Halifax Transit got a little bit of good news on Thursday Nov. 2, with the launch of an electronic payment app called HFXGO. It can be downloaded in the Apple store or the Google one. Bus tickets bought with the app can expire before being used—that is a requirement of the software—but if you have an expired ticket on your phone you can call 311 and get it back.
There are two main concerns around the security of the app. The first is that it doesn’t have two-factor authentication. This means the information in the app, like credit card info, is not protected in a way that is considered a best practice in online security. The city says the later phases of this implementation will have tap pay.
The other security concern is whether or not a (free) screenshot of a ticket, rather than a (paid) electronic ticket, can be used to get on the bus. The answer here is almost definitely yes, for all the same reasons stop signs don’t work at 2am. The app tickets are designed to be hard to reproduce, with a constantly updating date and time that looks like this—11/03/2023 2:36:01–constantly moving on the screen. And there’s a QR code that changes every few seconds. If you try and record it this is what happens:
The next phase of this procurement process is the QR readers that will read the dancing QR code on the digital ticket. Councillor Waye Mason, fielding questions about his newsletter on reddit, wrote that the “validators start being installed end of the month (buses, ferry terminals). Should start seeing them this year. Will take a while (I believe like GPS they can wire four buses at a time). The back end (which is the hard part) is now in place for the app, they should start testing them by mid winter, and then pay by tap for the app is first, pay by tap ticket second, then open tap last. But it's all the same back end and validators, once it is installed it should move through all 3 phases pretty quickly.”
So right now, in the first phase of rolling out this electronic payment system that has been in the works for roughly 12 years, the app will work by having bus and ferry drivers look at a possibly forgeable image on a screen. In the coming SoonTM second phase, machines will scan those QR codes and any .gif forgery market that has popped up should disappear. And finally, once tap pay starts, the app and its QR codes won’t be needed anymore: You’ll be able to use your phone’s well-secured payment options, there will be no need to give HFXGO your credit card information and the app will eventually die, its short life a cruel mockery of Halifax’s ambitions to join the 21st century.
