The tiny chip that powers Montreal subway tickets

Original Article ↗ Hacker News Discussion ↗

NFC ticket technology & security

  • Montreal’s disposable tickets use MIFARE Ultralight EV1, a very simple ISO 14443A chip with a signed UID and limited memory; backend systems typically treat it as a bearer token.
  • More secure families (MIFARE DESFire, Ultralight C, Felica, etc.) store cryptographic keys in tamper‑resistant hardware and support mutual authentication and encryption.
  • Ultralight has a password mechanism; some argue this meaningfully raises the bar for cloning, others note you can harvest the password mid‑transaction and then clone, so backend checks and duplicate‑use detection remain important.
  • EMV contactless payments sit on the same RF stack but are account‑based; transit cards are usually stored‑value, enabling fast offline operation and resilience to network outages.

Manufacturing & chip design

  • Chip is built on an older ~180 nm process; the die is grain‑of‑salt sized, with ~45k transistors and an analog front‑end for RF power and load‑modulation.
  • Wafers are thinned (back‑ground) to tens of microns, diced with ~20 µm saws, and dies picked with automated handlers down to ~0.2 mm.
  • UIDs are programmed and permanently locked during wafer test; other EEPROM areas can be one‑way locked and support anti‑tearing counters via indirection schemes.
  • Antennas are typically printed conductive ink or etched metal on plastic; details are mentioned but not deeply explored.

Transit systems, UX, and latency

  • Many systems cited: DESFire (Clipper, Oyster), MIFARE Classic/Plus (Boston, Moscow), Felica (Japan, Hong Kong), Calypso (Montreal OPUS), EMV‑based (NYC OMNY, London, Sydney).
  • High throughput at gates drives design: RFID/NFC taps (~100–500 ms) are preferred over magstripe and QR, which are seen as slower, less robust, and more angle/lighting‑sensitive.
  • QR is viewed as attractive for cost and flexibility, but problematic for offline use, multi‑ride tickets, and fast gates; some cities (e.g., parts of China, India, Japan soon) still pursue QR with heavy backend infrastructure.
  • Phones and wearables as transit tokens: Apple uses a secure element and “Express” mode; Android widely supports Host Card Emulation, though without hardware security by default.

Cost, waste, and policy

  • Per‑chip prices around a few cents; some argue mechanical mag readers and maintenance cost more than the electronics.
  • Debate on e‑waste: some see single‑use ICs and antennas as unjustifiable; others note the mass per ticket is tiny and most frequent riders use reusable cards.
  • Privacy concerns around bank‑card tap‑to‑ride and account‑based systems are raised; others point out many systems still allow anonymous stored‑value cards or cash‑bought disposables.
  • Several commenters advocate free or flat‑rate public transit to eliminate fare technology complexity and reduce transaction friction entirely.