The system is simple in design. The card reads via an IC chip inside. Because money cannot be refunded off a card, charging it effectively MAKES the money on the Suica side of things. The consumer is then given a choice of what resource to call forth because they have already paid. You as a consumer are merely making the decision as to what you'd like to do with the 'x product' you've already paid for, whether it be a train fare, beverage, snack, or item.
Suica doesn't function often in normal stores or as a debit card outside of the local areas around a train station. This ensures that you are likely still getting a product that is managed (read: quality control and brand approval) in some way by the corporation owning Suica/Pasmo cards.
You wouldn't expect to be racking up a considerable amount of charged money on merely beverages and snacks. The system is targeted towards commuters and travelers in the Tokyo area. Part of the functionality you are paying for, in essence, is that you are paperless and flexible. Which is everything nowadays. You don't save any money beeping through the gates on the cards moreso than slipping a paper ticket into the slot. But what you do save is time- time spent calculating your ticket amount, time buying tickets, and time entering and retrieving the paper tickets. Just charge it up and go at your own pace.
On the paper ticket side you have some pros and cons, but the card is just a harder push. One of the benefits of paper is for larger groups and the coupon ticket. For larger groups, say, tourists you wouldn't buy them all a card. That requires a 500 yen deposit in addition to a charge. The coupon ticket is a deal of 'buy ten, get one free.' That is exclusive to the paper system. Another advantage is that, as Suica requires a minimum re-charge of 1000 yen, paper tickets allow you to pay only the fare amount. So if you end up in a bind with a card and only have coins in hand, paper tickets are your best bet.
In general though, the Suica system has been carefully designed to be better in nearly all aspects. Whatever paper can do, Suica does it bigger and better. For example, while you can save money on paper by purchasing in bulk, you can apply a commuter pass to an IC card. It is line-specific from one station to another, inclusive. That means you can get on or off at any point on that line and it will be rendered a zero yen fare on the card. You can use that pass any time during the validated period it has been paid for and so save a large sum of money on lines you frequent.
Now the question this begs from a technological standpoint: How can the system be exploited? Here are a few thoughts on the matter. In analyzing security flaws in any human system you must track the connection from one end to the other. Earlier it was mentioned that charging is effectively the payment and relinquishing of the money. Anything after that is but mere redirection of the allocated funds. That leads to the first security wall.
How are cards charged? The charging transaction takes seconds irregardless of the amount. There is nothing printed on the card externally that reveals internal value. Any card on an arbitrary person could be valued from zero up to 10,000 yen in some cases. There could be names printed on the front but nothing prevents someone else from picking it up and using it til it bottoms out. Even if the owner traced the ID number through the Suica system, what would they find but many microtransactions along multiple train lines? Every train station has hundreds or thousands traveling through it each day. In summation, the cards on each person are expensive and unreclaimable assets. A swift take, if even just for the 500 yen deposit refund at the gate. Thankfully, Japanese people are not so conniving. These are the same people that would leave an iPod or a wallet on the same seat it was dropped while the train travels the entirety of its route. They may even run off the train at their own expense to hand it back to the owner. No, such discourse is but theory in the interest of the writer.
How would one exploit the charging system? An IC reader could perhaps tell you the amount on the card. Hacking will get you thus far as to change a few bytes and edit the yen amount on the card. Although, with such a glaring security flaw at step one in the consumer/corporation transaction, the antimeasures must be high. Hackers are limited only by time and code, but has anyone stepped forward to take the task? Who knows. If they have been successful, it goes unnoticed in the bustle of the station and the beep of the gate. The charging station is a box in a wall that takes in money and delivers change. The money inputted allows you to select yet higher and more expensive amounts as you like in multiplicty of 1000. At least programmatically, one should be able to replicate the charging box in some way.
After the charge, what else can be done but to spend away your hard-earned 'cash?' as all the transactions are done by touching the card to an appropriate IC panel, there's nothing further that can be done by the consumer besides more data modification (read: hacking). There are of course multiple points at which one could modify the chip's data. One possible avenue is to alter the code such that it will trick the gate or store readers into thinking the deduction has been made while maintaining an internal charge of null amount.
Other hacks may involve disassembling the card's plastic shell for analysis. Many Japanese use the card through their wallets since it need not actually touch the panel in use. No one will notice if the card has been modified slightly or taken out of it's plastic housing so long as it remains concealed within a wallet or purse. Perhaps it is only the chip that matters, and the printed serial number only for the eyes. The chip could be extracted and modified in a hardware hack. But again this would depend on the hacker's effort of time and understanding of IC code. People will go a long way in the name of free and open though. Who knows what may be procured in a quick google search on this matter?
Oh, the logistical mind. Written on a train from the airport over the course of one hour. Do not conduct evil from what is purely conjecture. Happy ponderings!
No comments:
Post a Comment