Honestly, this is a problem for a) The transit authority which implemented a broken system and b) the person who gets caught counterfeiting a card / riding for free.
It doesn't take much of a security expert to warn you that the system is insecure when you're implementing something which trusts the card (not a central database), and the protocol is proprietary and uses weak encryption (mifare is 48-bit or so?).
Implementing a system which trusts the card is just asking for trouble, certainly considering the amount of horepower your average commuters are carying around in their pockets nowadays.
Comments
Honestly, this is a problem for a) The transit authority which implemented a broken system and b) the person who gets caught counterfeiting a card / riding for free.
It doesn't take much of a security expert to warn you that the system is insecure when you're implementing something which trusts the card (not a central database), and the protocol is proprietary and uses weak encryption (mifare is 48-bit or so?).
Implementing a system which trusts the card is just asking for trouble, certainly considering the amount of horepower your average commuters are carying around in their pockets nowadays.