Reverse engineering Ticketmaster's rotating barcodes • Hacker News Board

Re: Reverse engineering Ticketmaster's rotating barcodes

#81

Post by GenerocUsername » Mon, Jul 08, 2024, 5:09 PM UTC

dylan604 wrote: post #80

RScholar wrote: post #55

> Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. This is one of the most powerful truths underlying the world we currently inhabit. The sooner we can agree to behave accordingly, the better our prospects for ripping the reigns of society from the hands of those whose only animating principles are avarice and exploitati…

The fact we have had less than benevolent wizards and shamans, why would we expect to have modern day equivalent of only benevolent coders? It's such a fairy tale level of expectation that it seems childish. Spending any energy in trying to make real world a fairy tale is just wasted.

It's okay to shame bad actors.

In fact, society would likely be better off if e brought back more public shaming

Re: Reverse engineering Ticketmaster's rotating barcodes

#82

Post by blowski » Mon, Jul 08, 2024, 5:09 PM UTC

munk-a wrote: post #71

probably_wrong wrote: post #67

Earlier quoted context omitted.

I'm glad we cleared that up. Now all that remains is a good, measurable definition of what a bad company is.

You're trying to get quantitative about a qualitative problem.

So if you think a company is bad you shouldn’t work for them. Perhaps many of the people working for TicketMaster don’t think they’re a bad company.

Re: Reverse engineering Ticketmaster's rotating barcodes

#83

Post by cogman10 » Mon, Jul 08, 2024, 5:09 PM UTC

oehpr wrote: post #52

cogman10 wrote: post #32

Earlier quoted context omitted.

Yup. I have to believe the reason the likes of ticket master isn't fixing this is because they are selling/auctioning/reserving some percentage of tickets to scalpers or "3rd party sellers". Requiring ID is such an obvious solution that I have to believe these convoluted approaches are only there so the secondary market can exist and so ticket master can wash their hands when prices get out of control on that market.

I have to presume that the driving impetus of all of this is that they're trying to avoid the actual requirement of checking the ID. Like, they want to improve the flow of traffic through admissions. But I mean, obviously, any kind of system like this strikes me as the same sort of thing as DRM. That you can somehow protect the message from the person you're sharing the message to. How can you avoid reselling if you…

So even if you don't want to do the ID thing, there are alternatives that you see all over the place (like venmo) Have a rotating QR code seeded with a unique to the user id. Then with ticket master, require a login to buy tickets. Register the tickets to the ID and then do the lookup with a combination of the ticket id, rotating qr code, and the user id.

That requires the admitter device to send the challenge back to HQ, but that shouldn't really be much of a challenge. Tickets then become linked to the user's account (perhaps you allow transfer).

This is effectively what Disney does with their ticketing system, along with at the gate them taking a picture of you so they can confirm "Yes, so and so looks like the photo".

But yeah, all of this is ridiculous on its face as the cheaper and easier solution is ticket plus ID. If you are worried about flow have signs up before check in that say "be sure to have your ID ready before you get to the counter".

The ticketmaster solutions are just bad/half assed.

That is to say, if ticketmater had just done TOPS like the article points out, you'd not need the headache they've created with needing a live internet connection to load your ticket.

Re: Reverse engineering Ticketmaster's rotating barcodes

#84

Post by toomuchtodo » Mon, Jul 08, 2024, 5:10 PM UTC

storyinmemo wrote: post #56

noodlesUK wrote: post #27

This sort of ticketing thing is a trivially solvable problem. It is solved at every airport in the entire world millions of times per day. You provide the name of each concertgoer when you buy a ticket, and they show up with their ticket and ID. You often need to show your ID at these kinds of venues to prove you're old enough to drink beer anyway.

But also, the hell with this. I'm still sour enough about the TSA without the concept of, "I'll buy tickets for me and three of my friends then see who wants to go," becoming impossible or gated by ticket transfer fees.

Airlines are preventing a secondary market. Unfavorable for your use case, but also prevents scalping airline tickets (while allowing airlines to attempt to maximize revenue). There are always tradeoffs and compromise.

To hack around this, I've used Southwest Airlines; I can buy tickets for folks and if they can't travel, we cancel the ticket(s) and keep the travel funds banked for another time. I hope this is potentially helpful information.

https://simpleflying.com/why-airlines-dont-allow-name-change...

Re: Reverse engineering Ticketmaster's rotating barcodes

#85

Post by dylan604 » Mon, Jul 08, 2024, 5:10 PM UTC

725686 wrote: post #73

A few months ago I went to Las Vegas to watch U2 at the Sphere. When I learned that I needed to open the app or website in order to get in I panicked in fear of the shitty internet that is common in massive events, so I opened my tickets since I left the hotel. Unless this stuff works completely offline, it is a terrible idea.

There's no way that I trust the developers of a company like Ticketmaster to install their app on my device.

Re: Reverse engineering Ticketmaster's rotating barcodes

#86

Post by its_ethan » Mon, Jul 08, 2024, 5:10 PM UTC

munk-a wrote: post #71

probably_wrong wrote: post #67

Earlier quoted context omitted.

I'm glad we cleared that up. Now all that remains is a good, measurable definition of what a bad company is.

You're trying to get quantitative about a qualitative problem.

That's their point. They're poking fun at how the OP is speaking in absolutes about something subjective/ opinion based.

Re: Reverse engineering Ticketmaster's rotating barcodes

#87

Post by probably_wrong » Mon, Jul 08, 2024, 5:11 PM UTC

munk-a wrote: post #71

probably_wrong wrote: post #67

Earlier quoted context omitted.

I'm glad we cleared that up. Now all that remains is a good, measurable definition of what a bad company is.

You're trying to get quantitative about a qualitative problem.

The problem is that "bad company" is such a nebulous concept as to be useless, as the JSON license showed with their "shall not use this software for evil" clause.

No matter which company you choose, someone somewhere will find a justification for why they are actually not bad. Weapons dealer? Protecting your nation. Destroying local businesses? "They are just adding efficiency to the market". Kill someone with bad practices? "Still safer than the alternative". Ticketmaster? "The scalpers are giving a subvention for those who cannot afford the real price".

Setting up a straw "bad company" and knocking it down doesn't help anyone on the real problem of people working for unethical companies.

Re: Reverse engineering Ticketmaster's rotating barcodes

#88

Post by james2doyle » Mon, Jul 08, 2024, 5:11 PM UTC

shaftway wrote: post #65

james2doyle wrote: post #62

Fantastic article. Really easy to understand. Side note: this is actually a great advertisement for server side rendering! If they didn't do all this client side rendering, exposing data in JSON APIs, then I doubt this reverse engineering would have been possible.

Except then I'd need to have a good data connection at the venue, and the odds of that are infinitesimally small.

I see what you mean. The barcode wouldn't work offline.

It seems like that didn't matter at the venue though? The spotty internet connection not allowing the code to load was the first part of the article wasn't it?

Re: Reverse engineering Ticketmaster's rotating barcodes

#89

Post by crazygringo » Mon, Jul 08, 2024, 5:13 PM UTC

superfrank wrote: post #64

> I remember a time when printable tickets were ubiquitous. One could print off tickets after buying them online or even (gasp) in-person, and bring these paper tickets to get entry into the event when you arrive I go to 1-2 concerts a month so I'm well aware of how scummy TM is, but the problem with PDF tickets is that people sell fakes or sell the same ticket multiple times. I know multiple people who've been scamm…

Exactly all of this.

I found the article really interesting from a tech perspective.

And I have no love for TicketMaster, but the migration from paper/PDF tickets to scannable changing QR codes is inevitable, precisely to combat scammers.

TicketMaster does a lot of bad things, but this doesn't seem to be one of them. And learning to download the digital tickets in advance -- either to the app or your Apple wallet -- is just a thing you learn to do, the same way you learn to download a bunch of podcasts before your airline flight that charges for (or doesn't have) WiFi. (And if your ticket was a PDF, you'd similarly be stuck if you couldn't get internet at the venue and hadn't downloaded it in advance.)

Re: Reverse engineering Ticketmaster's rotating barcodes

#90

Post by __MatrixMan__ » Mon, Jul 08, 2024, 5:15 PM UTC

noodlesUK wrote: post #27

This sort of ticketing thing is a trivially solvable problem. It is solved at every airport in the entire world millions of times per day. You provide the name of each concertgoer when you buy a ticket, and they show up with their ticket and ID. You often need to show your ID at these kinds of venues to prove you're old enough to drink beer anyway.

That requires a single source of truth for which names go with which tickets. Which is going to be a problem if tickets need to be transferred in contexts where users don't have internet access (but they do have local connectivity between devices) or in contexts where the venue doesn't have internet access. Or in cases where the single source of truth might be vulnerable to attack or doesn't have the resources to handle the load at certain times.

I don't have the solution explicitly, but it seems like it ought to be possible to do this such that PII need not be collected. Tickets could be cryptographic proofs that a chain of custody exists and meets certain criteria. The proofs could be constructed at transfer time and verified at admission, no servers in the loop anywhere. Yeah, we'll come up against the CAP theorem eventually, but we might find that the imposed constraints are workable.