Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering Ticketmaster's rotating barcodes

conduition.io

Post reply on HN
Print view View original

541–550 of 737 posts

Re: Reverse engineering Ticketmaster's rotating barcodes

#541

Post by sirsinsalot »

GuB-42 wrote: post #298

Does anyone knows how Ticketmaster works, really? I have been to Ticketmaster events that use reasonably priced, printable tickets, you could even buy a printed ticket with cash. In fact, even though there are so many Ticketmaster events, they are not all working the same way. And Ticketmaster doesn't have the monopoly on shitty practices, the article gives a good example in the beginning. What I suspect is that Tick…

You're missing that Ticketmaster (Live Nation) control and own a substantial portion of the venues, the catering, logistics, tour buses, security and so on.

The venue "choosing" the Ticketmaster product is owned by Live Nation.

Re: Reverse engineering Ticketmaster's rotating barcodes

#542

Post by ssl-3 »

janalsncm wrote: post #272
orbillius wrote: post #236

Earlier quoted context omitted.

> they will still be marking the ticket as used in their backend. I assume that's true, but it makes me wonder how their scanners are connected to the server. I mean, if 10,000 people showing up to an event with smartphones overwhelms wireless networks, wont that also kick their scanners off the network? They'd probably like to have a system where, if a scanner loses its connection, it can still validate tickets. It…

Simplest answer is a private wifi network for the scanners.

It's also the best answer.

It's all off-the-shelf electronics and standard protocols. Venue provides some wifi with a "Ticketbastard" SSID (or whatever) at entry points, and the COTS-built barcode-validating devices use that. Easy-peasy.

They might also provide other wireless networks for other purposes (definitely for vendors [$$$], but perhaps also for regular house staff, touring staff, and maybe even the guests who pay for it all!), but they'll all be under the venue's control and coordination: Other than the odd personal hotspot that wanders in, there's not necessarily any meaningful outside interference on 2.4/5GHz wifi bands in a big venue.

It's pretty easy to make short-range wifi work reliably in that kind of RF environment, such as the chokepoints where tickets are validated. (Modern apartment dwellers will have worse interference problems than that.)

Re: Reverse engineering Ticketmaster's rotating barcodes

#543

Post by radsquirrel »

I worked a summer job in a Ticketmaster box office ten years ago and had access to the whole of their UK customer database in order to print off ticket collections. I’d type in a customer’s post code and up came all of the data Ticketmaster held on them… including their password in plaintext.

Re: Reverse engineering Ticketmaster's rotating barcodes

#544

Post by noirscape »

lilyball wrote: post #151
noodlesUK wrote: post #27

This sort of ticketing thing is a trivially solvable problem. It is solved at every airport in the entire world millions of times per day. You provide the name of each concertgoer when you buy a ticket, and they show up with their ticket and ID. You often need to show your ID at these kinds of venues to prove you're old enough to drink beer anyway.

Flying requires an ID. Attending a concert should not. Any solution that is solved by "simple, just require an ID" is not a solution.

Depends a lot on the country you live in. In most European countries "carrying an ID" is legally required if the police stops you anyway (they do need a reason to see it though), so "show an ID at the entrance" is no big deal.

It's to my understanding mainly the US where ID requirements are often side eyed because many people don't have them and there's no national standard (and due to a variety of political reasons there probably won't ever be any.)

Re: Reverse engineering Ticketmaster's rotating barcodes

#545

Post by account42 »

trustno2 wrote: post #489
Ocha wrote: post #434

Earlier quoted context omitted.

Just vote with your pocket and don’t buy tickets from them. I do that - yes I don’t get to go to major concerts but there are still so much more that is not on ticket master. I found a lot of new entertainment and was happy to pay $4 fee instead of whatever TM charges nowadays.

They have an effective monopoly.

... for a completely optional form of entertainment.

At the very least you have the choice not to go to any concerts until there are better options. You can also make that clear to your favorite bands.

Re: Reverse engineering Ticketmaster's rotating barcodes

#546

Post by ssl-3 »

fnfjfk wrote: post #466
lilyball wrote: post #151

Earlier quoted context omitted.

Flying requires an ID. Attending a concert should not. Any solution that is solved by "simple, just require an ID" is not a solution.

How are you getting into shows without presenting ID for age? Every (well, every legal...) venue I've been to in NYC cards to see if you are 21.

I've been to many [big, small] well-known, legit shows in the US as a kid who was not yet an adult.

I did not have an ID, and none was required to get in.

All-ages shows are definitely things that exist.

Re: Reverse engineering Ticketmaster's rotating barcodes

#547

Post by account42 »

csomar wrote: post #515
lakerz16 wrote: post #94

I hate TM and ridiculous fees as much as anyone, but this article is overly hyperbolic. There's a section named "Pirating Tickets", that just explains how to re-create a barcode that you already paid for. You're not using this to rob anyone of anything. And at the end, "Have fun refactoring your ticket verification system". Why? There are no vulnerabilities here. A rotating barcode (even if following a known pattern)…

Are you sure you understood the article? The token is supposed to be a secret and the TOTP generation should happen remotely. This is not the case and this suggest a fundamental lack of security practices at the company.

Well it's more like the "security: they want is fundamentally is incompatible with support for ofline use in this case (as long as we have open computing platforms anyway).

Re: Reverse engineering Ticketmaster's rotating barcodes

#548

Post by Phemist »

patates wrote: post #524
deamanto wrote: post #409

I'd also like to highlight another bad practice by Ticketmaster. When you purchase a ticket from them and resell it on their marketplace, once someone purchases it, they(Ticketmaster) hold your funds and only give you the money ~7-14 business days after the event is over. They say this is to verify the validity of the ticket. On the buyer side, you purchase the ticket from the marketplace and it gets added to your ac…

Maybe to stop people selling the ticket and still going to the event with a pre-printed one? Solving that would also be easy if they have a central verification system (just invalidate the ticket and issue a new one) but not if it is all p2p. (disclaimer: I'm a complete outsider, last time I bought anything from Ticketmaster was a really long time ago).

They would need to solve that anyway in case 2 or more friends attempt to get in on the same ticket.

Not at all difficult - simply share screen a third device and display the rotating QR-code through e.g. zoom on individual phones. For additional trickery, try to split the group into joining multiple ticket scanning lines and timing the scan of the ticket to be as close as possible to eachother.

Re: Reverse engineering Ticketmaster's rotating barcodes

#549

Post by ssl-3 »

immibis wrote: post #537
NavinF wrote: post #207

Earlier quoted context omitted.

I'm an app dev. How exactly would I track your location without your consent?

For example, based on my IP address, nearby wifi networks, and camera footage.

> IP address

Great. So an app can plug my IP address into a geolocation query, and might ultimately determine that I'm somewhere in $city. Or maybe the next city over. Or maybe half a continent away.

But sure, this "works" without consent, since there is no extra step to enable networking for an app.

> nearby wifi networks

This doesn't work without consent.

> camera footage

This doesn't work without consent.

Re: Reverse engineering Ticketmaster's rotating barcodes

#550

Post by thih9 »

> TicketMaster markets their SafeTix technology as a cure-all for scammers and scalpers

Scammers - yes; but how scalpers? Does this mean there is no way to resell or give the ticket to another person?

Edit: The answer was couple of sentences later; looks like yes, unless via an official marketplace. I like this even less than scalpers.

"SafeTix makes it harder for people to resell tickets outside of TicketMaster’s closed, high-margin ticket-resale marketplace, where they make a boatload of money by buying low and selling high to customers with no alternative."

Post reply on HN