I used to go to a laundromat that used something like a smartcard to keep your balance. You’d refill it at the kiosk and swipe it at the washer/dryer.
I had a reader/writer around somewhere from a few years prior, when I was messing around with old Echostar boxes.
Wish I could have found it. Those machines didn’t look to be connected to anything. I didn’t see any wireless networks in the area and the equipment didn’t have any data lines.
I’m almost willing to bet the balance was stored as an value on the card and gets read/rewritten with every swipe, and essentially just security-through-obscurity. Meaning I could either back up and rewrite a $20 card forever, or rewrite the balance to having FF credits or whatever.
It could be simply obscure like you say, but the absence of a network doesn’t guarantee it’s that easy to hack.
They could use a checksum and your trick would invalidate the card until you figured out the correct algorithm, which would require a new visit to the laundromat for every new attempt, so basically impractical.
That or the card is just simply encrypted, which would make it impossible to interpret. It would be easy to implement too because the shared secret is between machines that are all physically controlled by the laundromat.
you could add a random number to the encrypted data on the card and require it to always be the same or larger than the last time that card was seen, and then increment it every time the card is used.
A simple encryption key would make the most sense. It wouldn’t even need to be that complex. All you would need is a way to verify the card and then another one that represents the number. You probably could just use some primes.
Well that’s the thing, you don’t need a lot. You’re handing out these cards and people walk out the door with them, so you can’t trust they’re not going to mess with them. They don’t need to be walking around with a writer, you need one person to have access - either own one or have one at work or a university lab - and they can make as many cards as they want to give to their friends. Then they could use your business for years and get thousands of dollars of free service without you ever knowing.
That’s the real threat here I think - a poor university student with a technical degree challenging themselves to cheat the system and help out their friends. I mean it’s probably not going to happen, but a business owner who’s aware of this attack vector could spend the time to get a basic encryption system going that’s practically unbreakable.
There also is a point of cost. They aren’t going to spend a bunch of money securing a laundromat. If they spend a bunch of money left and right your laundry fees would be pricy. Not to mention a laundryman isn’t exactly a high profit business.
I agree with the first part of your comment, but laundromats are absolutely a high profit business.
source: family friend owns a bunch of them, every single one was net profitable inside of a few months and they are now basically pure profit month over month. They make more money than I ever have from a single software development job, even at my peak, and they largely just farm maintenance out and pay some labor.
I used to go to a laundromat that used something like a smartcard to keep your balance. You’d refill it at the kiosk and swipe it at the washer/dryer.
I had a reader/writer around somewhere from a few years prior, when I was messing around with old Echostar boxes.
Wish I could have found it. Those machines didn’t look to be connected to anything. I didn’t see any wireless networks in the area and the equipment didn’t have any data lines.
I’m almost willing to bet the balance was stored as an value on the card and gets read/rewritten with every swipe, and essentially just security-through-obscurity. Meaning I could either back up and rewrite a $20 card forever, or rewrite the balance to having FF credits or whatever.
It could be simply obscure like you say, but the absence of a network doesn’t guarantee it’s that easy to hack.
They could use a checksum and your trick would invalidate the card until you figured out the correct algorithm, which would require a new visit to the laundromat for every new attempt, so basically impractical.
That or the card is just simply encrypted, which would make it impossible to interpret. It would be easy to implement too because the shared secret is between machines that are all physically controlled by the laundromat.
If there’s no central control or ledger, couldn’t you just rewrite the card with the original values and the machines wouldn’t know any difference?
Oh yeah, that’s true, so you wouldn’t have destroyed the card, but it’s not a useful hack if they’ve done even the most basic security measures.
That said, I would be fascinated to know what was on that card. I’d give it pretty good odds of having absolutely no security measures whatsoever.
you could add a random number to the encrypted data on the card and require it to always be the same or larger than the last time that card was seen, and then increment it every time the card is used.
A simple encryption key would make the most sense. It wouldn’t even need to be that complex. All you would need is a way to verify the card and then another one that represents the number. You probably could just use some primes.
I mean how many people are gonna be walking around with card rw
Well that’s the thing, you don’t need a lot. You’re handing out these cards and people walk out the door with them, so you can’t trust they’re not going to mess with them. They don’t need to be walking around with a writer, you need one person to have access - either own one or have one at work or a university lab - and they can make as many cards as they want to give to their friends. Then they could use your business for years and get thousands of dollars of free service without you ever knowing.
That’s the real threat here I think - a poor university student with a technical degree challenging themselves to cheat the system and help out their friends. I mean it’s probably not going to happen, but a business owner who’s aware of this attack vector could spend the time to get a basic encryption system going that’s practically unbreakable.
There also is a point of cost. They aren’t going to spend a bunch of money securing a laundromat. If they spend a bunch of money left and right your laundry fees would be pricy. Not to mention a laundryman isn’t exactly a high profit business.
I agree with the first part of your comment, but laundromats are absolutely a high profit business.
source: family friend owns a bunch of them, every single one was net profitable inside of a few months and they are now basically pure profit month over month. They make more money than I ever have from a single software development job, even at my peak, and they largely just farm maintenance out and pay some labor.
Yeah, laundromats are hard to beat, because your only real operating costs are bills and maintenance on the machines.