[tsujamin]

The bit at the end regarding the unauthenticated anti-fraud database of trips reminds me of bus tickets in a couple of australian states, which (locally on the 13MHz MFC cards) store a short rolling log of your most recent trips.

Not as bad as a public API, but probably some degree of a personal safety risk given the security around MFC cards and the ability to ascertain pattern-of-life from the data

[lmz]

Those are useful for ticket inspectors and also for troubleshooting issues e.g. if the fare gate won't let you out.

[tsujamin]

No ticket inspectors in play, but it’s roughly a COTS system so makes sense I guess