it's still the case that error codes reported by the magnetic stripe reader are
being used as peoples' card hashes.  this means that a random person swiping a
random card can get access to omni if the error code matches that hash.

since the data from the card reader is scrambled and randomized, there's no
easy way to discern "ERROR - CARD NOT READ" or whatever it's trying to say from
")!#@@@449492837203804720_05/20_" or whatever a normal card would be reporting.

substack and i tried to fix this a while ago by counting the number of bytes
coming from the reader but it wasn't enough.  so blah, now everybody here knows
and so if you care to look into it we can do that.

-jake
_______________________________________________
access mailing list
access@lists.sudoroom.org
https://sudoroom.org/lists/listinfo/access