[dfox]

The main point from that is that you should never do a system with stored value on a smart card. The vendors will show you various methods for that, but well it is 2024, just do that online (and the card is just an ID, which optionally can produce ECC signature of some challenge).

[account42]

No, stored value is a good solution if you want the system to function without online connection. You should still collect all transactions centrally where inconsistencies can be exposed. If that were been implemented GP would have been looking at a fraud charge.

[yuliyp]

having a pos in places without a reliable internet connection is enough of a reason for stored value cards to be a thing. Some things shouldn't require the mothership to be alive and reachable to work.

[ThePowerOfFuet]

You're not wrong, but that is precisely the tradeoff: stored-value is more reliable but also more vulnerable.

It's reminiscent of the old NASA saying: "faster, better, cheaper: pick any two".

[account42]

You don't need the system to be invulnerable to fraud, you just need to be able to detect it. Offline stored value cards plus separately shipping transactions to a central system with eventual consistency can give you that. The vending machine in question probably isn't invulnerable to physical break in either.

[lxgr]

> it is 2024, just do that online

Nice idea in theory, except that now you have a system that immediately and catastrophically breaks if there is ever a backend outage (due to, say, a cyberattack or incompetent software trying to prevent one) or your reader loses network connectivity.

> you should never do a system with stored value on a smart card

...if you can afford to ignore the disadvantages of not doing it. Quite often, you think you can, until you can't.