I write to you from Germany, where I work. I use an android device.

The transportation authority I am in is called Mainzer Mobilität and because my employer only covers 50% of the transportation costs if I use the digital travel card and not the physical one, I’m basically forced to use google wallet, which I hate. This transportation authority doesn’t offer pkpass files I could use with FOSS Wallet or pdf cards with my full name and a small qr code I could download. It has to be google wallet or use a physical card (and pay double).

I used to take a screenshot of the qr code and download the receipt as a pdf each month. On the receipt everyone can see the relevant data, including my full name, address, expiry date of the travel document, type of travel card and what I paid, but 5 days ago a “Kontrolleur” (an employee who boards buses to identify passengers without valid travel documents) fined me for not showing him the google wallet app with my pass there.

Yo read that right, it MUST be google wallet, otherwise I’m not carrying a valid travel document. The qr code alone together with the receipt with all my data and my identity card are not enough.

Is there any FOSS wallet or application that would work in Germany like google wallet does?

I really hate being forced to use google crap like this, I really don’t want to trust them with my data but I need to save as much as I can.

Feel free to suggest other communities where I could ask this question.

  • nomad@infosec.pub
    3·
    2 days ago

    It works by public key cryptography. They sign that your name bought a ticket with a secret key and everybody checking tickets has a public key to check it with which can’t be used to forge a signature.

    Yes I’m talking about 14 days, sorry. Just refund the ticket and now you have a valid signature under your name etc that you can show anybody checking tickets. They can’t take that piece of information from you. But that can publish on a public list which tickets were invalidated afterwards. Which nobody bothers checking, instead they rely on the apps checking that.

    Pkpass is just a formated version of what data is contained inside the qrcode. It should be possible to scan the code and save it as pkpass. But im not sure. My website allows importing into google wallet or downloading the pkpass for another wallet.

    Edit: the last part of the comment is wrong! The qrcode is enough data to allow checking the ticket but usually doesn’t contain more than the signed data for the ticket. That is enough to allow showing a valid qrcode, but not enough to display all related data. So you could in theory construct your own “thin” pkpass file or you might try reverse engineering the data inside the jwt token from the google wallet link to build a pkpass file from.

    Edit2: here you find a tool to do this. You can use the signature for the barcode to display a valid ticket code, but you won’t be able to create a valid container signature, so you need an app that will accept that anyways. (Apple wallet doesn’t) https://github.com/google-wallet/pass-converter/blob/main/README.md

    Maybe just try calling and telling them you have an iPhone and no google account. Or buy your ticket from another source.