Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering Ticketmaster's rotating barcodes

conduition.io

Post reply on HN
Print view View original

211–220 of 737 posts

Re: Reverse engineering Ticketmaster's rotating barcodes

#211

Post by Symbiote »

irjustin wrote: post #38

I agree with the bad implement but the opening complaining that "old way of printable tickets was great why change it" have so many problems. Scalpers are the problem that you have to accept. At the time of purchase, there's no way to tell the difference between a legit purchaser and a scalper or even someone who bought it and simply can't go and needs to resell. IDs, ticket limiters, CCs, etc, etc. All methods can b…

> Scalpers are the problem that you have to accept.

Several European countries ban reselling tickets for more than the original cost.

Re: Reverse engineering Ticketmaster's rotating barcodes

#212

Post by NavinF »

ilrwbwrkhv wrote: post #144
NavinF wrote: post #133

Earlier quoted context omitted.

https://xkcd.com/1390/ I don't see the issue. Every social media site does this, FB was just naive enough to share their research

And this just proved my point. During the Nazi regime, everyone was hating the jews. And everyone was doing fascism. Now to bring this to a close, people like you, who will jump companies for 20_000 and have lost the ability to see a clear ethical violation will be holding the guns and guarding the gas chambers when the next Hitler comes along. Meditate on this. Also this XKCD is dumb. Previously the feed was chronol…

> people like you, who will jump companies for 20_000

???

I said I don't find A/B tests unethical. Literally every tech company runs A/B tests just like that one. Why would I ask for 20k more?

> Previously the feed was chronological post of friends

Yeah, before they measured the impact of a good recommendation algorithm.

Re: Reverse engineering Ticketmaster's rotating barcodes

#213

Post by miki123211 »

mattmaroon wrote: post #105
tqi wrote: post #59

Earlier quoted context omitted.

People often buy tickets without knowing exactly which of their friends are going to attend with them. This is not true of airplane tickets.

One ID for the entire order would be fine. You can buy 4 tickets, and go into the concert with your 3 friends. It often works this way even with no ID involved, I buy two tickets, add them both to my wallet, scan them both when my GF and I go to the show. You COULD still scalp tickets if the person who bought them from you is going to walk in with you. But the scalper would have to eat the cost of one ticket to do it…

That's how trains work (here).

Every ticket must have one name and surname on it, no matter how many passengers it covers. That person must be traveling on the ticket.

You're usually asked for some kind of photo anyway because of discounts, which a very significant percentage of train riders are entitled to.

I think this is because tickets must be both printable and verifiable offline in case the train gets into a spot with no connectivity when the inspector is inspecting tickets.

Re: Reverse engineering Ticketmaster's rotating barcodes

#214

Post by reddalo »

mattmaroon wrote: post #92
RScholar wrote: post #55

> Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. This is one of the most powerful truths underlying the world we currently inhabit. The sooner we can agree to behave accordingly, the better our prospects for ripping the reigns of society from the hands of those whose only animating principles are avarice and exploitati…

I still don't blame the developers, I blame government. It's not the job of rank and file workers to police companies. I wouldn't work for LN, but I'm not going to blame someone else for doing so. We've all gotta feed our families. (I realize there's a line somewhere, you wouldn't excuse a prison guard at Auschwitz the same way, but I can't get too worked up about a developer making a ticketing app even if I hate the…

> I still don't blame the developers, I blame government.

Yes, but I think they still have some responsibility, even if they say "I was just following orders!" [1]

[1] https://en.wikipedia.org/wiki/Superior_orders

Re: Reverse engineering Ticketmaster's rotating barcodes

#215

Post by [deleted] »

immibis wrote: post #176
digging wrote: post #111

Earlier quoted context omitted.

And pretty much every company is bad. But this is a wrong answer because the question is actually nonsense. The answer to "What happens when you move faster than light" is not "nothing", it is undefined because the question is invalid. Asking if a person or a company is good or bad isn't a question that can ever have a well-defined answer: the answers we give are rounded according to our own values. To get more speci…

> Asking if a person or a company is good or bad isn't a question that can ever have a well-defined answer: the answers we give are rounded according to our own values. Counterexample: Was Hitler bad?

[deleted]

Re: Reverse engineering Ticketmaster's rotating barcodes

#216

Post by ec109685 »

dandigangi wrote: post #198

This was a fun read. I wonder if they reported it to a bug bounty program of theirs. Based on his writing how he feels about their business I'm going to guess no.

This isn’t a vulnerability. It has to work this way if offline access is permitted.

Re: Reverse engineering Ticketmaster's rotating barcodes

#217

Post by kristjansson »

jjmarr wrote: post #53
irjustin wrote: post #38

I agree with the bad implement but the opening complaining that "old way of printable tickets was great why change it" have so many problems. Scalpers are the problem that you have to accept. At the time of purchase, there's no way to tell the difference between a legit purchaser and a scalper or even someone who bought it and simply can't go and needs to resell. IDs, ticket limiters, CCs, etc, etc. All methods can b…

Buying something at a low price and selling it at a high price is arbitrage 101 and is free money. The "true solution" is to sell tickets at their actual market price instead of pretending that the face value of concert tickets isn't increasing due to a larger population and greater demand.

The market sets a clearing price for the ticket as commodity (i.e. for a single event). However, the iterated game that is the spectator-performer relationship, the seller may _strongly_ prefer yielding some of their benefit to the buyer in exchange for long term EV, positive PR, or just plain old goodwill.

The problem is maintaining a mutually-beneficial but economically suboptimal equilibria.

Re: Reverse engineering Ticketmaster's rotating barcodes

#218

Post by vjerancrnjak »

mattmaroon wrote: post #92
RScholar wrote: post #55

> Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. This is one of the most powerful truths underlying the world we currently inhabit. The sooner we can agree to behave accordingly, the better our prospects for ripping the reigns of society from the hands of those whose only animating principles are avarice and exploitati…

I still don't blame the developers, I blame government. It's not the job of rank and file workers to police companies. I wouldn't work for LN, but I'm not going to blame someone else for doing so. We've all gotta feed our families. (I realize there's a line somewhere, you wouldn't excuse a prison guard at Auschwitz the same way, but I can't get too worked up about a developer making a ticketing app even if I hate the…

Even government software has issues (Vienna). I paid a €100+ fine for not having a ticket, even though I spent time going through the purchase flow. I have 100s of tickets purchased. Live agent and support agent just shrugged and told me I don't know how to use the app, washed their hands of any responsibility or need for understanding.

It's like there's no way to make the software human and humans in the loop have a crutch to lean on to not behave as a human. When I contacted the dev team directly, they shrugged too. No refund.

To me it feels like software is the place where society can just exercise its cruelty and indifference, or maybe it is a reflection of society, it's probably just like humans are. What we think software should behave like is not human.

I had more pleasant experiences with London/UK train ticket edge cases and felt like the system is built to deal with user/server errors.

Re: Reverse engineering Ticketmaster's rotating barcodes

#219

Post by Closi »

colmmacc wrote: post #185

It's one thing for customers phones' wifi issues to be a problem, but it's an even worse problem if the scanner itself needs reliable connectivity. That makes me wonder if there is some kind of delegated deterministic derivation step in the secrets too (which wouldn't be obvious in this kind of analysis), so that the handheld scanners can avoid an on-line dependency.

They needed reliable connectivity in the previous scenario (checking barcodes against a central db) - they just setup a local private wifi network for the handsets and all the venue devices.

Otherwise I can't see how you would avoid replay attacks.

Re: Reverse engineering Ticketmaster's rotating barcodes

#220

Post by reddalo »

noodlesUK wrote: post #27

This sort of ticketing thing is a trivially solvable problem. It is solved at every airport in the entire world millions of times per day. You provide the name of each concertgoer when you buy a ticket, and they show up with their ticket and ID. You often need to show your ID at these kinds of venues to prove you're old enough to drink beer anyway.

Italy solved this. Five years ago, a new law enforced ID-checking when you enter any big events (like concerts with an audience larger than 5000 people).

Tickets have your name on it, and you can only change the name or resell them through the official seller (so, third party resellers are out of the game). Also, every reselling transaction is registered and can be inspected by the Italian Rightsholder Agency (SIAE).

Post reply on HN