“Since the password is transmitted without encryption, the security is weak, but better than nothing.”
The chip in a disposable Montreal Métro ticket measures 570 by 485 micrometres, about a grain of salt. It holds 48 bytes of user memory and three counters that can only go up, which can cap how many rides a ticket allows. The whole exchange with the turnstile takes 35 milliseconds. The only lock on it is a password sent in the clear, and the transit system is betting nobody bothers.