Does scanning a ticket at a barricade make it invalid?

[sor]

Why?

why not? paper tickets are readable by anyone, shouldn't e-tickets and ITSO also maintain readability? At least with ITSO there are apps to do so, some TOC apps even provide it, though you can't see anything not stored on the card (eg any notes that relate to a specific ticket).

There are other such examples, like passports where there are no shortage of apps that can read the chip and show you what's on it, no different to what the border guards can see. The UK gov even released its own such app at one point.

 

[OscarH]

They aren't required to do that because they're a private company, and not subject to the Freedom of Information Act (otherwise you could just ask). Having the public keys is necessary to read the ticket content at all, but having them doesn't let you make your own tickets (you need the private keys for that, which are only given to the individual ticket issuers).

Accordingly, there's no risk to the security of the system if the public keys were made public — it only means that people can't read the content of their own tickets, which I think is a bad thing!

(The RDG also don't publish any documentation on how the barcodes work, which I also think is bad; however, I was able to figure that out myself without them last year. There's a writeup about that here: https://eta.st/2023/01/31/rail-tickets.html)

Indeed, everyone loves a bit of security theatre. I don't off the top of my head see anything in the payload that would help fare evaders/isn't already printed on the ticket or displayed at the point of purchase, really it would just benefit nerds that like to look at what it contains really the same as 3rd party ITSO apps, which seems more than fine to me.

 

[pedr]

The particularly useful data is surely whatever is recorded in railway databases and associated with the ticket number, rather than the information actually encoded within the barcode. In particular (and somewhat relevant to this thread) as far as I can tell, a passenger can't find out whether they've scanned a ticket, and they can't see anything railway staff might have noted after a scan. There are, presumably, reasons for that in particular to reduce fraud, but passengers with multiple period return tickets in the same digital wallet, passengers who think they might have scanned the wrong ticket by mistake but can't be sure, and passengers who are told that they've been given permission to travel in some way other than their ticket's validity but can't prove it aren't well served by the current set-up.

 

[HurdyGurdy]

In particular (and somewhat relevant to this thread) as far as I can tell, a passenger can't find out whether they've scanned a ticket, and they can't see anything railway staff might have noted after a scan.

The theme of the thread concerns the validity of an e-ticket, depending on where and when it has been scanned. It's the data records associated with those scans which are most relevant, not the information encoded into the barcode on the ticket itself. A passenger cannot see those data records so they have no ability to question any interpretation railway staff may wish to put on them. And, because the barcode is intentionally not copy protected, a passenger cannot even know if someone else has a copy of their ticket and the data records relate to their use of it.

When it's the passenger's responsibility to make sure they have a valid ticket before they board any train, they need the ability to access and understand the underlying scan history of the e-ticket they hold.