taint.org: Justin Mason’s Weblog

Apparently, Transport For London are planning ‘e-money’ trials based on their remotely-readable Oyster RFID cards.

Combine that with Kevin Mahaffey of Flexilis’ talk at Black Hat last year, where he demonstrated apparatus to extend RFID read range from 4-6 inches to approximately 50 feet, and things could get messy. ;)

The slides for that talk are available here (PDF); slide 20 specifically mentions the Hong Kong “Octopus” cashless-payment card.

Tags: flexilis, kevin-mahaffey, london, oyster, rfid

Tube Rules — lessons in London Underground etiquette. My favourite: don’t wear massive backpacks.

Dave Malone on broken time-sync software. It seems Tardis, the popular Windows time-syncing software, used HTTP to get a trustworthy timestamp. OK, that’s pretty bad — using TCP/IP against a webserver to try and get a usable time — it’ll be several seconds off in most cases, and is pretty suboptimal in general.

But at least they set up their own server, instead of glomming off someone else’s bandwidth and CPU, right? Nope — they used a server at maths.tcd.ie, along with only 2 others worldwide. And they used GET. And they didn’t send a User-Agent header. And the server wasn’t even a public time server since 1996 anyway.

All seems well now — Dave instituted a policy of returning ‘1999′ as the date, and hopefully everyone has noticed by now. ;)

Tags: etiquette, favourite, london, server, software, tardis, time, tube, underground, windows