We hear about it all the time, people's social profiles are taking over by hackers. It is fairly simply done. Find a way to get people's username and password, login, change their login credentials, and voila. The attacker now has complete control over peoples profiles, and there is nothing they can do about it.

Just a few days ago, the musician Jason Mraz's Twitter account was taken over, and because the attacker changed his password, he could not do anything to stop them - apart from trying to contact Twitter and persuade them that this really was his account, and that someone else was in control of it.

As he wrote (on Facebook): "**IMPORTANT** someone has hacked into Jason's twitter account. Don't believe anything that is tweeted until we have access back into the account!"

Then today, United Airlines lost their Twitter account.

But here is the thing. It is amazingly simple for app developers to prevent this sort of thing. That is. You cannot prevent people from losing their username and password, but you can prevent that in doing so, they also lose control of their profile.

Here is what you do:

When anyone tries to change either the username, password or email address, send an email to the existing email address with the following message.

This way, it would be impossible for an attacker to take over your account, because you would always be able to change it back to you. Even if an attacker changed your password, email, or username, it could all be reversed by a simple following the link. And because this link would always be sent to the email on file before it was changed, you would always be in control.

It is really that simple - one email, with an "undo" link.

...something that every web app should implement by default.

- Read Comments

The OV-chipkaart is the new ticket system for Dutch public transport, using RFID cards, similar to Hong Kong's MTR (metro) octopus card.

In the past year several regional transport organizations (bus, tram, subway) as well as the Dutch railways have introduced the new system. The old ticket system for bus, tram and subways (the strippenkaart) will - and in some cases has been - phased out. So in some cities, the only way to get on public transport is the OV-chipkaart, and in the future it will also be the only alternative on the trains. You can choose between an anonymous rechargeable card, an anonymous single use card, and you can activate the chip in your reduced fare card.

For those of you that have been to Hong Kong, and seen the MTR's version of this at work, may think what the issue is here. Well, the issue is that the OV-chipkaart as its implemented now has some serious flaws from the user perspective. Consider it an interesting exercise in how not to create acceptance for a new system.

Single fare ticket more expensive
On the trams and buses you can only buy cards that allow you to travel for an hour, at a price of 2,60 Euro. Previously, going from my house to the railway station with a ticket I bought on the tram (already at a premium price) was 1,60 Euro. This is especially annoying for tourists. The argument from the transport agencies is: "Yes, but you can travel on it for a whole hour." Right, I wanted to quickly get from one place to the next to... get on another tram and travel for an hour?
The transport agencies initially pledged that the average fare would not be higher as a consequence of the introduction of the OV chipkaart, but in a number of cities an average increase of 5 to 10% was found. Politicians now are considering to wait with phasing out the old ticket system before this is fixed.


The price of the single fare ticket would not have been such a problem if there would have been the option to charge your card at bus and tram stops. Which is not there. So if your personalized or anonymous card is empty, the only alternative you have is to buy the incredibly expensive ticket on the tram or bus.

Activating a personalized card: absolute horror
A lot of people in The Netherlands have the aforementioned reduced fare card, as it gives a 40% discount on train travel outside of morning rush hours. This card has to be activated to be used as an OV-chipkaart. To do so you must make an account at the OV-chipkaart website. They chose to word activating the card as 'buying a product in the webshop'. You 'buy' the product 'activate my chipcard'. But then the card is not yet active. You have to 'collect your product' at a ticketing machine or service desk. A choice you have to make on the website. The whole procedure is just wrought with systems-thinking. Or an attempt at thinking from the user perspective gone horribly wrong.
Most problematic, the website is the only way to activate your card, and the procedure is far from clear. I've spoken to several people whose (somewhat elderly) parents no longer travel on buses and trams, as they found buying and charging an anonymous card too complicated. We're talking about a user group of which some find taking money from an ATM machine uncomfortable, and we're asking them to virtually transfer money from their account to a card. I think that very few of them will be activating their personalized OV-chipkaart if the system remains as is. What we in politically correct terms would call 'technology averse' people should be able to simply go to a service desk and get help to activate the card. Especially because this is a group of people for whom public transport can be the only way of getting around.

Activating automatic credit refill
If you have an activated personalized card, you can automatically transfer money from your bank account to your OV-chipkaart if you buy the 'automatic refill product' at the aforementioned website. I had to 'buy' this product three times before it finally worked. And both previous times I did receive a confirmation that 'my product' was ready to pick up. Went to the station to collect my product: no product.

Train travel: forgetting to check out
At this time, for train travel you can still choose between the OV-chipkaart and regular tickets. This phasing-in approach has the disadvantage that there are no turnstiles at the entrance and exit of the station, as people with regular tickets need to be able to enter and exit as well. And here's the catch: in Hong Kong you cannot exit the station without swiping your card. In the Netherlands you can. And if you exit without checking out you will be charged a maximum of 20 Euro. Of course, on buses and trams there are no turnstiles as well, but there the maximum amount you will be charged is 4 euro. To remind people to check out the Railways have added all kinds of signs and at regular intervals announcements are made on the train and station. The thing is: if the penalty is 20 euro, you should not be able to exit the station without checking out. To quote Krug: don't make me think.

Same device for checking in as for checking out
There are two types of devices for checking in and out. There's one where you can either check in or out. And there are devices, on trams, buses and some train stations, where you can both check in and out (picture on the right). Now, this wouldn't have been much of a problem, but...
To compensate for the problem of having no turnstiles and people forgetting to check out, the railways are lenient on the time between check-in and check-out. If I forget to check out in the morning, and then hold my card at a check-in/out pole in the evening, it will check me out. However, because the device at my station is both used to check people in and out, if I've just checked out, I cannot check in again, which I need to do to travel back home. No alternative in that case than to buy regular ticket.

Student OV-chipkaart
Students in Netherlands get a card that allows them free public transport either during the week or on weekends. Since this is a subscription and there are no turnstiles at the station, one would assume students would not need to check in. They do. And nobody really knows why. My best guess is that its for the benefit of travel statistics.
Got feedback that indeed in the beginning it was unclear whether students should check in or not. By now it is clear, or at least to some extent: students can check in, but do not need to.

All the same system, but separate
Because the OV-chipkaart is a single system, but the transport companies are separate, you need to check in and out on each vehicle you travel. You cannot simply check in on the bus, then travel by train, switch to the subway, and then check out. However, the architecture of for railway stations, such as station Bijlmer is not suited to accomodate this. At station Bijlmer people don't check out when they exit the metro or train, or exit the platform, but they check out when they exit the station hall. And by that time metro and train passengers have mixed so they cannot check out via the same devices, because the system needs to know whether you are checking out of the metro or out of the train. So they decided to dedicate one exit of the station for people checking out of the metro, and the other exit for people checking out of the train. Which, as expected, was completely unclear to travelers, who could not figure out why this device, that looked exactly the same would not check them out. Once again, this problem was 'fixed' with signs.


RFID signal collision
The RFID chip that was chosen is susceptible to interference. I have an another RFID card in my wallet, that I need to enter the building where I work, and when I have both cards in my wallet, and then hold it up to the RFID readers, neither can I enter at work nor check in in train or tram. And I think that in the near future the amount of RFID cards in our wallets will only increase. Seems like a poor protocol to me, but maybe they just chose a cheap RFID chip.

Checking tickets
It takes the train staff about 3 times as long to check your OV-chipcard with a PDA than it takes them to look at a regular card. On the bright side: once the turnstiles are installed at the stations, the need to check the tickets of all the passengers will be less, because you simply cannot enter the station without a checking in.
Additionally, a conductor checking my chip-card on a long train ride (in the Netherlands that's about 2,5 hours) confessed that the battery time of the device he had to use to check the cards was not sufficient to last all the way back and forth. At some point on the way back the thing would simply shut down. And this was at a time when only a few people were using chip-cards on the train...

You have your own gripes with the OV-chipkaart or similar systems? Feel free to share them in the comments...

[Top photo:Ramatheron, Single fare ticket:Alper, Sign at station:Sint Smeding, Check in/out pole:Battlefan, GVB/NS card pole:Hilderik]