Reverse engineering Ticketmaster's rotating barcodes

Post by [deleted] » Tue, Jul 09, 2024, 9:34 AM UTC

colmmacc wrote: post #324

Closi wrote: post #219

Earlier quoted context omitted.

They needed reliable connectivity in the previous scenario (checking barcodes against a central db) - they just setup a local private wifi network for the handsets and all the venue devices. Otherwise I can't see how you would avoid replay attacks.

You can do time-based binding. Many TLS/Quic 0RTT take this approach; where the signature is only valid for a second or so. It's not as good as a real strike register, but probably ok for this kind of environment. Of course the barcodes would need to be more dynamic, but that's doable.

Post by greenish_shores » Tue, Jul 09, 2024, 9:52 AM UTC

giaour wrote: post #156

lakerz16 wrote: post #135

Earlier quoted context omitted.

I'd argue that a few extra people sneaking in on the same ticket (assuming this is even possible) is more like sharing your Netflix credentials than ripping Netflix content and having it be shareable with the entire world. You're also walking into a stadium/concert in plain view of security cameras, so the stakes and deniability are different as well.

Not a lawyer, but "subverting DRM" (even if it's trivial or really stupidly designed) can be a crime in and of itself in the US under the DMCA. There are a bunch of exceptions to this, so I have no idea if OP's work is actually illegal.

Post by gorbachev » Tue, Jul 09, 2024, 9:56 AM UTC

noodlesUK wrote: post #27

This sort of ticketing thing is a trivially solvable problem. It is solved at every airport in the entire world millions of times per day. You provide the name of each concertgoer when you buy a ticket, and they show up with their ticket and ID. You often need to show your ID at these kinds of venues to prove you're old enough to drink beer anyway.

Post by immibis » Tue, Jul 09, 2024, 10:11 AM UTC

NavinF wrote: post #207

immibis wrote: post #184

Earlier quoted context omitted.

Maybe you are using a fully open phone, but mine has an OS made by Google and almost every app tracks my location without my consent.

I'm an app dev. How exactly would I track your location without your consent?

Post by sirsinsalot » Tue, Jul 09, 2024, 10:15 AM UTC

trustno2 wrote: post #489

Ocha wrote: post #434

Earlier quoted context omitted.

Just vote with your pocket and don’t buy tickets from them. I do that - yes I don’t get to go to major concerts but there are still so much more that is not on ticket master. I found a lot of new entertainment and was happy to pay $4 fee instead of whatever TM charges nowadays.

They have an effective monopoly.