, so I waited for the next opportunity to scan the QR at a safe, legal stop.

A dude was attempting to board, and I was hardly 10 seconds at the scanner when he urged me to get out of his way! It's bad enough when a magstripe pass doesn't scan on the first try... it's going to be murder if everyone's fumbling with their phones and apps and wireless connections.

jonathantf2• 3 years ago

Paper tickets are an absolute pain - I hate having to fumble around trying to find them, instead of just double clicking the power button and bringing up my Wallet.

I've only ever had it checked by the barriers, I can't remember the last time I saw a conductor checking tickets on a train.

stevekemp• 3 years ago

Some stations don't have barriers, which seems to correlate with tickets being checked on those routes more frequently.

(e.g. York, or Edinburgh.)

rippercushions• 3 years ago

I went to an exhibition at a museum today. There's a distance of maybe 5 meters between the ticket office and the exhibition entrance. Instead of getting a paper ticket and handing it over at the gate, I had to tell the clerk my phone number, wait a few moments to receive one SMS for each person, click on a link in each SMS to retrieve a separate per-person QR code that could be scanned at the gate, and then click back and repeat individually for everybody in my group. Such efficiency!

dTal2• 3 years ago

Yes, they efficiently extracted your phone number.

SCdF• 3 years ago

This has not been my experience of digital vs paper tickets in any country at any point, the UK included. And I don't mean it mostly doesn't happen, I don't think I've ever particularly noticed an instance of drama created through tickets being digital specifically.

sschueller• 3 years ago

This was an issue in Switzerland initially with the introduction of the SwissPass (very ugly looking thing, at least the new one looks a bit better [1]) which no longer showed what it was (the old Abonement cards where translucent [2]) but was a card with a photo on it and you would have a ticket connected to that card which the conductor could check with their smartphones either via NFC or the qr-code on the back. The Samsung phones that where issues where slow to scan the cards via NFC.

Today you can also have everything on your phone which then gets scanned withe QR-Code. BTW, this code changes every few seconds so screenshots don't work. You can also instead of purchasing a ticket do something that is called "check-in" where you check-in before you get on the train and a GPS type ticket is issues. At the end of the day the best possible rate for you is then calculated and your are billed. Downside is, you need to be "tracked" by the train company for this to work.

However the process to inspect tickets is again as fast or faster than it was before. In fact when someone has paper tickets (specifically papers from non-Swiss ticket offices (France, Italy etc.)) it can take longer.

There is also a rule if you can't present your ticket in a timely manner it's considered invalid. This never happens but when the conductor yells tickets please, get your phone out.

[1] https://www.swisspass.ch/new-swisspass?lang=en

[2] https://hymnos.existenz.ch/wp-content/uploads/2010/08/DSC037...

switch0075• 3 years ago

Nowadays, the industry would very much like you to ditch your paper ticket in favour of a fancy mobile barcode one (or an ITSO smartcard2); not only do they not have to spend money on printing tickets but they also gain the ability to more precisely track the ticket’s usage across the network and minimise fraud.

And unsurprisingly only a subset of tickets are available on the apps. Therefore the government gets its “fare simplification” it’s so badly wanted, through the back door, in a sense, the harder it pushes mobile tickets

Eg rover tickets are not on the ticketing apps. These can be excellent value.

Edit: also the government very recently announced [0] they are to scrap return fares. This will without a shadow of doubt increase prices for a great many journeys.

[0] https://www.railforums.co.uk/threads/end-of-the-line-for-ret...

AmericanChopper2• 3 years ago

I don’t know if they do this in the UK, but using apps also gives the government the ability to profit from breakage the same way gift card programs do. The last time I had a public transport app I had to maintain a balance that could expire. The place that implemented this system also prohibited all other forms of payment as a Covid measure, and for some reason hasn’t reverted that policy yet.

Symbiote11• 3 years ago

In London you can use a normal contactless debit or credit card or NFC payment on a phone for public transport. This is great for Londoners, and even better for visitors who don't need to figure out what they need to buy or how to top up a card.

I don't belive the ticket apps being discussed keep a balance, but I haven't used them myself.

riskpreneurship• 3 years ago

I dunno about the UK, but I think RFID readers might just be cheaper because they require so little maintenance.

I bought a single-use one-way subway ticket recently. When I got to the turnstiles, none of them had slots to swipe or insert the ticket.

Of course, it's 2023. You can tap the paper ticket as if you had a refillable or monthly pass, it has the RFID circuitry sandwiched between paper layers. No more mechanical moving parts which can break and slow down the rush hour commute.

zhte415• 3 years ago

Just do away with tickets and apps altogether and scan your national ID card.

Or give everyone a national fare allowance to boot, like the national subsidy for maintenance of roads and their other associated costs.

IanCal2• 3 years ago

There isn't a national id card.

xdfgh11122• 3 years ago

With mobile tickets I've also lost the ability to break my journey up (i.e. visit somewhere half way along a route without having to buy two tickets) which has increased the price of my journeys.

plugin-baby2• 3 years ago

How have mobile tickets stopped this? Wasn’t it always against the rules, even if possible when the middle station lacked barriers?

lozenge3• 3 years ago

Well, currently the single fare is often £0.20 less than the return fare, for historical reasons. Scrapping them seems like a good solution.

As already shown in this thread, even the employees don't understand the very complicated fare rules. My manager was very proud of winning a half hour long argument with a ticket inspector about the Conditions of Carriage, but most of us just want to buy a ticket and go.

switch0075• 3 years ago

Public transport exists to serve the public. If complicated return fares, while inefficient and perhaps annoying, ultimately better serve the public, then that is good reason for them to remain.

I know what will happen. We're at the stage of the PR spiel where they acknowledge there will be some losers but overall it "will benefit the majority". That will silence any critics. Then when it's being implemented, it'll turn to "we always knew there would be some winners and losers (dropping the "it will benefit the majority" part). Then a couple of years after the change, it will be: we regret how much it's affected a lot of people, but it's here now, and we're using all the extra revenue to invest in the railway. Like something out of Yes, Minister

Given the list of issues with our rail system currently, I'm not sure abolishing return fares should be high up on the list.

timthorn• 3 years ago

The photo of a UK train ticket is very interesting. Reading Green Park station isn't yet open, AFAIK: https://www.nationalrail.co.uk/stations/RGP/details.html

Symbiote11• 3 years ago

I'd guess you've discovered the train nerd Easter egg of the article.

nly7• 3 years ago

The price on the ticket is also £1.90M

arp2422• 3 years ago

It usually has an "X" suffix. I'm not sure what the "M" stands for; maybe to mark it as a specimen?

odiroot2• 3 years ago

Which is weird because the minimal fare is £2.20 now.

lol7682• 3 years ago

Seemingly purchased at a Paddington TVM? I'm surprised they allow purchasing that far in advance.

NoZebra120vClip4• 3 years ago

During the COVID outbreak, my public transit provider began to neglect their fareboxes (partly because everyone was boarding in the rear and didn't bother to pay fares anyway.)

I noticed that the boxes were still broken and unmaintained. I put 2 and 2 together and realized that a mobile "upgrade" was coming soon, so I kept my eyes out. And sure enough, I got myself invited to participate in the pilot project with the upgraded app.

The deadlines slipped twice but the pilot began in mid-January. So far I have not had glitches with scanning or boarding. But let me tell you.

There are disclaimers in the FAQ. Since the mobile passes are QR-based and not NFC, they absolutely require WAN connectivity on both sides in order to activate a pass. My initial testing indicated that a loss of connectivity will not invalidate an active pass, because it's endowed with a built-in expiration countdown. But we shall see.

The FAQ also says straight out, of course, that the customer must keep the phone charged in order to use the pass. Of course it goes without saying that your phone must be functional in order to scan the thing. So that's a whole tech stack that could go awry and strand you if you don't take precautions.

Hey, this may reduce fraud and friction at the farebox. I don't know. Many people will love not having another thing to lose or the convenience of purchasing passes without going somewhere (they cost way more on board a bus.) But the Luddite in me doesn't want this. I'd much rather carry around an old reliable paper-based pass, and I will go back to that for as long as I can get away with it.

But I won't turn down a $75 gift card to play along with the pilot test.

ClumsyPilot2• 3 years ago

Of course it goes without saying that your phone must be functional in order to scan the thing. So that's a whole tech stack that could go awry and strand you if you don't take precautions

It could go awry if Google fucked up, Samsung/phone manufacturer fucks up, battery or charger fucks up, software developer fucks up, internet, etc, etc.

we are replacing reliable sustems with fragile ones everywhere

LtWorf5• 3 years ago

In sweden Coop supermarkets were closed for a weekend because they rely on some cloud thingy from USA that had gotten a ransomware.

It was their billing system, you couldn't pay cash, they had no way to record it.

shortcake272• 3 years ago

A tangential story from Melbourne - you’re required to replace your Myki every ~7 years because of its shitty implementation, and when you do, it disables auto topup. However, when you get a new card, you also can’t immediately enable auto topup - you have to wait some time until the card is transferred. So a friend of mine had this happen and wasn’t able to touch onto the tram the following morning because they had no balance. Trams don’t have Myki machines, and there was no machine at their stop. Topping up online can take up to 24h. Paper tickets were removed to push Myki. So there was no way for them to pay the fare, but they had to get to work. Of course, ticket inspectors rocked up and fined them. It is genuinely incredible that commuters are expected to either pay a fine or be late to work because of shortcomings in the Myki system.

vlovich123• 3 years ago

My iPhone supports transit passes even when the battery is dead. I don’t think this is an intractable problem and indeed the designers of NFC designed for this problem: the NFC payment system provides the juice required for the SE chip to do it’s thing.

QR code as transit passes aren’t great but eventually the worse designs will fade out. NFC is a way superior piece of tech and way faster too - just tap your phone and go. I was pleasantly surprised that transfers worked seamlessly this way too.

osclarto• 3 years ago

I live in Berlin and use the official BVG app for using the public transport here. it bugs out temporarily fairly regularly and I have to make the decision whether to buy a paper ticket to cover me (incurring extra expense) while the app isn't working or to risk it and hope the ticket inspector doesn't stop me/shows me leniency when I demonstrate the non-functioning app. extremely annoying

totetsu2• 3 years ago

Am I miss remembering or can the nfc mobile train passes in Japan be used even with a dead battery?

larouxn• 3 years ago

Yes, I believe this is correct as the terminal you tap/place your card/phone near transits enough power wirelessly to read the NFC (F) data or so I have read. The NFC (Felica) + Osaifu-Keitai + Suica/Passmo system is quite interesting and super reliable.

Source: on a train in Tokyo right now

netsharc2• 3 years ago

Sounds like an iPhone feature: https://www.techradar.com/news/apples-iphone-xs-has-a-game-c...

The Pasmo/Suica cards are intriguing, they are NFC, but also store the last few transactions on the card itself, there are also mobile apps for scanning these cards to see how much credit you have left and list the above-mentioned transactions.

nischalsamji• 3 years ago

This sounds like valley metro

mixmastamyk2• 3 years ago

A tap card is a nice middle ground. No idea why people are dying to drag so much complexity into a simple transaction.

mixmastamyk2• 3 years ago

Oh I remember, so they can sell your data.

TEP_Kim_Il_Sung2• 3 years ago

Why not go all the way and tie your ID, medical info, and online presence to the phone, that way they can cancel your toll pass and life when you inevitably do, say or think something the ruling party doesn't like.

wodenokoto• 3 years ago

The best tech solution I’ve yet to see is simply accepting credit/debit cards.

Checking in, they can charge you minimum fare and checking out they can charge you remainder.

They could also charge you maximum fare and return remainder on checkout.

You can even keep track of card and give discounts for multiple rides.

All without registration. Works with watches and phones too.

8n4vidtmkvmk• 3 years ago

pretty sure they do this in Vancouver bc now. i think i heard san Francisco is starting it too now. but i haven't tried either first hand

domh• 3 years ago

This is how the London Underground works now. Used to require an Oyster card but has worked with contactless cards for a good few years at this point.

Symbiote11• 3 years ago

The London system makes a single charge at the end of each day, to reduce possible fees incurred by foreign cards etc.

I think they set up a special protocol with Visa and Mastercard to allow this.

beAbU• 3 years ago

We have this in South Africa, on the service between Pretoria and Johannesburg called the Gautrain.

It works with tap cards, both debit and credit. Can even be used to get in and out of the parking by tapping at the boom gate at entrance/exit.

You can buy a special Gautrain card that uses the same hardware. But the only benefit of the dedicated card is for folks that travel frequently, as you can buy discounted prepaid fare, something like 40 trips to be used in 20 days, for half price.

Only real risk is if you carry both a credit and debit card, and mix them up during the scan in/out process. They then charge maximum fare on both cards.

NoZebra120vClip4• 3 years ago

Our system uesd to accept credit/debit. Unfortunately on a bus circa 1999, you don't have an always-available connection to the payment processing center, so you settle all the transactions back at the barn.

One of my so-called friends just carried around an expired credit card, and rode the bus with impunity. The fare box accepted anything that seemed legit. So it's reasonable to see why that sort of payment method was discontinued with prejudice.

(Of course there's no reason not to bring it back with connectivity improvements, but they'd rather push mobile fares at the expense of something actually convenient to people in the economic bracket of "transit rider".)

ErikCorry3• 3 years ago

Good luck finding out ahead of time whether your foreign card is going to be accepted by the system.

Also seems difficult for children who don't generally have credit cards.

tazjin2• 3 years ago

Moscow metro does this. In very busy stations only the turnstiles at the sides have this functionality though, as the native NFC cards ("Тройка") are much faster (contactless payments can take O(seconds), which is a lot when there's 50k people trying to get through).

madeofpalk3• 3 years ago

Since the mobile passes are QR-based and not NFC, they absolutely require WAN connectivity on both sides in order to activate a pass.

Why they rolling out QR-based public transit ticketing in 2023 when NFC (which all phone platforms support even with a flat battery) solutions are table-stakes now?

Operyl• 3 years ago

Lowest bidder, government procurement is fun.

NoZebra120vClip4• 3 years ago

There is actually already a system of near-field passes that has been in place for several years and was supported by the old fare machines and bus boxes. The new QR scanners also appear to have an NFC scan icon on them. So I believe they're future-proof.

folmar• 3 years ago

Maybe all phone OSes (I'm too lazy to check) but far from all phones. For example a popular budget model Realme C25Y does not have NFC, or in general terms anything that is primary designed for the Chinese market, where payments are made through WeChat with QR codes, usually misses it.

tsujamin2• 3 years ago

The bit at the end regarding the unauthenticated anti-fraud database of trips reminds me of bus tickets in a couple of australian states, which (locally on the 13MHz MFC cards) store a short rolling log of your most recent trips.

Not as bad as a public API, but probably some degree of a personal safety risk given the security around MFC cards and the ability to ascertain pattern-of-life from the data

lmz• 3 years ago

Those are useful for ticket inspectors and also for troubleshooting issues e.g. if the fare gate won't let you out.

tsujamin2• 3 years ago

No ticket inspectors in play, but it’s roughly a COTS system so makes sense I guess

lawgimenez• 3 years ago

Last Covid, I did the same reverse engineering our government's Covid app and found out that the API keys (public and private) were hardcoded in the source code. Never got any response.

Edit: Emphasized public and private keys

tiziano88• 3 years ago

Where else should API keys be, if they are needed by the app?

ggm2• 3 years ago

Private key should be in the trust region and set up when you make the account

xkcd1963• 3 years ago

Coincidentally I started scanning Sao Paulo metro ticket QR codes (if someone feels like reversing it)

<q:01> s:196;u:296101284;i:14;c:JP4igg/YIyk03lYqnVcjFCQjDldUc7Th82Gjppb89S8I0vlCNIAYpzBgUESmeKmaaf2BHvlkuyd3opXXwEWsujuGqqakb09xrYWVlBeqY97qfwE1bynzs9FbGmG6HxnVmpM6AHROTBZa08ti/0KiR1oyKpZkrucBE9dJsJtz0qg=;x:49;

<q:01> s:196;u:297172367;i:14;c:pirqKynzF6wa7ttQJRtw8B5SfcQiWL5psEwju5OVjxLwG7hZKgJsii381A0l9hzcxsebxUJrK6Z1ZX22ILd/AMYOSx2DuQ2OHqrP5r8sNuVfMATrYOTbcioISrn/dBLN1vaQxEmZkTxLkE9837NGvsrlP7mF+BWYps3jqA/MfG0=;x:25;

renewiltord• 3 years ago

Nice stuff. As a user, this stuff is way simpler. I buy the ticket on train line and get a qr code that scans and I'm on the train.

josephcsible• 3 years ago

(“But wait,” I hear you cry, “isn’t getting a persistent device ID exactly what Apple don’t want you to do?” And you’d be right! Technically, I believe the device UUID actually does change between installs, but they store a copy in the device keychain, which doesn’t get wiped when you remove the app. This is stupid, and almost certainly a contravention of App Store policy.)

More proof that Apple's walled garden is a scam: it fails to protect against the thing that its alleged purpose of existence is to protect against.

TobyTheDog123• 3 years ago

This reminds me of the time when I was a college student in Massachusetts and would always try to reverse-engineer the Massachusetts Bay Transportation Authority tickets, powered by JustRide (oh! Just noticed it's the same company as in the article)

Unfortunately, my skills weren't quite there at that point in my life, and I no longer live in Massachusetts, but this was an incredible read regardless and I feel at least a bit of closure now :)

The MBTA tickets had an option of color bars (so the conductors could just visually check if all of them match throughout all the passengers) and a QR option, so I would always try to figure out how it generates those colors, as the tickets had to be able to function offline, and as the tickets all showed the same colors regardless of passenger, they certainly weren't unique per-purchase nor used any user-unique info (though they may have been unique per-train-route).

I should take another look at it with this article as a resource.

jasonjayr• 3 years ago

I think the tickets had to be activated 'online', and iirc they are good for 60 minutes.

Additionally the color bar screen has an animated timestamp too, presumably to prevent a (basic) screenshot attack.

And; although I've never had it scanned, I think if the ticket checker suspects something is up, they scan the qrcode for an online verification.

I took a large family group with me on one ride, and they did consistently check that I activated the right number of tickets.

fuzzfactor3• 3 years ago

On the Florida Turnpike it was always too expensive for many students when they traveled up and down the state.

It was bad enough having captive service stations and restaurants for overpriced products, but the toll was and still is ridiculous too, considering it was agreed there would be no toll after the construction was paid for, And it was well paid for decades ago.

Anyway there were only very few exits and they were mostly rural until you got to South Florida where you could get off and on every few miles. The captive service stations needeed to be built at the same time as the Turnpike or everybody would run out of gas back then.

Except Orlando which was a very small city before Disney came in, but their gas stations were still closed late at night and on Sunday.

Tickets were reverse engineered in a completely analog way.

The "main entrance" to the Turnpike coming south was out in the middle of nowhere where the I-75 freeway keeps going to Tampa but you smoothly get over to the main gates of the Turnpike if you want to head down to Miami instead. You would just breeze on through and pick up a ticket at the northernmost gate, and the further you traveled south, the more toll you would have to pay when you got off.

Students would get off of I-75 avoiding the Turnpike and drive on the rural roads about a half-hour until you get to the next Turnpike entrance and pick up a (very valuable) ticket there instead of at the main entrance to the north.

As you got down toward the Palm Beach area, where the northbounders and southbounders still shared the gas stations and restaurants in the central plazas, many northbound travelers would willingly trade tickets from wherever they got on in South Florida for one which will only cost them as much as if they got on at the very last chance before hitting the northernmost exit.

Northbounders would then get off right where they were going to anyway, one exit away from where we got on, and we would get off one exit away from where they got on, and everybody came out ahead, paying the minimum tolls possible.

It took a long time before any toll-takers started looking at the tickets and asking "why did it take 6 hours to only go one exit?"

reustle2• 3 years ago

I used to live in the US and currently live in Japan. We pay around $95 to go about 5 hours on a highway from Tokyo to Kyoto, for example. 3~ hours north is about $35. I think this more accurately charges us drivers for the resources we consume.

kevinh4562• 3 years ago

What's the condition of the road like? I assume that it is immaculate.

dandy23• 3 years ago

It's similar in France, maybe half that number though. It's a good system. The one's who use the highways pay for them. The highways are in a very good state in France.

paganel4• 3 years ago

It also adds to the price of food that gets transported from one place to another, and, as such, acts as a regressive tax on people who pay the biggest part of their income on their basic needs (like food). That's one of the main reasons why I don't get the "death to cars!" movement and why I regard it as mostly middle-class privileged discourse: no cars means fewer or worst roads, means food being a lot more expensive.

johnwalkr• 3 years ago

I was also going to mention Japan. All highways are tolled and Japan also has virtually zero street parking, and free parking is mostly limited to private lots owned by stores. Of course, the more rural a place you go, the less this generalization is true.

Even if you already own a car, it is in general more expensive, inconvenient and maybe even slower to choose to drive to work. As a general rule of thumb, driving long distances costs about the same as taking the shinkansen for one person, is slower and makes more sense once you have 3+ people in the car.

I think overall this is fair and leads to much better outcomes than US-style "it's my right to drive and park for free where ever I go, but I will fight any proposal to improve or subsidize transit because 'my taxes!'".

fuzzfactor3• 3 years ago

You may be right about the resources but that's pretty steep, between 10 and 20 dollars per hour and I would think that highly discourages workers earning hourly wages of that amount or less from traveling that way very much.

In Houston about $95 per month was about all the market could stand to commute on a modern 21st century tollway. Once it got over $100 it looked to me like it was beginning to become possible for an elected official to get in based on a promise to reduce or eliminate the tolls. I don't think that's been an issue yet but the tolls have recently been reduced for the first time ever.

Actually it's the unseen waste of resources that discourages me from driving any more than necessary, rather than the cost to me of operating a vehicle.

Symbiote11• 3 years ago

There was a discussion on a different post pointing out that maintenance of a highway is still very costly. Charging only the users, rather than all taxpayers, appears very fair.

dmurray• 3 years ago

Charging by road use definitely seems fair, but it's a problem when you have 50 major roads in the state and by historical accident only say 2 of them get tolled. North-South travellers end up subsidising East-West travellers or vice versa.

It's hard to come up with a perfectly fair system. Tolling every road is expensive and tax on fuel has its own trade offs.

mnd9993• 3 years ago

Superficially maybe, but it's much more complicated than that. When an efficient public transport exists between two places there are derivative economic benefits all round, a larger pool of employees for businesses in A, more demand for housing in B etc.

mattigames• 3 years ago

As much as charging only the victims of crimes to pay for police expenses rather than all taxpayers appears very fair.

borski• 3 years ago

So you never get anything delivered on a FedEx or ups truck? And you don’t receive mail?

bboygravity• 3 years ago

I've lived in countries with and without toll.

I feel the no toll approach is better.

Most importantly because no toll means (the feeling of) more privacy, toll means you're being tracked. Regardless of law we all know that everything eveywhere gets stored indefinitely independent of country (if not legally then illegally if not by the toll org then by the secret service).

Secondly the country I was in with the toll approach had worse infrastructure.

Thirdly, when looking at government spending as a whole, road infrastructure (in a non tollroad country) is really not that big of an expenditure as far as I know?

Forthly, a country may (and some do) still tax road-users only by just taxing car ownership periodically. No need to invade privacy for that through toll booths or even worse: mandatory tracking devices (countries in Europe are pushing for the latter). Added bonus: you can trivially put a tax on relatively polluting vehicles if you like and use that to subsidize less polluting vehicles.

iso16313• 3 years ago

Depends if you think roads should be run as a public service, free to all at the point of use, and paid for by all according to their means, or a private service (with or without profit).

Do you also think the same about parks? Or schools? Or police? Or healthcare? Or water? Or rail? Or defence?

slavboj• 3 years ago

Infrastructure provides public benefits way in excess of the private benefit to the users, which is why roads have been public projects for millennia. People generally travel on roads to get somewhere and do something, and given increased state capacity, that thing is overwhelmingly likely to be taxable.

Toll roads are a holdover from times of reduced state capacity when the best and only way to tax something was to force it to go through a physical chokepoint.

alistairSH• 3 years ago

Maybe, except it’s a regressive tax.

They don’t call HOV/toll lanes “Lexus Lanes” for nothing.

rhn_mk12• 3 years ago

"Reverse engineering" is where you learn something about how a system works, especially nonpublic information.

What you described doesn't have anything nonpublic or learned facts. Instead, it's a cooperation to fool someone into not having to pay for service. I'm not sure if it could even be called "cracking", since that typically involves learning new facts, too. Only "exploiting" comes to mind.

fuzzfactor3• 3 years ago

I'll concede the exploiting but there's always going to be some discrepancy about what a natural-born Florida "Cracker" is to begin with :)

And engineering is over exaggerated too, more like the tickets were merely reversed not thoroughly reverse engineered.

We certainly weren't going to counterfeit any tickets.

Just work around the system.

gadders• 3 years ago

>but the toll was and still is ridiculous too, considering it was agreed there would be no toll after the construction was paid for, And it was well paid for decades ago.

Same with the QE2 bridge in the UK. Governments are disgusting.

https://www.essexlive.news/news/essex-news/dartford-crossing...

Eisenstein• 3 years ago

And it was well paid for decades ago.

What happens when you build a road and declare it done and then never deal with it again? Does it continue to work as a road after a few years?

Governments are disgusting.

Who builds roads?

andrepd2• 3 years ago

tolls are expensive

Well do you know what's expensive? Highways. In the US less than 20c of every dollar come from road tax/fuel tax/tolls. The rest is paid by taxpayers, whether or not they use those roads, whether or not they drive, whether they drive a 3.5 ton SUV or a 1 ton "small" car. This is not even getting into the terrible externalities that car use entails.

Personal automobiles pay far too little.

tolls should cease after initial amount is paid

A good ballpark is every ~30 years you spend, in maintenance, the same amount of money it took to build it in the first place.

HyperSane• 3 years ago

Toll roads are stupid.

iudqnolq2• 3 years ago

They invented a clever decentralized system based on public key cryptography, but it seems like they actually need centralized features. So they bolted some on, leaving an end result worse off than if they'd started with something simple and centralized.

For example, you can ask any UK rail operator to book you a trip that includes sections run by other operators. So your purchase needs to be fed through a centralized revenue-splitting system (called LENNON iirc) anyway.

Then they got the feature request that you should be able to book specific seats and someone else shouldn't be able to book the same seat, and so on. This just can't be decentralized.

This setup does have the advantage that they can check tickets without needing a network connection, but I'd guess there would be simpler ways to add that to a centralized system.

bombcar• 3 years ago

You could in theory make it decentralized-ish depending on the requirements. For example they could allocate blocks of seats to vendors and if you bought one of those seats you could buy it “offline” to be synced later.

But it’s probably not worth the hassle and once the ticket is sold you can have it be signed by the centralized system so you can verify the signature offline easily.

iudqnolq2• 3 years ago

I don't think that theory works out in practice because they have not that many seats in the trains, a lot of vendors, vendors that book very small and irregular numbers of tickets on routes, and sometimes very few or no extra seats. So you'd need to reallocate the blocks by demand quite frequently, at which point it's morally a shitty centralized system.

And with every clever decentralized solution there's another feature request that adds more complexity. I just remembered some trains have displays above seats that tell you if it's reserved.

krisoft• 3 years ago

So they bolted some on, leaving an end result worse off than if they'd started with something simple and centralized.

I disagree.

This setup does have the advantage that they can check tickets without needing a network connection

This is the most important reason why it is implemented this way. Checking happens on rowing handheld devices which have frequently no good internet connection. Even in the turnstiles where you would think they could afford a reliable connection if said connection goes down you can’t block the flow of people.

Reliability and speed of checking was clearly the most important features they optimised for. Security, in the sense that passengers can’t just mint tickets for themselces, is a close second.

The beauty is that every centralised reporting can be deffered. In case the centralised database is down, or the checker’s network is down, you just store the timestamp and the signed ticket data and report it once things are working again. The centralised system doesn’t even need to trust the checker computers. Railway company A cannot mint a ticket from railway company B. They don’t have the keys to do that. So they cannot fraudelently divert revenue from each other. Neither accidentally nor intentionally.

but I'd guess there would be simpler ways to add that to a centralized system.

I’m all ears. How would you do it simpler?

londons_explore2• 3 years ago

Centralized ticket server. QR tickets consist of a counter and signature.

Train companies have a login to the ticket server to let them mint tickets.

Checkers, when offline just check the signature, and log to the central server later.

When online, they ask the central server for all other ticket details and check those.

Any ticket that is misused and isn't detected at the time is blacklisted, and that blacklist distributed for offline use. A blacklist of the 10 million most-misused tickets could perhaps be just 10 megabytes - easy to download/update every few hours over mobile internet.

Now, anyone can wrongly use a ticket just once, as long as they are sure the checker is offline. And if they are mistaken and the checker is online, or they reuse a ticket, they will get caught.

main benefit: tickets can be smaller (and therefore read far quicker). Tickets can also be cancelled easily. For example, train companies could send out promotional tickets which only charge you if used, and are cancelled otherwise.

qrt• 3 years ago

if you reverse the domain of this website, you get "state" :)

jrockway• 3 years ago

They seem to have removed the device "abc" from being allowed to download keys, or that was an "obviously fake" device id for the article:

   > $ curl -s 'https://device.theticketkeeper.com/download_keys?device_name=abc' |  jq
   > {
   >   "return_code": "error",
   >   "message": "Device not registered."
   > }

arnon• 3 years ago

Very nicely written, it made it very accessible to those who aren't super familiar with reverse engineering.

I'm fascinated by "transport billing" - it's such a complex problem, owing to the different infrastructure providers, different operators, fares, holidays, special events, and weird edge-case situations.

japanman425• 3 years ago

Okay very good but why bother?

michaelt2• 3 years ago

they also gain the ability to more precisely track the ticket’s usage across the network and minimise fraud.

Except mobile tickets make fraud trivial - getting off the train without a ticket, at a station with a ticket barrier? Just show them your powered off phone and say 'my phone died' and they'll let you out, no questions asked.

Shaanie• 3 years ago

Sure, but presumably because it's not worth the effort to verify rather than an inability to do so, no?

If their priorities change, claiming your phone is out of battery seems unlikely to allow you to avoid a fine.

nly7• 3 years ago

Exactly. It's not like with paper tickets it was any different. If you lost your paper ticket they would either shrug and let you out, or fine you on the spot and let you cancel the fine if you can find and produce the lost ticket later.

Of course, I suppose in 2023 you can always say you have no way to pay the fine without your phone...

lozenge3• 3 years ago

Do that five days a week and they will start recognising you!

nprateem• 3 years ago

It's your responsibility to produce a ticket. Claiming your dog ate it or whatever will just mean they make you buy a new ticket and apply for a refund if you find your original again. They've heard these things before.

michaelt2• 3 years ago

So you say - but I've repeatedly seen people allowed to exit through the ticket barriers at my local train station with nothing but a powered off phone as a 'ticket'

odiroot2• 3 years ago

That won't work with the controllers inside the train.

astrange2• 3 years ago

NFC works on phones even if the battery is dead, as long as it's set as an express card. (Doesn't work if it's /really/ dead, but just hit 0% that day is fine.)

grahar64• 3 years ago

Such a good read.

nly7• 3 years ago

The fact that there's a gender field on the ticket is interesting.

lol7682• 3 years ago

It's unused in reality.

tescocles• 3 years ago

One might assume it's forward thinking - if this were used in Japan, where there are woman-only carriages, this might be relevant.

nly7• 3 years ago

There should never be a need for this and the fact that they exist is sad.

implements• 3 years ago

Sometimes people give one-day unlimited travel tickets they no longer need to other passengers as they leave the station, which is at least against the terms of issue if not actually illegal.

I guess having a sex / gender field makes that kind of re-use slightly harder?

switch0075• 3 years ago

Which part of the National Rail Conditions of Travel is that against?

Edit: section 5.1.2

usr1106• 3 years ago

It might be needed for night trains (sleepers). Before COVID-19 in Finland you could reserve a single bed for women or men, which meant your share the compartment with a stranger of the same sex.

A model which of course assumed sex is strictly binary and having strangers of opposite sex in the same compartment is problematic, while having strangers of the same sex is unproblematic.

riialist• 3 years ago

Same-gender compartments in trains or whatever simultaneously make sense and do not. E.g. for "cis-gender hetero woman" - as myself - these policies give me privileges such as more clean toilets but longer queues - except in tech events, where women are nowadays a minority.

In Mumbai the local trains have separate wagons for women, which was nice. There was space, women who talked to me as as "sister" singing and making handicrafts. The other sections of the train were packed as sardines in a can, and men groping each other, in particular those with fair complexion. And please don't take this comment as xenophobic or as an insult against Indian people or culture in Mumbai, this is just how it is.

At the same time, the only time I have been actually hurt by sexual harassment by a stranger happened here in Finland when a girl high on something groped me in a techno party and tried to kiss me. I got amused first, but after a while I tried to detach her. No one come to help me even I yelled that please get this girl away from me. If it had been a guy, I would have kicked him to ground, but for a girl - I could not do anything apart from just trying to push her away. Eventually we both fell down stairs and my ankle got sprained.

emj• 3 years ago

I highly recommend Harley Watsons talk (_unlobito) about ITSO and footnotes on Oyster card. https://lobi.to/talks/papertickets/ that talk is also referenced in this article, a truly wonderful presenter.

Reversing UK mobile rail tickets

Related Stories