Arriva cellphone tickets let mobiles keep you mobile
Passengers travelling on an Arriva bus can now pay with a wave of their mobile phone, without recourse to NFC, RFID, or any equally high-tech solutions. The system deployed by Arriva uses a Java client on the phone to sell tickets to the passengers using a credit card or at a PayPoint outlet, the ticket can then be activated on …
Anyone else looking forward to having to hand over their phone to accounts to get paid your £2.40 bus ticket expense?
wow. a measured, sensible system with a low-tech way of spotting simple forgeries. great stuff!
This is all very well, but how much money will you waste when it all goes wrong?
Stagecoach have a service here in Exeter to text the code on the bus stop for bus times, it is free to text (as they broadcast) but costs for the return text (okay, only 0.27p, but they don't tell you that).
Using the code on my closest stop only results in a text back telling you that it's an invalid code, and you get charged for the pleasure of a lecture telling you to enter the code on the stop!
Icon due to bad pun and the fact that Stagecoach put their prices up so regularly
that we can show potential muggers what phone we have on us WHEN we get on the bus, as opposed to wasting their time after getting clobbered with a 2x4 only to find a Nokia 2210 with no battery or sim card, 50 yards away from the bus stop.
One to take the picture of the other in order to add to my ticket collection!
Not an over the top solution looking for a problem to solve. Basic, but does the job. Even if it was high tech it probably would have been broken just to prove that it could. By using a low tech method for something which has a low intrinsic value (bus tickets aren't as expansive as £1000 train tickets - yet) there is no need to try and break the tech for criminal purposes - not worth it.
Once you know the colour of the day, what else is there to spoof? If there's a group of people travelling together, they can club together to buy one ticket and then use the clone application (which will surely be written if things really are that simple) to duplicate it on the phones of the rest of the group.
They're selling this as being more convenient than using cash.
So how does that work then?
You pre book your ticket, board the bus and show the phone to the driver, he then presumably has to check something to verify the ticket - otherwise people would be forging the screen in no time flat. That sounds more complicated than just handing over a few coins.
Another case of a company rushing into a technological solution that's actual more complex than the system it replaces?
"Arriva tells us that the combination of a clock ticking away, along with animated Arriva symbols, would make the ticket hard to forge, and that drivers would be advised of that day's colour (orange in the example, top right) to make things harder for the would-be forger."
Java apps are trival to reverse engineer, so your ticking clock and and animated arriva symbols are absolutely not hard to forge. In fact, you wouldn't even have to forge them, just modify their app.
As for the colour... well, that just sound impossible to work around!
I mean, good god, a simple, low-tech solution doesn't mean it has to be full of gaping security holes.
They might as well just use a lie detector and ask the passenger if they've bought a ticket.
Now that could be a problem too (though traffic lights might be more of an issue)
Details like getting reimbursed by accounting, or not wanting to leave a digital trail, or inability to prove I bought a ticket if the phone suddenly runs out of juice, or not being able to buy a ticket at all if the phone up and dies or better yet, the phone company suddenly develops "technical problems" and takes a week to fix it (hello vodafone; their nosedive took the entire tram service with it too). So, as a computing professional I say:
I'll take a real ticket in return for some real cash, thanks.
National Express coaches have been selling e-tickets for a while. Having bought the ticket on the web, you download it to your phone and then display it to the driver. If its a ticket for a specific time, the driver has a printed manifest to check you off against. If its some kind of open ticket, the risks are higher.
think the article misses the point.....it doesn't need to be high tech....yet, but an interim whilst the world waits for low-cost NFC. The best solutions are the simple ones. The m-ticket also has a security code that changes each and every minute, so be interesting to see how you can spoof that? I tried it on my phone and it's so simple, but that's probably going to disappoint the techno-geeks and the consultants!
Sign up, sign up for The Register's weekly mobile & wireless newsletter - click here
