Christchurch transport card flaw

Forums › Off topic › Christchurch transport card flaw

1 | 2

sbiddle

30853 posts

Uber Geek

Retired Mod

Trusted

Biddle Corp

Lifetime subscriber

#931182 12-Nov-2013 08:41

mikerussellnz: If you read the SC magazine article you will know that ECan were made aware of the issues 3 months before the conference and even that it would be presented at the conference. ECan did nothing.

ECAN were on the radio yesterday morning making it very clear the issues that he raised 3 months ago with them were not the website issues he raised at Kiwicon and the first they knew about these were on the weekend.

Yabanize

2350 posts

Uber Geek

#1551361 12-May-2016 10:31

@sbiddle while this was a while ago now, all of the corrospondance between the 'hacker' and ecan was released via OIA on the FYI website, and it seems he did make them aware.

3 years later, they have now just started the roll-out of new cards (DESFire I believe)

Linuxluver

5828 posts

Uber Geek

Trusted

Subscriber

#1551424 12-May-2016 11:37

Oblivian: As predicted, they have taken it offline (ecan electronic topup site) now that it has gone viral
http://www.stuff.co.nz/the-press/news/transport/9386649/ECan-public-transport-card-hacked

And indicating they want to charge the guy!...

That's funny.

Embarrassed, caught-out admin people trying to put the blame on someone else.

Typical response of far too many people these days.

_____________________________________________________________________

I've been on Geekzone over 16 years..... Time flies....

meesham

973 posts

Ultimate Geek

#1551446 12-May-2016 12:46

This is the information released: https://fyi.org.nz/request/1298-all-correspondence-and-internal-documentation-in-relation-to-security-and-privacy-concerns-with-the-metrocard-services#incoming-5156

It looks like he spent a lot of time and effort assisting them.

Geektastic

17942 posts

Uber Geek

Trusted

Lifetime subscriber

#1551519 12-May-2016 14:16

Presumably I am not the only person who thinks that Auckland, Wellington and Chch all using different systems for paying for transport is as mad as a box of frogs?

KrazyKid

1238 posts

Uber Geek

#1551558 12-May-2016 15:37

I agree - crazy.
Someone (SBiddle??) wrote an excellent post on the history of Snapper, AT Hop and the reasons why they weren't one card.

They only good news is 3 systems provides a sort of security as someone has to find 3 different points of weakness (I know I'm stretching here).

Kyanar

4089 posts

Uber Geek

ID Verified

Trusted

#1551616 12-May-2016 16:56

Geektastic:

Presumably I am not the only person who thinks that Auckland, Wellington and Chch all using different systems for paying for transport is as mad as a box of frogs?

I don't know why you think that. You can't even use one transport card over all of Queensland AU, California US, Victoria AU, NSW AU, or your beloved United Kingdom.

Equinox IT

Cloud spending continues to surge globally, but most organisations haven’t made the changes necessary to maximise the value and cost-efficiency benefits of their cloud investments. Download the whitepaper From Overspend to Advantage now.

richms

28168 posts

Uber Geek

Trusted

Lifetime subscriber

#1551621 12-May-2016 17:06

Geektastic:

Presumably I am not the only person who thinks that Auckland, Wellington and Chch all using different systems for paying for transport is as mad as a box of frogs?

Unless they were to fence off the stored funds so that chch and wellington saw no benifit from my funds loaded to use in auckland, then I would be ok with sharing the network, but since they all seem to want to centralize the stored funds I think that separate platforms is best.

Richard rich.ms

radomatic

93 posts

Master Geek

#1551637 12-May-2016 17:43

richms:

Geektastic:

Presumably I am not the only person who thinks that Auckland, Wellington and Chch all using different systems for paying for transport is as mad as a box of frogs?

Unless they were to fence off the stored funds so that chch and wellington saw no benifit from my funds loaded to use in auckland, then I would be ok with sharing the network, but since they all seem to want to centralize the stored funds I think that separate platforms is best.

Out of interest, what do you see as the issues with centralising the funds? I think there would be great benefits to a shared system, but I just am not convinced sharing the funds is the right thing to do.

richms

28168 posts

Uber Geek

Trusted

Lifetime subscriber

#1551646 12-May-2016 17:57

radomatic:

Out of interest, what do you see as the issues with centralising the funds? I think there would be great benefits to a shared system, but I just am not convinced sharing the funds is the right thing to do.

Any profits from it should be going back into the network where its users are located, not building new stuff or upgrades in a totally different city.

Richard rich.ms

1 | 2