The Leap Card Thread

[24Green]

Any update on the capping? Which operator, daily or weekly capping etc. Also how is the auto topup coming along too? Thanks.

[Colm Moore]

Originally Posted by 24Green

Any update on the capping? Which operator, daily or weekly capping etc. Also how is the auto topup coming along too? Thanks.

We hope to get a list of indicative dates for each upgrade. However, it will be some time yet.

Each operator is likely to have capping along the lines of their existing products and there is likely to be some form of cross-operator capping.

[IckyThump]

are there any long term plans for making the leap card a national thing? i do think it would be a great idea for people who use public transport alot

[Mark Gleeson]

There are studies underway for Cork.

[Locky]

Just tried to top-up my Leap card for the first time only to discover that I can't do this online! I use my card on Dublin Bus so I have to select the Payzone retailer that I want to 'collect' my top-up from ...
Please select the load location where you wish to collect your Top Up. Note, while we endeavour to allow your Top Up to be collected within 24 hours, in some cases it may take up to 48 hrs.
I was able to purchase the initial card and credit amount online but now I have to go to a retailer to top-up. This is an absolute farce. If this is the top-up system it is already antiquated. Who in their right mind set up a system in 2012 that operates like this.

[Mark Gleeson]

Every smartcard system in the world works like this. The card can only be updated if it comes into physical contact with a reader

Where you travel by Irish Rail or Luas the top up is applied when you tag on/off and is seemless as far as is possible to the end user

Collection on a bus is not supported and technically is not possible in a city the size of Dublin. London doesn't support it either.

Auto top up will be available in 2012 which will work on all operator but will require that you register an Irish bank account for direct debit payment

[Dubhaltach]

Is anyone else getting error 002 when trying to register a card online? Tried it over the space of few weeks and on three different laptop's, nothing.

[Colm Moore]

Have you been able to register your account OK?

Are you inputting the numbers strictly in accordance with the instructions - I think you are mean to leave out the last number.

[seamus kilcock]

Very interesting discussion on Joe Duffy/RTE just now.

[Locky]

Just listened back to the Joe Duffy show it makes very interesting listening and makes me very concerned for a number of reasons but here's one that I think will surprise everyone:
RTÉ staff need to swipe their staff ID card to use photocopiers. Joe Duffy inadvertently swiped his Leap Card at the photocopier and hey presto it brought up his name and allowed him to use the copier! Seems like Leap Card is using a highly secure encrypted system...not!

http://www.rte.ie/radio/radioplayer/...02%2 D2012%3A

[markpb]

Originally Posted by Locky

Joe Duffy inadvertently swiped his Leap Card at the photocopier and hey presto it brought up his name and allowed him to use the copier!

I don't understand how this, of all the possible things that people could complain about, is getting so much air time. Who knows or cares. Why do people think it's any reflection on the security in use on the card? Why not criticise the photocopier?

If nothing else, how do you think the photocopier got his name from his Leap card when it isn't on the card? You can walk into any Payzone shop and buy a Leap card anonymously.

If we could focus on the terrible implementation on Dublin Bus or the slow deployment of features, it might be more productive than a photocopier in Montrose.

[Dubhaltach]

Originally Posted by Colm Moore

Have you been able to register your account OK?

Are you inputting the numbers strictly in accordance with the instructions - I think you are mean to leave out the last number.

Rang up leap card support and found out that the solution to the issue is to register it, let it fail, then in 24 hours do it again. However then I mentioned it was a personalised card and she said that they can't be registered! Accordingly if I lose it I can still conact them as they have my name and number on file, I just won't be able to top-up or view my history.

[Inniskeen]

Ok, lets assume its not a photocopier, but something else that grabs the contents of your E-purse. Imagine the hassle of getting a refund !

Maybe it is not much an issue, but it might indicate a deficient design in respect of security and if so, it may well be serious. It may be serious anyway as it indicates a poor system of authentication. The Leap card should only share info with an authenticated and authorised device.

Remember electronic voting, if Joe Public thinks its a substandard system then your system might end up in long term storage !

Maybe a simple ticket valid for a specfied period of time, say 90 minutes might have covered off most of the requirements from a user point of view.

[markpb]

Originally Posted by Inniskeen

Ok, lets assume its not a photocopier, but somethink else that grabs the contents of your E-purse. Imagine the hassle of getting a refund !

There's absolutely no proof that a) it happened, b) the photocopier managed to get his name from his card (which doesn't store your name) or c) that there's any security implications at all.

Remember electronic voting, if Joe Public thinks its a substandard system then your system might end up in long term storage !

The difference here is that an expert group proved beyond proof that the electronic voting machines were unaditable and had security issues. All we have here is Joe Duffy and a mind reading photocopier.

[Inniskeen]

I have no idea whether it happened or not, maybe its the photocopier's fault - it could have had Joe Duffy's details in its buffers and rather than reject the Leap card simply dispayed the contents of the buffer.

A few simple tests should be enough to establish whether there is an issue or not.

[Locky]

Originally Posted by markpb

There's absolutely no proof that a) it happened, b) the photocopier managed to get his name from his card (which doesn't store your name) or c) that there's any security implications at all.

b) When you register your card it stores your name and
c) I personally feel there are huge security implications if the photocopier can garner data from your Leap Card! Am i on my own here with these concerns?

[James Howard]

It is also quite possible he had the RTE card close enough to be read and it just appeared that it was reading his leap card.

I keep my Dublin Bikes card in the same wallet as my train pass and oddly enough I can take a bike using my train pass.

[robdrysdale]

Originally Posted by Inniskeen

Ok, lets assume its not a photocopier, but something else that grabs the contents of your E-purse. Imagine the hassle of getting a refund !

This is Troll Duffy rubbish. Leap Cards are secure encrypted cards in a similar way to SIM cards on your mobile. You'd need the key to decrypt and communicate with the epurse. RTE do not have the key so cannot possibly communicate with the epurse.

[plant43]

Originally Posted by Locky

b) When you register your card it stores your name and
c) I personally feel there are huge security implications if the photocopier can garner data from your Leap Card! Am i on my own here with these concerns?

It's my understanding that the card does not have your name, only the card number and the credit. The linking between the card number and the personal only happens at the frontend (i.e the website). The backend systems have no personal details. I'd be interested if I'm wrong though.

[Mark Gleeson]

The card hold no names, addresses etc.

You need a special encryption key to read the card, however a very small amount of information is publicly available in read only mode, basically the card type and serial number

The access control in my office will beep as normal if I present an Irish Rail card instead of my staff card won't open the door though.