Re: Thanks for the antipodean information...
Because it's to do with the rules. It matters not a jot if the principle is the same, it matters if the rules are being followed. It matters if the TICKET is valid not if the fare has been paid. The fare having been paid is part of but not the same as the ticket being valid. How many ways can I put this?
That's the thing really, the idea of validity is simply down to the rules and, as you mention can come down to silly stuff like having an avocado. I was going to suggest only valid if whistling La Marseillaise, but Virgin have provided us with an equally ridiculous example. Let's assume in this case the guy was convicted because he didn't have the hallowed plastic surround to the NFC chip, it's not a very interesting question whether or not he did. What is an interesting question is why did they bother going to this trouble? I mean, there's no suggestion he hadn't paid the appropriate fare, why care about the letter of the rules for ticket validity in that case?
There are a number of possibilities. Maybe the transit authority can't actually validate the information on the chip, and rely on the card to say you have a right to be on the journey? That brings me back to the Oyster example, I could trivially (but unconvincingly) fake an Oyster card by cutting out a card from a cereal packet and writing "Oystur" on it in blue crayon. This would obviously not be very useful. I could also obtain a genuine card for £5 from any ticket machine. An inspector looking at this card cannot say it's not genuine, and there is no information recorded on the card directly connected to my journey, though I assume it's possible for someone to look up the serial number in the system. But in practice they hardly ever see the cards they validate with a reader, my Oyster is always in a card holder. Obviously if the card doesn't read then we are into the situation of someone trying to blag that they did pay a fare they didn't, but if it does, why care about the surround?
That brings us to possibility number two, the system isn't secure. But for the authenticity of the card to matter (I'm assuming the validity rules are for some rational reason rather than just to provide jobs to clause fetishists) it requires the system to be insecure in a particular way: it is secure enough I can't reprogram or top up the chip in the card, but at the same time uses a system where a different chip that I do control could spoof a genuine one. I can't think of many ways that could come about, except for the card simply reporting an id that's checked against a database or only accepting updates accompanied by some form of credentials.
Biting the hand that feeds IT
