my interest in this goes further. two different systems use what they believe is good enough privacy/security and it works as long as they are in their separate world. put both into the same public place and it becomes apparent it's no longer the case.
this might pose a problem for those that collect tickets and them throw them in the bin, or expense them, like in our case. 