Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering Ticketmaster's rotating barcodes

conduition.io

Post reply on HN
Print view View original

21–30 of 737 posts

Re: Reverse engineering Ticketmaster's rotating barcodes

#21

Post by speed_spread »

haburka wrote: post #2

Isn’t this a bit like irresponsible disclosure? Since this may be considered a security vulnerability. Although it’s all client side, I’m sure there’s some basis for a lawsuit here.

If it runs on my CPU and shows up on my screen after I paid for it, it's mine and I can do whatever I want. Anybody who thinks otherwise can fuck off outright.

Re: Reverse engineering Ticketmaster's rotating barcodes

#22

Post by 12_throw_away »

mschuster91 wrote: post #11

> This is a contradiction in TicketMaster’s marketing. They can’t have robust DRM on their tickets if those tickets can still be viewed offline. The "robust DRM" is called "ID cards". Here in Europe, it's become commonplace to tie soccer tickets to ID cards that are verified at the gates to keep hooligans (or those suspected of being hooligans, which is a status that is way WAY easier obtainable than one might reason…

Huh, weird, a turns out an old, low-tech solution is much more secure than Ticketmaster's roll-your-own weird TOT-QR "security" (even considering the magic animation that that makes it "in a sense, alive")

(Not that requiring ID doesn't raise the same and also other consumer rights issues)

Re: Reverse engineering Ticketmaster's rotating barcodes

#24

Post by jcranmer »

haburka wrote: post #2

Isn’t this a bit like irresponsible disclosure? Since this may be considered a security vulnerability. Although it’s all client side, I’m sure there’s some basis for a lawsuit here.

I'm struggling to come up with a good basis for a lawsuit. CFAA abuse is the first thing that comes to mind, but this is a real stretch for that, and SCOTUS shut that stretching down a while ago. DMCA doesn't come into play, since this isn't circumventing any copyright protection schemes. So this kind of leaves you with some form of contract violation, but even that seems like a stretch here. Tortious interference or interference with prospective business? I mean, I don't see any events complaining about this (hell, Ticketmaster itself arguably has some contract liability issues with the fact that their technology relies on cell service which tends to be spotty in dense crowds). So you're kind of left with some individual contract liability issue, which is literally not worth the cost of litigation.

Re: Reverse engineering Ticketmaster's rotating barcodes

#25

Post by arscan »

I recently purchased tickets via SeatGeek and was provided a link to one of these barcodes, which accepted as a querystring parameter an access token that seemingly had a long expiration attached to it. It was hosted on “downloadmytickets.com”, which doesn’t look legitimate and caused me to do this same type of analysis to see how it all worked. Whether or not this was a way to bypass the “security” to enable sale via third parties, or just a very untrustworthy-looking official domain, I don’t know. But in the end it worked fine at the venue. Definitely more stress involved than I would have liked though.

Re: Reverse engineering Ticketmaster's rotating barcodes

#26

Post by mschuster91 »

12_throw_away wrote: post #22
mschuster91 wrote: post #11

> This is a contradiction in TicketMaster’s marketing. They can’t have robust DRM on their tickets if those tickets can still be viewed offline. The "robust DRM" is called "ID cards". Here in Europe, it's become commonplace to tie soccer tickets to ID cards that are verified at the gates to keep hooligans (or those suspected of being hooligans, which is a status that is way WAY easier obtainable than one might reason…

Huh, weird, a turns out an old, low-tech solution is much more secure than Ticketmaster's roll-your-own weird TOT-QR "security" (even considering the magic animation that that makes it "in a sense, alive") (Not that requiring ID doesn't raise the same and also other consumer rights issues)

The thing is, unlike most of Europe, the US doesn't have a legal mandate for anyone to possess an ID card, and so in practice you got 50 states worth of driver's licenses, library cards, military or government employment IDs that can be used (or faked)... so you can't really use these for legitimately verifying anything unless you want to spend a lot of time and money to train your staff to spot fakes. Banks can do that but no one wants to do that for the goons that run security at venues for minimum wage.

Re: Reverse engineering Ticketmaster's rotating barcodes

#27

Post by noodlesUK »

This sort of ticketing thing is a trivially solvable problem. It is solved at every airport in the entire world millions of times per day. You provide the name of each concertgoer when you buy a ticket, and they show up with their ticket and ID. You often need to show your ID at these kinds of venues to prove you're old enough to drink beer anyway.

Re: Reverse engineering Ticketmaster's rotating barcodes

#28

Post by IncreasePosts »

mschuster91 wrote: post #26
12_throw_away wrote: post #22

Earlier quoted context omitted.

Huh, weird, a turns out an old, low-tech solution is much more secure than Ticketmaster's roll-your-own weird TOT-QR "security" (even considering the magic animation that that makes it "in a sense, alive") (Not that requiring ID doesn't raise the same and also other consumer rights issues)

The thing is, unlike most of Europe, the US doesn't have a legal mandate for anyone to possess an ID card, and so in practice you got 50 states worth of driver's licenses, library cards, military or government employment IDs that can be used (or faked)... so you can't really use these for legitimately verifying anything unless you want to spend a lot of time and money to train your staff to spot fakes. Banks can do t…

Sure, but realistically no one is going to get a fake ID with a certain name on it so they can go to a concert with that person's tickets.

Re: Reverse engineering Ticketmaster's rotating barcodes

#29

Post by abofh »

frizlab wrote: post #23

How about the “Add to Apple Wallet” option? He did not talk about that at all , but AFAIK the ticket would be fully available offline and not in Ticketmaster app, no? It’s actually an elegant solution IMHO.

They mentioned avoiding google wallet, so we can assume android, and that apple wallet wasn't considered for not being an option for them.

Re: Reverse engineering Ticketmaster's rotating barcodes

#30

Post by Aachen »

12_throw_away wrote: post #9
haburka wrote: post #2

Isn’t this a bit like irresponsible disclosure? Since this may be considered a security vulnerability. Although it’s all client side, I’m sure there’s some basis for a lawsuit here.

"Responsible disclosure" is poorly defined corporate wishcasting, and certainly not any sort of best practice or legal shield.

The public prosecutor does not pursue cases where responsible aka coordinated vulnerability disclosure was applied. I'd say that's a legal shield of some kind at least, and it is generally also considered best practice in the industry. There's exceptions to everything but, in the general case, I'm not sure where you're getting these viewpoints from
Post reply on HN