The bus company that I use (Arriva UK) is trying to persuade passengers to switch from buying paper tickets to tickets stored on their app. They are particularly pushing this for 'bus passes': tickets that allow you to take any bus in a given area for a week, 4 weeks or 1 year.
Passes must be purchased in advance and are then displayed on exactly one device linked to your account. You can only switch device by e-mailing customer services.
When you open a ticket or pass in their app, it displays the time until ticket expiry and a QR code which changes every so often (so it's presumably a pass ID hashed with a timestamp). When you board the bus, your QR code is scanned (otherwise you must pay and claim a refund by e-mail).
However, you can only open a ticket or pass with a live Internet connection. At bus stops, this usually means using mobile data. Once the ticket is opened, you can usually access the ticket until you close the app (even without data), but you can't rely on this working.
This process regularly fails because passengers can't get a reliable data signal at every bus stop, as hundreds of reviews attest. It also forces you to buy an expensive data package, because if you run out of data you can't use your expensive bus pass either.
So why does the bus company insist on having a live Internet connection in order to use the pass?
I realize you might need a connection to download the pass once, but surely then the key that you need is stored? After all, smart cards don't have their own Internet connection and they are used for hundreds of millions of journeys every day.
I know that the bus company is worried about people trying to scan screenshots of someone else's ticket. I have been accused of doing this by a bus driver, when the problem was just that my phone couldn't get signal. Surely using a code that's a hash of passenger account number, IMEI (which is fixed since the pass is tied to one device), and timestamp would avoid any such attempt at fraud?§ That could be calculated both by the phone and the bus' QR scanner.
I am thinking about asking the local council (which subsidizes bus services) to try to get the app changed but want to campaign for something that's actually workable for both the company and passengers.
EDIT: The buses should all have an Internet connection, because they have free WiFi for passengers.
§ How tickets could be checked without a live Internet connection
- The phone app encrypts the account number and IMEI using the current timestamp (e.g. the current minute) and the bus company's public key and puts it into a QR code.
- The bus reader decrypts the code using the current timestamp and the company's private key.
- If the code decrypts to gibberish (malformed account number/IMEI), then reject (the timestamp must be wrong or its another bus company).
- If the code decrypts to a valid (correctly-formed) account number, compare it to the reader's internal database (updated whenever it does have a good data signal). If the account has a pass for this route and the correct IMEI then accept, otherwise reject.
- If the QR code is a screenshot, then the timestamp will be wrong (given the amount of time it takes to take and forward a screenshot).
- If the phone user's pass has expired, then it won't match the internal database. If the user is trying to use the same pass on multiple devices, then the IMEI won't match the database.
Isn't this sufficiently safe against fraud?