Santana Row shopping center in San Jose has implemented a ticketless parking system that eliminates the need for drivers to take a ticket upon entry and pay at a pay station upon exit. Instead, drivers can simply scan a QR code (see photo) posted throughout the garage using their phones, enter their license plate number and credit card information on the website that pops up, and a camera will read their license plate and open the gate as they exit. While this system may seem convenient and efficient, I think there is a significant security concern! There is a risk that perpetrators could replace the posted QR code with their own, which would redirect drivers to a fake website where they would unknowingly enter their credit card information. This could lead to unauthorized charges and potential identity theft. It is crucial for the shopping center to address this security concern by taking appropriate measures to protect drivers' personal and financial information. They must ensure that the QR codes posted are authentic and that there are no vulnerabilities that could allow perpetrators to manipulate the system. As an alternative solution, pay stations could be installed for shoppers to use instead of relying on their own phones.
Jon Innes in the comment above is spot on. How about they use NFCs? Inexpensive and Secure. And starting with iOS 18.1, developers will be able to offer NFC contactless transactions using the Secure Element from within their own apps on iPhone, separate from Apple Pay and Apple Wallet. My friend Jim Barlow from ST Micro can help.
My garage in San Matero has something similar but uses the pay to park app. Downloading the app if you're only parking one time if inconvenient but a lot more secure than the QR code. They also have a pay station.
Some garages let you pay with your credit card (or virtual card) by the exit. Requiring a phone or an app is overkill if you think about it. Someone should take a clean slate approach to designing this.
That's a valid concern about the potential security risks associated with the ticketless parking system. What measures do you think the shopping center could take to prevent tampering with the QR codes and protect drivers' sensitive information?
Founder & CEO - Protium
3moGreat insight Ming T. Lu. I completely agree that while this ticketless parking system and no need for an app is a convenience and is appealing, security must be at the forefront of the implementation due to payments being accepted. The scenario you mentioned with potential QR code manipulation/replacement is a real concern. It's essential for developers to anticipate these types risks and build in layers of security from the outset. I like the suggestion of creating a read only NFC tag in the chat, as most phones have the capability these days. This solution makes the attack surface smaller and barrier to entry for a threat actor a bit harder, however not impossible to do a similar replacement of an NFC tag for a small cost. There is always inherent trust that is required of the user and as developers we need to find creative ways to bring our products to market that limit the amount of trust needed by the user.