Subject: We need to deliver the whole solution

From: Phillip Hallam-Baker <[email-masked]>
Date: Tue, 22 Oct 2019 10:30:47 -0400

This story is happening a lot and not just in the UK. Transit system uses
mobile for payment. Rider's phone dies, is arrested for not having a ticket.

https://metro.co.uk/2019/10/21/boy-handcuffed-police-phone-dies-cant-pay-tube-10956494/?fbclid=IwAR15m1l2V70jKYKxonkpZ05vs8eJcqN5qk-mPF-ozkB4k7E_hXncAApylwk

The problem here is responsibility. Nobody is taking responsibility for the
whole system so responsibility for the system failure lands on the user.

It is never, ever the user's fault.

The phone maker didn't tell the transit system they could use it for this
type of payments scheme (only they did actually). The transit system didn't
think about the consequences of a broken phone.

There is actually a simple fix possible: Put a QR code onto the phone case
that can be scanned even if the phone itself is dead. This can then be used
to provide a 'last resort' ticket if the user opts in to the potential
privacy issues (though anticipating these should mean they can be mitigated
so as to be no worse than for a paper ticket).

QR code binds to DNS name and a symmetric encryption/authentication key.
This provides the necessary bootstrap to obtain needed information.

Alternatively, the user can print out the QR code and put it in their
wallet or print it onto a sticker that can go onto the phone.

Over the past 36 months, there has been a change in the wind. Big tech is
no longer so popular. We are no longer regarded in the same light as ten
years ago. People are starting to see the downside to the brave new world
we have imposed on people. If we are going to keep the support of the
people, we have to acknowledge and fix the problems we are creating.

Twenty odd years ago, an un-named Apple executive had a temper tantrum in a
parking lot after realizing they had forgotten to bring the 240V adapter
they needed for the trip. In an instant, they realized that the adapter
should work in any country. That is the adapter should actually adapt
rather than the human. We need to bring that type of thinking back and
apply it to what we have wrought.

Yes, the technical solution I proposed above is based on a Mathematical
Mesh technology (BOF Friday, Singapore). But the MathMesh is merely a
rebranding of the technologies we should be delivering but for some reason
or other failed to provide. It is there to provide an existence proof that
we can do better.

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Tue, 22 Oct 2019 16:37:48 +0200

There is a simpler solution.

Having the authorities to be able to track the payment from their system. I think it is quite obvious it should be that way.

Is not me the one that I need to probe that I’ve not paid, this is law, at least in many countries as I know. If it was a printer ticket, but I lost it, or it has been stolen, I can’t be arrested, they need to probe that I’ve not paid it. If I paid with a credit card or an equivalent system, the Metro system needs to keep a copy of that transaction, not just my bank!

If the system doesn't work well, clearly is not the responsibility of the user.

Regards,

Jordi

@jordipalet

El 22/10/19 16:31, "ietf en nombre de Phillip Hallam-Baker" <[email-masked] en nombre de [email-masked]> escribió:

This story is happening a lot and not just in the UK. Transit system uses mobile for payment. Rider's phone dies, is arrested for not having a ticket..

The problem here is responsibility. Nobody is taking responsibility for the whole system so responsibility for the system failure lands on the user. 

The phone maker didn't tell the transit system they could use it for this type of payments scheme (only they did actually). The transit system didn't think about the consequences of a broken phone.

There is actually a simple fix possible: Put a QR code onto the phone case that can be scanned even if the phone itself is dead. This can then be used to provide a 'last resort' ticket if the user opts in to the potential privacy issues (though anticipating these should mean they can be mitigated so as to be no worse than for a paper ticket).

QR code binds to DNS name and a symmetric encryption/authentication key. This provides the necessary bootstrap to obtain needed information.

Alternatively, the user can print out the QR code and put it in their wallet or print it onto a sticker that can go onto the phone.

Over the past 36 months, there has been a change in the wind. Big tech is no longer so popular. We are no longer regarded in the same light as ten years ago. People are starting to see the downside to the brave new world we have imposed on people. If we are going to keep the support of the people, we have to acknowledge and fix the problems we are creating.

Twenty odd years ago, an un-named Apple executive had a temper tantrum in a parking lot after realizing they had forgotten to bring the 240V adapter they needed for the trip. In an instant, they realized that the adapter should work in any country. That is the adapter should actually adapt rather than the human. We need to bring that type of thinking back and apply it to what we have wrought.

Yes, the technical solution I proposed above is based on a Mathematical Mesh technology (BOF Friday, Singapore). But the MathMesh is merely a rebranding of the technologies we should be delivering but for some reason or other failed to provide. It is there to provide an existence proof that we can do better.

**********************************************
IPv4 is over
Are you ready for the new Internet ?
http://www.theipv6company.com
The IPv6 Company

This electronic message contains information which may be privileged or confidential. The information is intended to be for the exclusive use of the individual(s) named above and further non-explicilty authorized disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited and will be considered a criminal offense. If you are not the intended recipient be aware that any disclosure, copying, distribution or use of the contents of this information, even if partially, including attached files, is strictly prohibited, will be considered a criminal offense, so you must reply to the original sender to inform about this communication and delete it.

---

From: Alexandre Petrescu <[email-masked]>
Date: Wed, 23 Oct 2019 15:51:49 +0200

Le 22/10/2019 à 16:30, Phillip Hallam-Baker a écrit :
> This story is happening a lot and not just in the UK. Transit system
>  uses mobile for payment. Rider's phone dies, is arrested for not
> having a ticket..
> 
> The problem here is responsibility. Nobody is taking responsibility
> for the whole system so responsibility for the system failure lands
> on the user.
> 
> The phone maker didn't tell the transit system they could use it for
>  this type of payments scheme (only they did actually). The transit 
> system didn't think about the consequences of a broken phone.
> 
> There is actually a simple fix possible: Put a QR code onto the phone
>  case that can be scanned even if the phone itself is dead.

Sounds reasonable solution, but could be it attacked?

  This can then
> be used to provide a 'last resort' ticket if the user opts in to the
>  potential privacy issues (though anticipating these should mean they
> can be mitigated so as to be no worse than for a paper ticket).
> 
> QR code binds to DNS name and a symmetric encryption/authentication
> key. This provides the necessary bootstrap to obtain needed
> information.

I am not sure how authentication would protect here.  What are the
credentials?

On my side, I think the transportation systems (metro, bus, pods) are
places where one wants to move as smoothly as possible.  The technology,
under the forms of smartphones, are actually hampering that smoothness,
because of communication latencies and attention drawn to screen. (CPU
latency is not an issue).

The fastest way to get through the transportation system where I live is
to plan it carefully, carry the precise amounts of paper bills ($,
"fermesse") and coins, know the locations of counters, etc.  The
smartphone as a magic wand only impedes all that, precisely because of
its universality.  It is good to so many other things, that it has
trade-offs for transportation.  If one wants a wand, then that would
have to be a smartphone more specific to transportation, which reflects
the battery issue you mention above, and a few others, that I barely
touch upon below.

Consider that the smartphone can get one much information about the
traffic at a station, but the most reliable information (most recent,
most authoritative) is the information displayed on the screens of the
station, or told on a local loud-speaker.  In many cases that
information is contradictory to the smartphone's.  Why cant the
smartphone talk to the station's display or listen to these local speakers?

Consider that the smartphone is what might get one injured, if one
listens to its audio while walking astray on road spaces dedicated to
cars.  The Bluetooth noise-cancelling headphones are very good while
flying between continents, but are very risky to their carrier safety,
completely ignoring electric cars who, for their part, are mandated by
legislation to _add_ sound to their silent engine.  Why dont smartphones
implement V2X technology?

Alex

> Over the past 36 months, there has been a change in the wind. Big
> tech is no longer so popular. We are no longer regarded in the same
> light as ten years ago. People are starting to see the downside to
> the brave new world we have imposed on people. If we are going to
> keep the support of the people, we have to acknowledge and fix the
> problems we are creating.
> 
> Twenty odd years ago, an un-named Apple executive had a temper
> tantrum in a parking lot after realizing they had forgotten to bring
> the 240V adapter they needed for the trip. In an instant, they
> realized that the adapter should work in any country. That is the
> adapter should actually adapt rather than the human. We need to bring
> that type of thinking back and apply it to what we have wrought.
> 
> Yes, the technical solution I proposed above is based on a
> Mathematical Mesh technology (BOF Friday, Singapore). But the
> MathMesh is merely a rebranding of the technologies we should be
> delivering but for some reason or other failed to provide. It is
> there to provide an existence proof that we can do better.
>