Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering Ticketmaster's rotating barcodes

conduition.io

Post reply on HN
Print view View original

591–600 of 737 posts

Re: Reverse engineering Ticketmaster's rotating barcodes

#591

Post by TylerE »

hunter2_ wrote: post #262
donalhunt wrote: post #246

Earlier quoted context omitted.

You would hope... But they often run the scanners in offline mode (e.g. at temporary / seasonal events) so there can be lag in the backends being updated. Heard from a friend who got straight into two events in the same city recently - they presumed the show was at one outdoor venue but the scanners let them straight in at the first (wrong) venue. Went to the correct venue and got in there without any issue too (this…

Hm. So I guess at a small venue that has 3 door people with offline scanners, you have a 2/3 chance of success if you're the second of two people sharing a barcode. Combined with the obvious 3/3 success being the first person, that averages out to 5/6 chance if both of you (oblivious to each other) schedule your arrival similarly.

My experience from visiting many many of them is that 80-90% of small venues don’t even bother with scanners.

Re: Reverse engineering Ticketmaster's rotating barcodes

#592

Post by digging »

__MatrixMan__ wrote: post #340
digging wrote: post #111

Earlier quoted context omitted.

And pretty much every company is bad. But this is a wrong answer because the question is actually nonsense. The answer to "What happens when you move faster than light" is not "nothing", it is undefined because the question is invalid. Asking if a person or a company is good or bad isn't a question that can ever have a well-defined answer: the answers we give are rounded according to our own values. To get more speci…

It doesn't need a well defined evaluation scheme. You're the one asking the question, you can provide your own scheme, and come up with your own answer. Whether you're honest with yourself in this process is up to you. It's still useful to point out that IF you think your company is bad THEN you should do something about that. It establishes that "I was just following orders that I know are wrong" isn't a valid excus…

> You're the one asking the question, you can provide your own scheme

Well, I'm responding to someone else providing their scheme for everyone else to use.

Re: Reverse engineering Ticketmaster's rotating barcodes

#593

Post by digging »

Dylan16807 wrote: post #471
digging wrote: post #111

Earlier quoted context omitted.

And pretty much every company is bad. But this is a wrong answer because the question is actually nonsense. The answer to "What happens when you move faster than light" is not "nothing", it is undefined because the question is invalid. Asking if a person or a company is good or bad isn't a question that can ever have a well-defined answer: the answers we give are rounded according to our own values. To get more speci…

> the answers we give are rounded according to our own values I agree with this entirely. And rounding does not change the answer in most situations. Something that isn't well-defined can still be mostly-defined. I have no idea what the point of that strawman is in your last paragraph. It doesn't make sense with or without rounding. Maybe if you round every single value to infinity, but that's not what "rounding" nor…

I honestly don't know how to respond to this, it's too vague.

Re: Reverse engineering Ticketmaster's rotating barcodes

#594

Post by rbits »

csomar wrote: post #515
lakerz16 wrote: post #94

I hate TM and ridiculous fees as much as anyone, but this article is overly hyperbolic. There's a section named "Pirating Tickets", that just explains how to re-create a barcode that you already paid for. You're not using this to rob anyone of anything. And at the end, "Have fun refactoring your ticket verification system". Why? There are no vulnerabilities here. A rotating barcode (even if following a known pattern)…

Are you sure you understood the article? The token is supposed to be a secret and the TOTP generation should happen remotely. This is not the case and this suggest a fundamental lack of security practices at the company.

> the TOTP generation should happen remotely.

It says that it is available offline (if you've viewed it in the last 20 hours), so the TOTP generation can't happen remotely

Re: Reverse engineering Ticketmaster's rotating barcodes

#595

Post by dml2135 »

trustno2 wrote: post #489
Ocha wrote: post #434

Earlier quoted context omitted.

Just vote with your pocket and don’t buy tickets from them. I do that - yes I don’t get to go to major concerts but there are still so much more that is not on ticket master. I found a lot of new entertainment and was happy to pay $4 fee instead of whatever TM charges nowadays.

They have an effective monopoly.

On large venues for big name artists.

Granted, I live in NYC, which probably has one of the most vibrant local music scenes in the country. But it's not like nowhere else has local bands that play at small venues.

It feels like a lot of the people that complain about ticketmaster's monopoly have never branched out from Billboard chart artists.

Re: Reverse engineering Ticketmaster's rotating barcodes

#596

Post by dml2135 »

sofixa wrote: post #518
mattmaroon wrote: post #446

Earlier quoted context omitted.

I don’t think that’s accurate. They’ve successfully handled plenty of anti trust issues in the past and very recently got on this one.

When was the last time they did it?

Biden's FTC and Justice Department are in the process of suing Apple, Facebook, and Google for antitrust violations. And Ticketmaster.

Re: Reverse engineering Ticketmaster's rotating barcodes

#597

Post by OJFord »

TrinaryWorksToo wrote: post #582
Steven420 wrote: post #574

Earlier quoted context omitted.

If you don't have a patent on an invention then how do you protect it from people who will just steal what you have spent time/money creating?

Patents no longer go to individual people. They go to corporations. Perhaps we should ban corporations from getting patents on behalf of people.

That would be.. interesting from a compensation & retention (& poaching!) perspective!

Re: Reverse engineering Ticketmaster's rotating barcodes

#598

Post by dml2135 »

poet123432 wrote: post #578
radsquirrel wrote: post #543

I worked a summer job in a Ticketmaster box office ten years ago and had access to the whole of their UK customer database in order to print off ticket collections. I’d type in a customer’s post code and up came all of the data Ticketmaster held on them… including their password in plaintext.

I had to create an account just to reply to this; as much as TM has it's faults this is just false, it does not store passwords in any reversible way or at least hasn't for more than 2 years and all evidence removed. Source: I am an engineer within TM that has worked on integration between various booking products in the UK market.

As an engineer within Ticketmaster, I'd be curious to hear your take on the conclusion of the article.

> I think we can all agree: Fuck TicketMaster. I hope their sleazy product managers and business majors read this and throw a tantrum. I hope their devs read this and feel embarrassed. It’s rare that I feel genuine malice towards other developers, but to those who designed this system, I say: Shame.

> Shame on you for abusing your talent to exclude the technologically-disadvantaged.

> Shame on you for letting the marketing team dress this dark-pattern as a safety measure.

> Shame on you for supporting a company with such cruel business practices.

> Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. You’re using them to exclude people from entertainment events.

> Have fun refactoring your ticket verification system.

Re: Reverse engineering Ticketmaster's rotating barcodes

#599

Post by bonestamp2 »

cbsmith wrote: post #426
bonestamp2 wrote: post #398

Earlier quoted context omitted.

Actually, TicketMaster was involved in each transaction. Let's revisit the first paragraph: "TicketMaster is taking massive fees each time the same ticket is sold." I'll lay it out in detail so it's more clear: TicketMaster sold the original ticket to the scalper. Then the scalper listed the ticket on TicketMaster's secondary market. Then I bought the ticket on TicketMaster's secondary market and TicketMaster collect…

Yes, I misunderstood what you wrote. There are plenty of scalpers who sell tickets outside of TicketMaster, despite their best efforts. Do you think the $50/ticket fee that you paid would have been lower if you'd done your transaction outside of TicketMaster's platform?

I have purchased secondary tickets outside of TicketMaster many times and the fee has always been lower. But, that's anecdotal of course... there's no reason why they couldn't be higher. But, let's leave the actual fee amount aside for a moment...

I'm slightly less concerned with the actual amount of the fee and more concerned with the fact that ticket scalping has apparently become legal and that the original ticket seller is not only in on it, but getting even higher fees on the scalped tickets than the original tickets.

It's disturbing that it's illegal to scalp a single ticket in person outside an event, but if someone does it online with hundreds of tickets then they're a "ticket broker" and that's legal (in California at least).

Re: Reverse engineering Ticketmaster's rotating barcodes

#600

Post by withinboredom »

lakerz16 wrote: post #94

I hate TM and ridiculous fees as much as anyone, but this article is overly hyperbolic. There's a section named "Pirating Tickets", that just explains how to re-create a barcode that you already paid for. You're not using this to rob anyone of anything. And at the end, "Have fun refactoring your ticket verification system". Why? There are no vulnerabilities here. A rotating barcode (even if following a known pattern)…

He was basically wondering if he could create two tickets each with different tokens. Tokens are valid for 20 hours but it probably doesn’t invalidate the old token (e.g. a request for a new token makes it to the internet but due to congestion, the response never comes back to your phone before timing out) and this could trigger multiple tokens for the same ticket and are all valid.
Post reply on HN