Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering Ticketmaster's rotating barcodes

conduition.io

Post reply on HN
Print view View original

11–20 of 737 posts

Re: Reverse engineering Ticketmaster's rotating barcodes

#11

Post by mschuster91 »

> This is a contradiction in TicketMaster’s marketing. They can’t have robust DRM on their tickets if those tickets can still be viewed offline.

The "robust DRM" is called "ID cards". Here in Europe, it's become commonplace to tie soccer tickets to ID cards that are verified at the gates to keep hooligans (or those suspected of being hooligans, which is a status that is way WAY easier obtainable than one might reasonably assume) out, and high-class events that attract scalpers like a pile of dungs attracts flies have been doing that for even longer.

Re: Reverse engineering Ticketmaster's rotating barcodes

#14

Post by ikesau »

Really good post! I also found this quote which distilled their position in the 404media coverage of the situation.

> “What I can say for sure is that TicketMaster and AXS have had every opportunity to support scam-free third party ticket resale and delivery platforms if they wished: By documenting their ticket QR code cryptography, and by exposing apps and APIs which would allow verification and rotation of ticket secrets,” Conduition told me in an email. “But they intentionally choose not to do so, and then they act all surprised-pikachu when 3rd party resale scams proliferate. They're opting to play legal whack-a-mole with scammers instead of fixing the problem directly with better technology, because they make more money as a resale monopoly than as an open and secure ecosystem.”

from https://www.404media.co/scalpers-are-working-with-hackers-to...

Re: Reverse engineering Ticketmaster's rotating barcodes

#15

Post by coldpie »

haburka wrote: post #2

Isn’t this a bit like irresponsible disclosure? Since this may be considered a security vulnerability. Although it’s all client side, I’m sure there’s some basis for a lawsuit here.

Nah. Ticketmaster is unethical enough that spreading information that harms them or helps them go out of business is ethical.

Re: Reverse engineering Ticketmaster's rotating barcodes

#16

Post by gruez »

cortesoft wrote: post #10

> There’s no risk that your ticket won’t get you in Isn’t this not true? The risk with printable tickets is that a seller could sell it to multiple people, who all print it out, but then only the first person who uses it can get in? Even if the venue doesn’t check to see if a ticket has already been used, only one person can sit in the actual seat.

>is that a seller could sell it to multiple people, who all print it out

They can't "print it out" because it's a rotating code.

Re: Reverse engineering Ticketmaster's rotating barcodes

#17

Post by 8organicbits »

cortesoft wrote: post #10

> There’s no risk that your ticket won’t get you in Isn’t this not true? The risk with printable tickets is that a seller could sell it to multiple people, who all print it out, but then only the first person who uses it can get in? Even if the venue doesn’t check to see if a ticket has already been used, only one person can sit in the actual seat.

Previous sentence:

> If you bought the ticket off the event’s official ticketing agency (not a sketchy reseller)

Re: Reverse engineering Ticketmaster's rotating barcodes

#18

Post by gruez »

mschuster91 wrote: post #11

> This is a contradiction in TicketMaster’s marketing. They can’t have robust DRM on their tickets if those tickets can still be viewed offline. The "robust DRM" is called "ID cards". Here in Europe, it's become commonplace to tie soccer tickets to ID cards that are verified at the gates to keep hooligans (or those suspected of being hooligans, which is a status that is way WAY easier obtainable than one might reason…

>They can’t have robust DRM on their tickets if those tickets can still be viewed offline.

https://en.wikipedia.org/wiki/Trusted_Computing

Re: Reverse engineering Ticketmaster's rotating barcodes

#19

Post by Aachen »

londons_explore wrote: post #12

v2 of this will require an Android/iOS app which will make use of the platforms secure storage abilities for the key. On non-rooted devices, those are pretty much impervious to the user trying to inspect their contents.

And this is why those companies love DRM'd (non-rooted) devices and try to detect when you broke this form of DRM: you can't get at your data, not even to make a backup of it; they're in full control. Also for security (can't grant root to malware if you don't have the permission to grant that), but also for everything else

Re: Reverse engineering Ticketmaster's rotating barcodes

#20

Post by chazeon »

Another case of abusing ToTK, an excellent technology that promised convenience, security, and offline access. Similarly, Duo builds their stuff off ToTK and then fending off (or makes it very, very hard) you from using a third-party ToTK authenticator with their sites. This company just jettisons the fine promise of available offline that was made by ToTK.
Post reply on HN