Reverse engineering Ticketmaster's rotating barcodes • Hacker News Board

Re: Reverse engineering Ticketmaster's rotating barcodes

#201

Post by lesuorac » Mon, Jul 08, 2024, 6:58 PM UTC

BobaFloutist wrote: post #145

jrockway wrote: post #76

Earlier quoted context omitted.

Yup exactly. Some events are pretty bad at opening the doors early. The Brooklyn Nets seem to open 30 minutes before the game, so they need to get 20,000 people through 20 metal detectors in 30 minutes. Every second extra they add to the process is a second you don't have to buy a $25 drink, and that's how they make their money. We check IDs for flights because airline yield management demands that there be no resale…

>We check IDs for flights because airline yield management demands that there be no resale, or business travelers would be traveling on leisure fares. Sorry, what? Surely business travelers pay more just by virtue of traveling by business class? Or, if travel through business portals was consistently significantly more expensive than just buying the ticket directly on the airline's website, businesses would just star…

Yeah, I don't think that's right either. They don't check your ID at the gate, it's just TSA that checks your id (if you have one).

Re: Reverse engineering Ticketmaster's rotating barcodes

#202

Post by uniq7 » Mon, Jul 08, 2024, 6:58 PM UTC

> I paid three hundred US dollars for this high-tech experience.

That's a good incentive for companies to keep up with the "high-tech experience".

Re: Reverse engineering Ticketmaster's rotating barcodes

#203

Post by gspencley » Mon, Jul 08, 2024, 7:01 PM UTC

> Shame on you for abusing your talent to exclude the technologically-disadvantaged.

Very minor nitpick: I don't like the term "technologically disadvantaged" here. While it is undoubtedly true that there are many people who are without smart phones due to economic reasons, or because their battery died or their phone was just stolen ... there are also lots of people, myself included, who would CHOOSE to forgo a smart phone when attending a concert / event.

My wife and I live in a city with a Caesar's hotel and casino within walking distance. When there are shows and concerts we are interested in, we don't hesitate to buy tickets. When we go to such a show for a date night, we would like to leave our phones at home. Some of this might be due to our being middle aged, and so we're not glued to our phones 24/7, but it's also just a hassle to bring them through security, and to often have to put them in those lock bags because they don't want people recording etc.

So to us, e-tickets are evil for no other reason than the fact that it assumes that we want to have a phone on us and to use it as a ticket. I will happily pay the fee for a physical ticket whenever available.

Re: Reverse engineering Ticketmaster's rotating barcodes

#204

Post by NavinF » Mon, Jul 08, 2024, 7:01 PM UTC

dylan604 wrote: post #191

NavinF wrote: post #127

Earlier quoted context omitted.

You don't trust your OS to sandbox it? With a threat model like that, I wouldn't use any apps other than the browser

From the AppStore: Data Linked To You: Purchases, Location, Search History, Usage Data, Financial Info, Contact Info, Identifiers, Sensitive Info. Nope Nope Nope.

That explains nothing. I'm pretty sure it's talking about info that you type into form fields in the app. Same reason FB "links" your health info even though it has no access to the health info stored by your OS.

The same applies if you use their website. It'll still ask for that info with a web form.

Re: Reverse engineering Ticketmaster's rotating barcodes

#205

Post by mattmaroon » Mon, Jul 08, 2024, 7:01 PM UTC

immibis wrote: post #170

ilrwbwrkhv wrote: post #144

Earlier quoted context omitted.

And this just proved my point. During the Nazi regime, everyone was hating the jews. And everyone was doing fascism. Now to bring this to a close, people like you, who will jump companies for 20_000 and have lost the ability to see a clear ethical violation will be holding the guns and guarding the gas chambers when the next Hitler comes along. Meditate on this. Also this XKCD is dumb. Previously the feed was chronol…

One thing I have learned from the internet is that if you mention the Nazis or the Jews, you lose, good day sir, even if you are right. People are illogical.

Yeah I was only trying to give an extreme example of someone being unethical working an immoral job, contrasting that with, say, working for Ticketmaster, which, as much as I despise them, is hard to equate with the Holocaust, given that one killed millions of civilians and one just costs me a little money. I should have known better.

They seem very different to me and anymore, I almost think that’s a valid test of the reasonable person standard.

Re: Reverse engineering Ticketmaster's rotating barcodes

#206

Post by crftr » Mon, Jul 08, 2024, 7:02 PM UTC

llsf wrote: post #192

noodlesUK wrote: post #27

This sort of ticketing thing is a trivially solvable problem. It is solved at every airport in the entire world millions of times per day. You provide the name of each concertgoer when you buy a ticket, and they show up with their ticket and ID. You often need to show your ID at these kinds of venues to prove you're old enough to drink beer anyway.

The issue is most likely about throughput. You want to let fans enter the venue as quick as possible. Most venues have lots of gates, but still the latency at each gate has to be a handful of seconds per ticket. Having to validate both ticket and ID would easily double or triple that time.

Today's digital entry experience is far from frictionless. Might as well add a scan of the PDF417 barcode on the back of the latest state ID cards.

I just went to a MLB game yesterday, and the digital process was:

    - Open ticket app
    - scan ticket 1
    - scan ticket 2

I imagine this could have been:

    - Open ticket app
    - scan PDF417
    - scan ticket 1
    - scan ticket 2

Re: Reverse engineering Ticketmaster's rotating barcodes

#207

Post by NavinF » Mon, Jul 08, 2024, 7:03 PM UTC

immibis wrote: post #184

NavinF wrote: post #127

Earlier quoted context omitted.

You don't trust your OS to sandbox it? With a threat model like that, I wouldn't use any apps other than the browser

Maybe you are using a fully open phone, but mine has an OS made by Google and almost every app tracks my location without my consent.

I'm an app dev. How exactly would I track your location without your consent?

Re: Reverse engineering Ticketmaster's rotating barcodes

#208

Post by RcouF1uZ4gsC » Mon, Jul 08, 2024, 7:03 PM UTC

> Software developers are the wizards and shamans of the modern age.

No they are not. The big difference is that wizards and shamans closely guarded their secrets to keep their position secure, while software developers will happily give them away to as many people as possible.

This means that software developers as such have close to zero leverage.

Re: Reverse engineering Ticketmaster's rotating barcodes

#209

Post by Closi » Mon, Jul 08, 2024, 7:07 PM UTC

CYR1X wrote: post #112

lakerz16 wrote: post #94

I hate TM and ridiculous fees as much as anyone, but this article is overly hyperbolic. There's a section named "Pirating Tickets", that just explains how to re-create a barcode that you already paid for. You're not using this to rob anyone of anything. And at the end, "Have fun refactoring your ticket verification system". Why? There are no vulnerabilities here. A rotating barcode (even if following a known pattern)…

It's piracy in a way that's analogous to ripping like Netflix content. You are breaking away from DRM which is piracy. They also cite the potential to have multiple tokens valid per one ticket which would let multiple people get in with the same ticket.

I doubt the second bit is true - they will still be marking the ticket as used in their backend.

They are just trying to prevent scalpers printing off tickets 10 times and selling them outside the venues as a scam, which happened at every large concert I have ever been to until recently (so I assume this is working!).

Re: Reverse engineering Ticketmaster's rotating barcodes

#210

Post by survirtual » Mon, Jul 08, 2024, 7:07 PM UTC

akira2501 wrote: post #197

RScholar wrote: post #55

> Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. This is one of the most powerful truths underlying the world we currently inhabit. The sooner we can agree to behave accordingly, the better our prospects for ripping the reigns of society from the hands of those whose only animating principles are avarice and exploitati…

> The sooner we can agree to behave accordingly People don't code out of a sense of duty, they do so to earn money, so there is no mechanism to enforce "behavior." > our prospects for ripping the reigns of society There are too many industries that take the mantle of improving society on their back. This is a mistake. There is no natural representative mechanism that ensures your actions are aligned to required outco…

Congress is useless, along with the rest of the planetary corporate-fascist oligarch facsimiles of democracy.

If software engineers united behind true ideals of freedom, we could automate the entire stack of "leadership" and raise the floor of society.

Open source implementations of:

Universal cryptographic identification

Decentralized voluntary anonymous voting, verifiable by every voter

Sovereign algorithmic monetary policy

Liquid representation

Complete digitization of all necessary information to audit any authorities, at any time

Full release of privacy for any "public official" -- service to society should be a burden, not a privilege

This, and much, much more can ALL be done with software. An entirely new paradigm of society, with freedom unalienably encoded into the fabric of the social machine.

Our rights digitized, our privacy, speech, and pursuit of happiness made into software.

I would say software may have an impact, and the thinking of this impact extends far beyond the next quarter of profits. This mindset can extend into a multi-planetary society and beyond. A continuously evolving, open source mechanism of human governance.