CAPTCHAs are over (in ticketing)
behind.pretix.eu
CAPTCHAs are over (in ticketing)
1–10 of 285 posts
Re: CAPTCHAs are over (in ticketing)
#2One option that I not see discussed in the blog post: Collecting user signals locally and using those access patterns (mouse movement, clicks, IP/site browsing history) to discriminate between "standard" site usage and bots; so like a "reCaptcha lite", not trained across many sites but trained specifically on the target.
For a ticket platform like pretix that can be run self-hosted alongside the main site, this should give you enough signals to discriminate between normal users and bots, unless they are specifically targeting that site, or am I mistaken? Even just pure web server access logs may be sufficient on smaller sites so this might work even without JS?
Re: CAPTCHAs are over (in ticketing)
#3Unfortunately, the solution to something like this is more intense KYC and lawsuits.
You don't defend at the web, you defend in the courtroom and bank.
I assume it's too expensive or the ticket sellers don't actually care, they just want to think they care.
Re: CAPTCHAs are over (in ticketing)
#4>Most organizers, including for-profit organizations, do not want to choose this option due to ethical concerns or concerns about community building.
The alternative is selling the tickets to scalpers which doesn't seem ethically better or better at community building as compared to directly selling it to fans.
Even if you assign tickets to IDs scalpers will sell access to bots instead to capture the delta between market price and the price the ticket is being sold for.
Re: CAPTCHAs are over (in ticketing)
#5One option that I not see discussed in the blog post: Collecting user signals locally and using those access patterns (mouse movement, clicks, IP/site browsing history) to discriminate between "standard" site usage and bots; so like a "reCaptcha lite", not trained across many sites but trained specifically on the target. For a ticket platform like pretix that can be run self-hosted alongside the main site, this shoul…
This seems pretty well covered by the post?
Doing any kind of access pattern analysis leaves you with the problem of handling false positives, and your proposal doesn't help with the accessibility problems.
IP addresses aren't a panacea here -- this is a high margin business where the attackers can switch to high cost / high quality proxies.
> unless they are specifically targeting that site
In this case the attackers would very specifically be targeting specific sites (ones selling tickets to events with more demand than supply).
Re: CAPTCHAs are over (in ticketing)
#6>Most organizers, including for-profit organizations, do not want to choose this option due to ethical concerns or concerns about community building. The alternative is selling the tickets to scalpers which doesn't seem ethically better or better at community building as compared to directly selling it to fans. Even if you assign tickets to IDs scalpers will sell access to bots instead to capture the delta between ma…
Sell the tickets with a decreasing price - early tickets are very expensive, late tickets are not, and hold back between 10% and 20% until day of sale at the lowest price.
Make the scalping bastards choke on it, and break FOMO all at once.
Re: CAPTCHAs are over (in ticketing)
#7Unfortunately, the solution to something like this is more intense KYC and lawsuits. You don't defend at the web, you defend in the courtroom and bank. I assume it's too expensive or the ticket sellers don't actually care, they just want to think they care.
you defend at the ID system. anonymous cert chain ID fixes this. the u.s is defined by its fraudulent business and therefore no one in power wants it.
Re: CAPTCHAs are over (in ticketing)
#8What about limiting the number of tickets per card?
Or do what airlines do and you need to declare who is using the ticket. Maybe allow exchange for up to 50% of a party.
Then the scalpers can't win but there is still a DOS problem to solve.
Maybe a card auth -> reserve seats -> complete txn flow would help there. The card auth rate limits the amount of unbooked but temporary reserved tickets.
Re: CAPTCHAs are over (in ticketing)
#9What about limiting the number of tickets per card? Or do what airlines do and you need to declare who is using the ticket. Maybe allow exchange for up to 50% of a party. Then the scalpers can't win but there is still a DOS problem to solve. Maybe a card auth -> reserve seats -> complete txn flow would help there. The card auth rate limits the amount of unbooked but temporary reserved tickets.
> What about limiting the number of tickets per card?
discussed in TFA
> Or do what airlines do and you need to declare who is using the ticket
ditto
Re: CAPTCHAs are over (in ticketing)
#10I'd rather see bot resistance (important for everyone) and privacy (important for everyone) take precedence over accessibility (important for a small minority) and have laws change to reflect that.