Simple PrePay/Checkout System Using MagCards?

An Anonymous Coward asks: "I help at a small youth club that has various events on different nights. For awhile now we have had a snack bar of sorts and have been thinking of developing a pre-paid system. We have access to plenty of computers and magnetic card readers (wit blank cards) but any ideas on the software? Also, would there be any way of also using this to keep track of a CD sign-out system?"

Re:Yikes.

[ameoba]

Kids wouldn't want to pre-pay, but their parents would. Parents could pre-pay for snacky-bits, and rest easily knowing that, while $5 could buy some drugs, 5 snickers bars aren't quite so transferable (especially when they've been in sombody's hand during a nervous 10-block run).

Obvious security issues...

[ameoba]

There are a few obvious things here:

• I doubt anonymous transactions are much called for, so keep -all- the data, other than a single user ID, on your server. No need to have kids comming in and getting $150 worth of pixie sticks at a time.
  
• Do your damnedest to keep the physical security of the server (and access points) tight. Kids can do wonders with an accidentally logged-in terminal
  
• If you can implement some form of photo-id on the cards, it'll cut down on loss/theft. If printing the pix on the card isn't workable, keep them in the DB.
  
• Make sure to keep copious records and excellent backups of all transactions. Hell hath no fury like a parent who thinks somebody's been stealing from their kids.
  

Extra Layer of securiy req'd

[vreeker]

As suggested above the security of mag cards are quite trivial. However if you kept a record of what *should* be on the cards on a database of some kind <shameless mysql plug here/> any attempt to use a modified card could be spottted and dealt with.

This somewhat stupifies the usage of the mag cards as you could just as easily use a barcoded card to track the users and keep all information local.

CD borrowing system could work just like any library system now. Each user has a barcoded card (easily could be a mag card) that has a user id of some sort. Then the server keeps track of the rest. An added bonus to using the barcode is people could "log-in" from home and check account status. With a mag card the users would need an additional user id printed on the card. (Or assigned one in the application process).

Just my two clams from above the border.

Helping

[Chacham]

Well, I don;t know of any software for it, but I'd love to help design the database end of it.

Texas A&M Aggie Buck System

[Milican]

I used a system that was tied to my mag card / student ID for many years there. You can buy cokes, pizza, food of any type, etc.. with the swipe of a card. The vending machines are the best because there is no need for change anymore! Everyone at A&M loves Aggie Bucks.

BTW, here is a link [tamu.edu] for businesses involved. I know this doesn't help directly with the software, but it proves it has been done on a wide scale with great success. You may want to contact those involved in implementing this, or learn from their example. Good luck.

JOhn

Mag cards...

[shumacher]

A couple of security suggestions:
1) Avoid sequential numbering.
2) The Mag stripe should have information that's not printed on the card.
3) Printed information on the card should be verified against data from the swipe.
4) Mag card numbers should be independent of any specific user information.

This might be overkill but...

[John Harrison]

Have you considered smart cards? You can store prepaid credit on the card itself. You can keep a list of what is checked out currently on both the card and the a backend sysstem. This would be useful for proving to someone that they did indeed check something out. Ask for their card and show them the record of it from their card.

If you do it right the security is better. Readers aren't that expensive (~$50) and they also function as writers. Also cards are getting pretty cheap. $3 for Java card, less that $1 for some file system cards. Obviously this is more expensive than mag-stripe, but also much cooler.

disclaimer: I do smart card work full time so I am biased.

Re:This might be overkill but...

[dfreed]

where can you find readers for $50?

iButton

[JediTrainer]

Try the iButton [ibutton.com]. It's a Java-based little button that can be placed on a keychain (or ring, or watch, or wallet). I imagine they're probably simple enough to program with, and probably difficult to hack. I believe they all come with a unique identifier that can be accessed which cannot be overwritten, unlike with a mag-card which can easily be copied and forged.

Should be relatively trivial to write a program to interface with a database every time it's touched to your terminal, depending on what sort of transaction you wish to take place.

Re:iButton

[PrinceBytor]

This is a good suggestion.

I have done some iButton programming in the past and found it fairly simple to create a little app that watched for contact on the iButton receptacle (or BlueDot), read relevant data from the iButton, and did its thing.

Security on those little buggers is impressive (especially the lengths to which they went ensuring the physical security of the can).

They're pretty cheap too.

Re:iButton

[dfreed]

What is your definition of cheap for these buttons?