super entertaining read! many thanks.
Reverse engineering Ticketmaster's rotating barcodes
91–100 of 737 posts
Re: Reverse engineering Ticketmaster's rotating barcodes
#92> Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. This is one of the most powerful truths underlying the world we currently inhabit. The sooner we can agree to behave accordingly, the better our prospects for ripping the reigns of society from the hands of those whose only animating principles are avarice and exploitati…
I still don't blame the developers, I blame government. It's not the job of rank and file workers to police companies. I wouldn't work for LN, but I'm not going to blame someone else for doing so. We've all gotta feed our families. (I realize there's a line somewhere, you wouldn't excuse a prison guard at Auschwitz the same way, but I can't get too worked up about a developer making a ticketing app even if I hate the ticketing company.)
Developed countries long ago came to the conclusion that companies should not be allowed to have monopolies because it is bad for society as a whole, and it's hard to think of a current monopoly as egregious as this one. There is absolutely no reason one company should have exclusive rights to 85% of large venues, also be an evebt promoter, and also be the ticket seller.
Anything their developers do is not the real issue, a society that allows this to happen in the first place is.
Re: Reverse engineering Ticketmaster's rotating barcodes
#93A few months ago I went to Las Vegas to watch U2 at the Sphere. When I learned that I needed to open the app or website in order to get in I panicked in fear of the shitty internet that is common in massive events, so I opened my tickets since I left the hotel. Unless this stuff works completely offline, it is a terrible idea.
I used to work or a mobile event app company that made a lot of the big festival/conference apps. Everything was built to function locally from a sqlite file on your phone that was constantly updated when you did have coverage.
It was 100% expected that you would have no cell signal the entire event and we built in as many mitigations as we could think of.
This was 2013ish, I think there are a lot more mesh network devices that can relay signal nowadays but I'm not involved anymore in that stuff.
It was the best on-call I've ever had because.. nobody had cell signal while the event was on to complain about something.
This person complains that people didn't have network access on their phones when they were at the gate. I can only assume that they waited till they were at the gate to install/use the app so it never got its offline data.
Always open your event apps before getting to the event. Sometimes they're completely bare bones and have to reach out and pull that apps specific database so its sure you have the latest. Most of the event apps are a template that is modified for each event and just has different assets/sqlite.
Re: Reverse engineering Ticketmaster's rotating barcodes
#94I hate TM and ridiculous fees as much as anyone, but this article is overly hyperbolic.
There's a section named "Pirating Tickets", that just explains how to re-create a barcode that you already paid for. You're not using this to rob anyone of anything.
And at the end, "Have fun refactoring your ticket verification system". Why? There are no vulnerabilities here. A rotating barcode (even if following a known pattern) is still more secure than a static barcode on a piece of paper.
Re: Reverse engineering Ticketmaster's rotating barcodes
#95Earlier quoted context omitted.
"Responsible disclosure" is poorly defined corporate wishcasting, and certainly not any sort of best practice or legal shield.
The public prosecutor does not pursue cases where responsible aka coordinated vulnerability disclosure was applied. I'd say that's a legal shield of some kind at least, and it is generally also considered best practice in the industry. There's exceptions to everything but, in the general case, I'm not sure where you're getting these viewpoints from
[deleted]
Re: Reverse engineering Ticketmaster's rotating barcodes
#96Re: Reverse engineering Ticketmaster's rotating barcodes
#97Earlier quoted context omitted.
I have to presume that the driving impetus of all of this is that they're trying to avoid the actual requirement of checking the ID. Like, they want to improve the flow of traffic through admissions. But I mean, obviously, any kind of system like this strikes me as the same sort of thing as DRM. That you can somehow protect the message from the person you're sharing the message to. How can you avoid reselling if you…
So even if you don't want to do the ID thing, there are alternatives that you see all over the place (like venmo) Have a rotating QR code seeded with a unique to the user id. Then with ticket master, require a login to buy tickets. Register the tickets to the ID and then do the lookup with a combination of the ticket id, rotating qr code, and the user id. That requires the admitter device to send the challenge back t…
You don't understand how people at their companies evaluate stuff like this.
Any solution that increases capital or operating expenditures for them or the venues (half of whom they own, if I remember correctly?) is a non-starter if it doesn't generate some increase in revenue.
They will not do anything they don't have to do if it means any impact to their bottom line whatsoever.
We see it as "pennies per transaction."
They see it as "we sell 500M tickets per year so five cents per transaction is $25M/year in lost net."
Re: Reverse engineering Ticketmaster's rotating barcodes
#98> Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. This is one of the most powerful truths underlying the world we currently inhabit. The sooner we can agree to behave accordingly, the better our prospects for ripping the reigns of society from the hands of those whose only animating principles are avarice and exploitati…
It’s interesting, the more we agree and hold strong, the higher the demand grows for engineers who would help some companies create their hellscape. The incentive will grow higher and higher until people break rank. And you start over.
Re: Reverse engineering Ticketmaster's rotating barcodes
#99Earlier quoted context omitted.
The fact we have had less than benevolent wizards and shamans, why would we expect to have modern day equivalent of only benevolent coders? It's such a fairy tale level of expectation that it seems childish. Spending any energy in trying to make real world a fairy tale is just wasted.
It's okay to shame bad actors. In fact, society would likely be better off if e brought back more public shaming
I think that this is predicated upon a reasonably well informed and educated public. And my estimation is that the general populous is not informed enough on cryptography to be in a position to shame Ticketmaster engineers.
Also, my impression is that there is already copious amounts of public shaming. Some social media sites seem largely devoted to that. And unfortunately, I don't think most people fully deserve the verdict that they get in the court of public opinion.
Re: Reverse engineering Ticketmaster's rotating barcodes
#100> Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. This is one of the most powerful truths underlying the world we currently inhabit. The sooner we can agree to behave accordingly, the better our prospects for ripping the reigns of society from the hands of those whose only animating principles are avarice and exploitati…
The fact we have had less than benevolent wizards and shamans, why would we expect to have modern day equivalent of only benevolent coders? It's such a fairy tale level of expectation that it seems childish. Spending any energy in trying to make real world a fairy tale is just wasted.
We wouldn't. You might expect that on an indivudual level. But at a society level, I would expect any company that's doing things that are specifically allowed by our goverment (who did approve the Ticketmaster Live Nation Merger) to get their jobs filled just like any other. I think Ticketmaster is evil, another developer might not. That's fine, they're not killing people or dumping toxic chemicals into reservoirs, we can agree to disagree.
My outrage is directed entirely at the government agencies whose job it was to stop this, not the developers making a ticketing app.