Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering Ticketmaster's rotating barcodes

conduition.io

Post reply on HN
Print view View original

651–660 of 737 posts

Re: Reverse engineering Ticketmaster's rotating barcodes

#651

Post by toomuchtodo »

BenjiWiebe wrote: post #618
toomuchtodo wrote: post #583

Earlier quoted context omitted.

People who compare Southwest to Frontier and Spirit are not serious people. Southwest is a premium offering, if folks want to ride cattle car a la carte, I encourage them to, just don't ruin the established brand of SWA. I would rather fly dead on Southwest than alive on another domestic carrier.

First I've heard of southwest being a premium option. Even Wikipedia lists it as a budget airline.

Value is subjective. I'm going to pay for business or first when the whole plane gets there at the same time? Nah, I'm paying for a great experience if something goes wrong, bags included, and reliable air travel between two points. It's low key white glove service in a world of race to the bottom customer service and trying to remove every touchpoint possible between the business and the customer to save pennies.

https://community.southwest.com/t5/Blog/Southwest-Airlines-R...

https://www.nerdwallet.com/article/travel/is-southwest-airli...

Re: Reverse engineering Ticketmaster's rotating barcodes

#652

Post by llsf »

627467 wrote: post #410
llsf wrote: post #192

Earlier quoted context omitted.

The issue is most likely about throughput. You want to let fans enter the venue as quick as possible. Most venues have lots of gates, but still the latency at each gate has to be a handful of seconds per ticket. Having to validate both ticket and ID would easily double or triple that time.

I keep reading about this argument but Olympics and World Cup matches are arguably as large events (if not larger) and they place name on ticket and check ID at entrance. people complain at ticketmaster yet seem to bend over backwards to justify the state of affairs

Not sure how they do it for Olympics and World Cup, they probably compensate with more gates/scanners than a typical venue. I am not advocating either way, which is either keep a ticket anonymous, or tie a ticket to an ID. I guess Ticketmaster would love to tie tickets to ID, so they would know the customers better.

If/when https://nfc-forum.org/news/2024-07-nfc-forum-defines-next-ge... gets implemented by Apple/Google then we could one phone tap, get the ID, the ticket and verify that they match.

But I have no idea when Apple or Google would implement those ?

Re: Reverse engineering Ticketmaster's rotating barcodes

#653

Post by worik »

lakerz16 wrote: post #564
csomar wrote: post #515

Earlier quoted context omitted.

Are you sure you understood the article? The token is supposed to be a secret and the TOTP generation should happen remotely. This is not the case and this suggest a fundamental lack of security practices at the company.

"Should happen remotely" – according to who? What is the security risk for the end-user? "this suggest a fundamental lack of security practices at the company" – that's a stretch of a conclusion to make. You're being as hyperbolic as the original post. What didn't I understand about the article? This still offers a slight increase in security over static barcodes, without introducing any new vulnerabilities.

> This still offers a slight increase in security over static barcodes, without introducing any new vulnerabilities

It offers nothing to the user, except taking away their rights, and making it all unreliable

Re: Reverse engineering Ticketmaster's rotating barcodes

#654

Post by llsf »

mixmastamyk wrote: post #453
627467 wrote: post #410

Earlier quoted context omitted.

I keep reading about this argument but Olympics and World Cup matches are arguably as large events (if not larger) and they place name on ticket and check ID at entrance. people complain at ticketmaster yet seem to bend over backwards to justify the state of affairs

You can rely on TM to do whatever makes the most money, and they probably know better than us. Also those you list are typically higher security events.

Yes, some events are different, like the Super Bowl for instance, where everyone is screened, and a simple concert, where you just need a ticket that scans.

Re: Reverse engineering Ticketmaster's rotating barcodes

#655

Post by llsf »

crftr wrote: post #206
llsf wrote: post #192

Earlier quoted context omitted.

The issue is most likely about throughput. You want to let fans enter the venue as quick as possible. Most venues have lots of gates, but still the latency at each gate has to be a handful of seconds per ticket. Having to validate both ticket and ID would easily double or triple that time.

Today's digital entry experience is far from frictionless. Might as well add a scan of the PDF417 barcode on the back of the latest state ID cards. I just went to a MLB game yesterday, and the digital process was: - Open ticket app - scan ticket 1 - scan ticket 2 I imagine this could have been: - Open ticket app - scan PDF417 - scan ticket 1 - scan ticket 2

Hopefully in the near future (https://nfc-forum.org/news/2024-07-nfc-forum-defines-next-ge...) you would just need to tap you phone once, and get your ID passed to the scanner, along all the tickets for that venue & time.

No more opening app, and showing different tickets and IDs.

That would clear that argument.

Re: Reverse engineering Ticketmaster's rotating barcodes

#656

Post by fallingknife »

ipsum2 wrote: post #500
mixmastamyk wrote: post #423

Earlier quoted context omitted.

Wonder no more—yes.

Do you work at ticketmaster? Otherwise, how do you confirm this?

1. ticket master holds the money for 14 days before paying the customer

2. there are a lot of customers

3. therefore ticket master holds lots of customer cash in transit (this is called the "float")

4. cash earns 5% interest so this year they will earn about 5% * avg float

Re: Reverse engineering Ticketmaster's rotating barcodes

#657

Post by bjclark »

guhcampos wrote: post #143
lakerz16 wrote: post #94

I hate TM and ridiculous fees as much as anyone, but this article is overly hyperbolic. There's a section named "Pirating Tickets", that just explains how to re-create a barcode that you already paid for. You're not using this to rob anyone of anything. And at the end, "Have fun refactoring your ticket verification system". Why? There are no vulnerabilities here. A rotating barcode (even if following a known pattern)…

Piracy here just means you can use it to sell your ticket without using their platform, which is analogous to just sending someone the PDF or handing over the piece of paper as always. While this has the upside of breaking you free from TM's obnoxious practices, it also obviously opens up for scalpers and all.

Piracy here means that you can sell 50k tickets to the same seat with a real valid rotating barcode.

Re: Reverse engineering Ticketmaster's rotating barcodes

#658

Post by vel0city »

BenjiWiebe wrote: post #618
toomuchtodo wrote: post #583

Earlier quoted context omitted.

People who compare Southwest to Frontier and Spirit are not serious people. Southwest is a premium offering, if folks want to ride cattle car a la carte, I encourage them to, just don't ruin the established brand of SWA. I would rather fly dead on Southwest than alive on another domestic carrier.

First I've heard of southwest being a premium option. Even Wikipedia lists it as a budget airline.

Flying on Southwest is generally a more pleasant experience than flying economy on United, American, or any of the other major carriers IMO. It won't beat flying business class or whatever though, but I'm not that rich.

The seats are more comfortable. Every plane has pretty good in-flight WiFi (paid) and free movies/TV you can watch on your own device. Drinks and snacks included. Two checked bags free. About the only thing I miss from the big carriers is charging/power outlets at the seats, but I hear that's coming.

Re: Reverse engineering Ticketmaster's rotating barcodes

#659

Post by digging »

Dylan16807 wrote: post #636
digging wrote: post #629

Earlier quoted context omitted.

Appreciate the explanation. > Then for some reason you acted like "rounding" turns things into strawman-level black and white. The slightest blemish (not hiring a specific good person) qualifying as evil. This was in direct response to the top-level comment making that very assertion (via a blog post). If I'm understanding you correctly, I think we're actually agreeing that it's absurd. The CEO of a "good" company in…

I'm saying that your argument is absurd, but the one in the blog post is not absurd. You made a strawman. "A good person is obligated to quit a bad company." is a far more reasonable statement than "A good company is obligated to hire every good person." > Also, with regard to your scale - you've given the question too much credit. The question doesn't ask "how much are you good or bad?", it asks and receives a binar…

Alright. I just don't agree with you then. "A good person is obligated to quit a bad company" is a bullshit statement, unless the bar for "bad company" is a lot higher than I see it. I already asserted at the very beginning of the comment chain, almost every company is bad. That went unchallenged, so if that's the context, almost every person is bad, no matter how much they do good in the world. That is absurd.

Re: Reverse engineering Ticketmaster's rotating barcodes

#660

Post by CobrastanJorji »

dml2135 wrote: post #598
poet123432 wrote: post #578

Earlier quoted context omitted.

I had to create an account just to reply to this; as much as TM has it's faults this is just false, it does not store passwords in any reversible way or at least hasn't for more than 2 years and all evidence removed. Source: I am an engineer within TM that has worked on integration between various booking products in the UK market.

As an engineer within Ticketmaster, I'd be curious to hear your take on the conclusion of the article. > I think we can all agree: Fuck TicketMaster. I hope their sleazy product managers and business majors read this and throw a tantrum. I hope their devs read this and feel embarrassed. It’s rare that I feel genuine malice towards other developers, but to those who designed this system, I say: Shame. > Shame on you f…

Everybody has their own personal lines in the sand. People need to work for a living because we're not in a magical, post-need society. Every company has its flaws. Each company has some subjective amount of flaws/sins/evil, and everybody makes their own decision about what they're willing to do for money.

Helping a company use some sleazy dark patterns to make some extra money off of Taylor Swift tickets is honestly pretty mild on the scale of evil software engineering jobs, so I imagine their answer is "I built a system to sell entertainment, now my kids get to go to private school, and I sleep great at night."

Ticketmaster sucks, but it's not like he's working for Palantir, Lockheed Martin, or TikTok.

Post reply on HN