Oyster Renewal
 

How come if I get a refund it can be added at Watford Junc but if I do an
online top up it can't be added at Watford Junc or Euston main line.

Kevin

Oyster Renewal
 

On Sep 1, 9:54*pm, "Zen83237" wrote:
How come if I get a refund it can be added at Watford Junc but if I do an
online top up it can't be added at Watford Junc or Euston main line.

Possibly might be the TOC, London Midland, protecting their ticket
office takings at WJ?

Oyster Renewal
 

"Mizter T" wrote in message
...

On Sep 1, 9:54 pm, "Zen83237" wrote:
How come if I get a refund it can be added at Watford Junc but if I do an
online top up it can't be added at Watford Junc or Euston main line.

Possibly might be the TOC, London Midland, protecting their ticket
office takings at WJ?

But Watford Junc is never the less a London Overground station, seems odd
that it isn't a station that you do an online top up at.

Oyster Renewal
 

"Zen83237" wrote in message
...

"Mizter T" wrote in message
...

On Sep 1, 9:54 pm, "Zen83237" wrote:
How come if I get a refund it can be added at Watford Junc but if I do an
online top up it can't be added at Watford Junc or Euston main line.

Possibly might be the TOC, London Midland, protecting their ticket
office takings at WJ?

But Watford Junc is never the less a London Overground station, seems odd
that it isn't a station that you do an online top up at.


Isn't it that you can only do online top up at *Underground* stations?

I've never understood why anybody bothers with online top up. I tried it
once or twice and rapidly came to the conclusion it is the utterly useless
and inconvenient way to administer a PAYG balance that it is.

In a previous post on uk.railway under the subject "Oyster top up at Kings
Cross" I wrote:

"Online top-up is for those who are prepared to use a klunky web interface
to buy something that has to be collected at a nominated place within a
certain time window with the risk that if the oyster balance runs out in the
meantime they might not be able to get to the nominated collection point to
collect the purchase in the first place."
....

"The only benefit I can see is the avoidance of ticket office/machine
queues. With my frequent but irregular travel patterns I always found it
easier and just as inconvenient to stuff a card into a ticket machine when I
spotted one without a queue. Then I activated auto top-up."

D A Stocks

Oyster Renewal
 

On Sep 2, 10:11*am, "David A Stocks" wrote:

I've never understood why anybody bothers with online top up. [...]

Because what's no good for you is no good for anyone else, and anyone
who might demur is wrong?

[...] I tried it
once or twice and rapidly came to the conclusion it is the utterly useless
and inconvenient way to administer a PAYG balance that it is.

And therefore no-one might find it useful or convenient?

OK then, judgement has been given, tell TfL to pull the plug on it...

Oyster Renewal
 

Mizter T writes:

On Sep 2, 10:11*am, "David A Stocks" wrote:

I've never understood why anybody bothers with online top up. [...]

Because what's no good for you is no good for anyone else, and anyone
who might demur is wrong?

I think we're all prepared to entertain the *possiblity* that it might
be good for someone, but you don't actually give any indication of who
they might be or why.

Do tell. My experience echoes Mr Stocks', so I would also be interested
to hear from people who do get use out of the service.


-dan

Oyster Renewal
 

On 2 Sep, 11:22, Daniel Barlow wrote:
Mizter T writes:
On Sep 2, 10:11*am, "David A Stocks" wrote:

I've never understood why anybody bothers with online top up. [...]

Because what's no good for you is no good for anyone else, and anyone
who might demur is wrong?

I think we're all prepared to entertain the *possiblity* that it might
be good for someone, but you don't actually give any indication of who
they might be or why.

Do tell. *My experience echoes Mr Stocks', so I would also be interested
to hear from people who do get use out of the service.


One possibility is parents who want to top up their kids' oysters
(although with fares so low for kids this might not be frequent!!)

Oyster Renewal
 

On 2 Sep, 10:11, "David A Stocks" wrote:
"Zen83237" wrote in message

...



"Mizter T" wrote in message
...

On Sep 1, 9:54 pm, "Zen83237" wrote:
How come if I get a refund it can be added at Watford Junc but if I do an
online top up it can't be added at Watford Junc or Euston main line.

Possibly might be the TOC, London Midland, protecting their ticket
office takings at WJ?

But Watford Junc is never the less a London Overground station, seems odd
that it isn't a station that you do an online top up at.

Isn't it that you can only do online top up at *Underground* stations?


It seems to be available at all DLR, London Overground and Underground
stations, except some run by a National Rail company (so no Clapham
Junction, Richmond or Wimbledon either, but Barking and Upminster are
allowed (these last two are C2C stations))

Oyster Renewal
 

"Daniel Barlow" wrote in message

Mizter T writes:

On Sep 2, 10:11 am, "David A Stocks" wrote:

I've never understood why anybody bothers with online top up. [...]

Because what's no good for you is no good for anyone else, and anyone
who might demur is wrong?

I think we're all prepared to entertain the *possiblity* that it might
be good for someone, but you don't actually give any indication of who
they might be or why.

Do tell. My experience echoes Mr Stocks', so I would also be
interested to hear from people who do get use out of the service.

On-line top-up accepts Amex cards -- I don't think ticket machines do
(or they didn't used to). Also, no risk of anyone seeing your pin.

Oyster Renewal
 

"Daniel Barlow" wrote in message
...
Mizter T writes:

On Sep 2, 10:11 am, "David A Stocks" wrote:

I've never understood why anybody bothers with online top up. [...]

Because what's no good for you is no good for anyone else, and anyone
who might demur is wrong?

I think we're all prepared to entertain the *possiblity* that it might
be good for someone, but you don't actually give any indication of who
they might be or why.

Do tell. My experience echoes Mr Stocks', so I would also be interested
to hear from people who do get use out of the service.


Exactly.

As I said in my post (but Mizter T snipped it) there is a possible benefit
in the avoidance of queues at ticket offices/machines, but I still found it
a lot easier to top up at ticket machines than using online top up. I'm a
frequent PAYG user but my pattern of use is not very predictable making the
requirement to pick up the balance at a nominated underground gateline[1] a
complete pain in the arse.

It's also possible my experience is affected by living south of the river
....

OTOH auto top up is absolutely wonderful.

So here is the challenge: is there someone out there who regularly uses
online top up, and why do they use it in preference to manual top ups at
ticket machines?

I, like Daniel, am genuinely interested to know.

[1] I was quoting from a post about Kings X, where you have to specify the
tube or sub-surface gate line to collect top ups and, presumably, other
Oyster products.

--
D A Stocks

Oyster Renewal
 

In message
, Andy
writes

One possibility is parents who want to top up their kids' oysters
(although with fares so low for kids this might not be frequent!!)

Under 16s travel free (unless they've been naughty and had their
concession withdrawn).
--
Paul Terry

Oyster Renewal
 

"Recliner" wrote in message
...
"Daniel Barlow" wrote in message

Mizter T writes:

On Sep 2, 10:11 am, "David A Stocks" wrote:

I've never understood why anybody bothers with online top up. [...]

Because what's no good for you is no good for anyone else, and anyone
who might demur is wrong?

I think we're all prepared to entertain the *possiblity* that it might
be good for someone, but you don't actually give any indication of who
they might be or why.

Do tell. My experience echoes Mr Stocks', so I would also be
interested to hear from people who do get use out of the service.

On-line top-up accepts Amex cards -- I don't think ticket machines do (or
they didn't used to). Also, no risk of anyone seeing your pin.
I always used my Amex card. The PIN by itself isn't a lot of use, and online
card transactions from a less than secure PC could give away far more
compromising information ...

D A Stocks

Oyster Renewal
 

On Wed, 2 Sep 2009 12:06:59 +0100
"Recliner" wrote:
Do tell. My experience echoes Mr Stocks', so I would also be
interested to hear from people who do get use out of the service.

On-line top-up accepts Amex cards -- I don't think ticket machines do
(or they didn't used to). Also, no risk of anyone seeing your pin.

Apart from whoever runs the back end system.

B2003

Oyster Renewal
 

In message , at 12:18:07 on Wed, 2 Sep
2009, David A Stocks remarked:
OTOH auto top up is absolutely wonderful.

So here is the challenge: is there someone out there who regularly uses
online top up, and why do they use it in preference to manual top ups
at ticket machines?

I, like Daniel, am genuinely interested to know.

I never used online topup (was it even available then) but for two years
now I've been on auto-topup, which is great.

As an occasional user only, and generally visiting London for meetings,
I'm most often in a hurry and using (relatively) unfamiliar stations
away from the terminus. So topping up with a machine was a bit of a
lottery, of finding one at the right time without a queue.
--
Roland Perry

Oyster Renewal
 

On 2 Sep, 12:21, Paul Terry wrote:
In message
, Andy
writes

One possibility is parents who want to top up their kids' oysters
(although with fares so low for kids this might not be frequent!!)

Under 16s travel free (unless they've been naughty and had their
concession withdrawn).

Not on the underground they don't, only buses and trams. The
underground has a £1 fare.

Oyster Renewal
 

On 2 Sep, 12:40, wrote:
On Wed, 2 Sep 2009 12:06:59 +0100

"Recliner" wrote:
Do tell. *My experience echoes Mr Stocks', so I would also be
interested to hear from people who do get use out of the service.

On-line top-up accepts Amex cards -- I don't think ticket machines do
(or they didn't used to). *Also, no risk of anyone seeing your pin.

Apart from whoever runs the back end system.


They won't see you PIN either, although they will get enough
information for on-line use.

Oyster Renewal
 

I, like Daniel, am genuinely interested to know.


My reason for using the online top-up facility was to gain online access
to my journey history.

That seems still to be a requirement. From the Oyster site:

"You need to have an Oyster online account and have purchased pay as you
go online to view your journey history online. Once you are logged in,
select the Journey History option under the 'My card' tab."

That may of course simply change the question to why online top-up is
required. I'd guess as a security check (with DPA in mind) that the
person gaining access is the owner of the card. Not foolproof of course
but it seems to me a reasonable safeguard.

--
R

Oyster Renewal
 

On Wed, 2 Sep 2009 05:43:24 -0700 (PDT)
Andy wrote:
Apart from whoever runs the back end system.


They won't see you PIN either, although they will get enough
information for on-line use.

If you say so , though how you think the pin gets transmitted to the
server without the server seeing it would be an interesting discussion.
Knowing how badly most web backends are written it wouldn't surprise me
if its stored in a temporary plain text file.

B2003

Oyster Renewal
 

wrote in message ...
On Wed, 2 Sep 2009 05:43:24 -0700 (PDT)
Andy wrote:
Apart from whoever runs the back end system.


They won't see your PIN either, although they will get enough
information for on-line use.
I don't think they would have security code on the card, which would stop a
lot of potential abuses.

If you say so , though how you think the pin gets transmitted to the
server without the server seeing it would be an interesting discussion.
The PIN is verified by the front end against the card. If the PIN isn't
matched the front end rejects the card and the back end doesn't see the
transaction at all. The back end never sees the PIN.

Knowing how badly most web backends are written
We're talking about manual card transactions at a ticket machine. If you're
enough of a sucker to give out a credit/debit card PIN over the internet
then you're really f**ked.

DAS

Oyster Renewal
 

In message
,
Andy writes

On 2 Sep, 12:21, Paul Terry wrote:

Under 16s travel free (unless they've been naughty and had their
concession withdrawn).

Not on the underground they don't, only buses and trams. The
underground has a £1 fare.

I'd forgotten that, but only those aged 11+ have to pay: younger kids
can travel free on the tube with an Oyster photocard.
--
Paul Terry

Oyster Renewal
 

On Wed, 2 Sep 2009 14:55:54 +0100
"David A Stocks" wrote:
Knowing how badly most web backends are written
We're talking about manual card transactions at a ticket machine. If you're

Err no, the poster I was replying to was talking about renewing online.

enough of a sucker to give out a credit/debit card PIN over the internet
then you're really f**ked.

Online banking requires it but I don't know about other sorts of online
transations - I don't do mail order.

B2003

Oyster Renewal
 

On Wed, 2 Sep 2009 07:09:41 -0700 (PDT)
Andy wrote:
When have you EVER put your PIN into a website to buy anything? You

Never, I don't do mail order.

B2003

Oyster Renewal
 

On Wed, 2 Sep 2009 07:16:02 -0700 (PDT)
Andy wrote:
Oh and to reinforce the point, if you are undertaking a 'customer
present' transaction, the PIN number is validated directly against the
card and not sent to any server. The card holds the PIN, not the bank.

If your card has a magnetic stripe on the back then your bank is probably
well aware of your PIN otherwise you'd never be able to use it in non
chip-and-pin cash machines in other countries.

B2003

Oyster Renewal
 

wrote in message
On Wed, 2 Sep 2009 14:55:54 +0100
"David A Stocks" wrote:
Knowing how badly most web backends are written
We're talking about manual card transactions at a ticket machine. If
you're

Err no, the poster I was replying to was talking about renewing
online.

enough of a sucker to give out a credit/debit card PIN over the
internet then you're really f**ked.

Online banking requires it but I don't know about other sorts of
online transations - I don't do mail order.

No, you don't need your card PIN for on-line banking -- you have a
different password for that (with probably more than 4 characters).

Oyster Renewal
 

wrote in message
On Wed, 2 Sep 2009 07:09:41 -0700 (PDT)
Andy wrote:
When have you EVER put your PIN into a website to buy anything? You

Never, I don't do mail order.

I suppose I'm asking for trouble here, but why do you not do any Web
shopping? I've been doing it for many years without problems.

Oyster Renewal
 

On Wed, 2 Sep 2009 16:27:06 +0100
"Recliner" wrote:
enough of a sucker to give out a credit/debit card PIN over the
internet then you're really f**ked.

Online banking requires it but I don't know about other sorts of
online transations - I don't do mail order.

No, you don't need your card PIN for on-line banking -- you have a
different password for that (with probably more than 4 characters).

You're right, I was thinking of the telephone/online banking PIN. My bank
requires that plus a passphrase.

B2003

Oyster Renewal
 

On Wed, 2 Sep 2009 16:28:55 +0100
"Recliner" wrote:
Never, I don't do mail order.

I suppose I'm asking for trouble here, but why do you not do any Web
shopping? I've been doing it for many years without problems.

I don't do any sort of mail order because either the parcel gets dumped in
the front garden while I'm at work and then gets wet or nicked, or I have to
go and collect it from some depot 10 miles away thats only open office hours
monday to friday. And when it goes wrong its down to the main post office to
send it back and wait 3 weeks for a response.

Been there, done all that, ******** to it. Shops are a damn sight better.

B2003

Oyster Renewal
 

wrote:

On Wed, 2 Sep 2009 07:16:02 -0700 (PDT)
Andy wrote:
Oh and to reinforce the point, if you are undertaking a 'customer
present' transaction, the PIN number is validated directly against the
card and not sent to any server. The card holds the PIN, not the bank.

If your card has a magnetic stripe on the back then your bank is probably
well aware of your PIN otherwise you'd never be able to use it in non
chip-and-pin cash machines in other countries.

When you get a new card the bank sends you the pin (and if a renewal
debit at least says it is the same as your current one)

--
Mark

Oyster Renewal
 

On 2 Sep, 16:08, wrote:
On Wed, 2 Sep 2009 14:55:54 +0100
"David A Stocks" wrote:

Knowing how badly most web backends are written
We're talking about manual card transactions at a ticket machine. If you're

Err no, the poster I was replying to was talking about renewing online.

enough of a sucker to give out a credit/debit card PIN over the internet
then you're really f**ked.

Online banking requires it but I don't know about other sorts of online
transations - I don't do mail order.


No online banking requires it either. You might have to use a small
electronic card-reader to get a verification number, or use a personal
website ID number, but at no point is your PIN ever sent over the
network.

Oyster Renewal
 

On 2 Sep, 16:16, wrote:
On Wed, 2 Sep 2009 07:16:02 -0700 (PDT)

Andy wrote:
Oh and to reinforce the point, if you are undertaking a 'customer
present' transaction, the PIN number is validated directly against the
card and not sent to any server. The card holds the PIN, not the bank.

If your card has a magnetic stripe on the back then your bank is probably
well aware of your PIN otherwise you'd never be able to use it in non
chip-and-pin cash machines in other countries.


Yes, but we were talking about UK on-line transactions, not foreign
ATMs. I know that the PIN is held by the bank, otherwise it would be
very hard for a reminder to be sent. However, in the UK the banks
don't remotely validate PINs for transactions anymore.

Oyster Renewal
 

In message
, Andy
writes

I know that the PIN is held by the bank, otherwise it would be
very hard for a reminder to be sent.

I don't think that even the PIN is held directly by the bank. They will
have a record of the underlying security number of the card, which is
not revealed to the customer and can never be changed.

When a new PIN is selected, an offset generated by a complex hash is
recorded, and the bank will have a record of this offset. This allows
them to issue a PIN reminder without the necessity of storing a
vulnerable list of PIN numbers.
--
Paul Terry

Oyster Renewal
 

On Sep 2, 6:46*pm, Paul Terry wrote:
In message
, Andy
writes

I know that the PIN is held by the bank, otherwise it would be
very hard for a reminder to be sent.

I don't think that even the PIN is held directly by the bank. They will
have a record of the underlying security number of the card, which is
not revealed to the customer and can never be changed.

When a new PIN is selected, an offset generated by a complex hash is
recorded, and the bank will have a record of this offset. This allows
them to issue a PIN reminder without the necessity of storing a
vulnerable list of PIN numbers.

Might be true, but the bank can still access the PINs, otherwise the
reminder that you sometimes get with a replacement card, or upon
request, would have to be a new number rather than the advice of the
existing one. So someone with the correct access can still get hold of
your PIN. Some banks (MBNA for the Virgin Credit card is one) even
allow you to get your PIN displayed online, which seems to me to be a
very bad idea.

Oyster Renewal
 

In article ,
lid (Mark Bestley) wrote:

wrote:

On Wed, 2 Sep 2009 07:16:02 -0700 (PDT)
Andy wrote:
Oh and to reinforce the point, if you are undertaking a 'customer
present' transaction, the PIN number is validated directly against
the card and not sent to any server. The card holds the PIN, not the
bank.

If your card has a magnetic stripe on the back then your bank is
probably well aware of your PIN otherwise you'd never be able to use
it in non chip-and-pin cash machines in other countries.

When you get a new card the bank sends you the pin (and if a renewal
debit at least says it is the same as your current one)

My credit and debit card PINs have stayed the same through card changes,
including account number changes in the case of credit cards. The PIN
relates to the card.

--
Colin Rosenstiel

Oyster Renewal
 

On Sep 2, 9:19*pm, Andy wrote:

On Sep 2, 6:46*pm, Paul Terry wrote:

In message
, Andy
writes

I know that the PIN is held by the bank, otherwise it would be
very hard for a reminder to be sent.

I don't think that even the PIN is held directly by the bank. They will
have a record of the underlying security number of the card, which is
not revealed to the customer and can never be changed.

When a new PIN is selected, an offset generated by a complex hash is
recorded, and the bank will have a record of this offset. This allows
them to issue a PIN reminder without the necessity of storing a
vulnerable list of PIN numbers.

Might be true, but the bank can still access the PINs, otherwise the
reminder that you sometimes get with a replacement card, or upon
request, would have to be a new number rather than the advice of the
existing one. So someone with the correct access can still get hold of
your PIN. Some banks (MBNA for the Virgin Credit card is one) even
allow you to get your PIN displayed online, which seems to me to be a
very bad idea.

Indeed, that sounds like a spectacularly bad idea!

I don't recall ever getting a reminder of my PIN when a replacement
card came through - the PIN simply remained the same. I think I
remember requesting a reminder from what credit card company or
another in years gone by, and them sending me a brand new PIN.

Oyster Renewal
 

On 2 Sep, 21:59, Mizter T wrote:
On Sep 2, 9:19*pm, Andy wrote:





On Sep 2, 6:46*pm, Paul Terry wrote:

In message
, Andy
writes

I know that the PIN is held by the bank, otherwise it would be
very hard for a reminder to be sent.

I don't think that even the PIN is held directly by the bank. They will
have a record of the underlying security number of the card, which is
not revealed to the customer and can never be changed.

When a new PIN is selected, an offset generated by a complex hash is
recorded, and the bank will have a record of this offset. This allows
them to issue a PIN reminder without the necessity of storing a
vulnerable list of PIN numbers.

Might be true, but the bank can still access the PINs, otherwise the
reminder that you sometimes get with a replacement card, or upon
request, would have to be a new number rather than the advice of the
existing one. So someone with the correct access can still get hold of
your PIN. Some banks (MBNA for the Virgin Credit card is one) even
allow you to get your PIN displayed online, which seems to me to be a
very bad idea.

Indeed, that sounds like a spectacularly bad idea!

I don't recall ever getting a reminder of my PIN when a replacement
card came through - the PIN simply remained the same. I think I
remember requesting a reminder from what credit card company or
another in years gone by, and them sending me a brand new PIN.- Hide quoted text -

- Show quoted text -

My bank uses a PIN-like four-digit code* plus some security questions,
and I bet that a lot of people will set it to be the same as their PIN
so it's easier to remember. So anyone intercepting the communications
would effectively get a lot of PINs.


*and annoyingly forces you to select them from drop-downs, so that
anyone looking at the screen can see what number you are scrolling to,
although it becomes a * once selected.

Oyster Renewal
 

On Thu, 3 Sep 2009 08:54:21 +0100
Ian Jelf wrote:
The problem I'm starting to find now is that a lot of shops simply don't
have the range of things I want. For some reason, I've particularly
noticed that with books where I think the wind of Amazon really is
starting to blow.

Next time you're down in London visit Foyles in Charing Cross Road. It really
is the most superb (and large) bookshop and unless what you're after is
really obscure they're pretty likely to have it. Failing that the Waterstones
off piccadilly is apparently the largest bookshop in britain though there
does seem to be a lot of wasted space there so I'm not sure if the actual
number of books they have is as much as Foyles which tends to pack things
in pretty tight.

B2003

Oyster Renewal
 

On Wed, 2 Sep 2009 18:46:39 +0100
Paul Terry wrote:
When a new PIN is selected, an offset generated by a complex hash is
recorded, and the bank will have a record of this offset. This allows
them to issue a PIN reminder without the necessity of storing a
vulnerable list of PIN numbers.

If the PIN can easily be recreated just using a formula then its just as
vulnerable as if they stored it directly.

B2003

Oyster Renewal
 

On Thu, 3 Sep 2009 08:54:21 +0100
Ian Jelf wrote:
Post Office stuff isn't too much of a problem for us, as the Delivery
Office is quite nearby and I can usually arrange to get things due to my
varied working hours.

The post delivery office is a bit more convenient for me but even then their
hours are unhelpful. Also most companies seem to be obsessed with using
next day delivery courier companies which only seem to delivery when people
are at work. You'd think there'd be a market for companies that would
deliver in the evening or weekends.

B2003

Oyster Renewal
 

On 3 Sep 2009 09:15:57 GMT
Huge wrote:
On 2009-09-03, Ian Jelf wrote:
In message , writes
On Thu, 3 Sep 2009 08:54:21 +0100
Ian Jelf wrote:
The problem I'm starting to find now is that a lot of shops simply don't
have the range of things I want. For some reason, I've particularly
noticed that with books where I think the wind of Amazon really is
starting to blow.

Next time you're down in London visit Foyles in Charing Cross Road.

Oh I've certainly done that! Indeed, I recently had quite a spending
spree in there, ostensibly buying a couple of books for SWMBO's birthday
but ended up buying a bit of stuff for myself, too!

It really
is the most superb (and large) bookshop

Foyles? Superb? Have they stopped indexing the books by publisher, got some
helpful assistants and refurbished the place, then?

Yes, about 10 years ago.

B2003

Oyster Renewal
 

In message , writes

If the PIN can easily be recreated just using a formula then its just as
vulnerable as if they stored it directly.

No, there is no simple formula involved. The data is strongly encrypted
using three independent keys and the PIN can only be regenerated by a
specialist machine that decrypts both the original security number and
the offset used by the customer. It then outputs the PIN to a security
envelope. The only way for a member of the bank staff to see the PIN is
to open the envelope before it is posted, which is why customers are
always warned to check that the envelope has not been tampered with
before using their PIN.

--
Paul Terry