News for hackers. Stuff that matters.
Re:Activists release code to generate free public transporta... by erpellan on Monday September 02, 2019 @07:29AM (#20858422)
- Phone generates public/private key pair.

- Phone registers public key with backend during signup.

- Phone generates ticket signed with private key.

- Backend checks signed ticket against registered public key to charge customer.

Fraud is still possible but limited to individual customer accounts.

Re:Activists release code to generate free public transporta... by em-bee on Monday September 02, 2019 @10:31AM (#20859302)
can we expand this?

- phone displays the generated ticket to the ticket scanner in the bus. - the scanner connects to the backend to verify the ticket.

this way the phone can remain offline after registration, and only need to get online to send money for your account.

i see no way for possible fraud as in fact all the ticket is doing in that case is to verify your identity to the server.

now how can we do the same thing but without revealing your identity, but just verifying that you paid?

Re:Activists release code to generate free public transporta... by scruffyfox on Monday September 02, 2019 @11:20AM (#20859613)
third party ticketing machines typically don't have an internet connection hence why offline validation is needed