Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Reverse engineering Ticketmaster's rotating barcodes

conduition.io

Post reply on HN
Print view View original

711–720 of 737 posts

Re: Reverse engineering Ticketmaster's rotating barcodes

#711

Post by reddalo »

cyberbolt23 wrote: post #663
reddalo wrote: post #220

Earlier quoted context omitted.

Italy solved this. Five years ago, a new law enforced ID-checking when you enter any big events (like concerts with an audience larger than 5000 people). Tickets have your name on it, and you can only change the name or resell them through the official seller (so, third party resellers are out of the game). Also, every reselling transaction is registered and can be inspected by the Italian Rightsholder Agency (SIAE).

Because this, and more very strange rules it is very hard for ticketing systems to get into the Italian market. Some examples: - not allowed to change to time or name of the event after the 1st ticket is sold - only allowed section names in halls from a know list - free tickets on events... can only do this under strange conditions - smart card application, for encryption, must run on a physical server in Italy. You…

You know many details about Italian ticketing systems, are you working in the industry?

Re: Reverse engineering Ticketmaster's rotating barcodes

#712

Post by karttu »

mechanicalpulse wrote: post #623

Great read, though I am compelled to comment on this ad-hoc date/time conversion: $ date=$(python3 -c 'import datetime; print(datetime.datetime.fromtimestamp(1707074879).isoformat())') Consider reaching for `date` from GNU coreutils instead: $ date -Is -d @1707074879 Fewer keystrokes, faster execution, and the output includes the TZ offset.

Great article indeed, but that python line triggered me too.

It's a good reminder though. We are all smart individuals with wealth of knowledge, but we never know everything.

Re: Reverse engineering Ticketmaster's rotating barcodes

#714

Post by nativeit »

massysett wrote: post #697
Sesse__ wrote: post #689

Earlier quoted context omitted.

> If the idea behind the system was to give people a financial incentive to innovate No, it wasn't. The idea behind the system was to give people a financial incentive to be _open_. Patents are a trade with the commons; you would give up your secrets for a limited time period of exclusivity. People would innovate with or without patents, but they would keep that innovation to themselves. With software, both sides of…

U.S. Constitution at least seems to side with innovation, not openness. Constitution article 1 section 8 says Congress shall have power "To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries" This says nothing about publication, only about progress and exclusivity.

It doesn’t say anything about selling patents to third parties to abuse either. It specifies authors and inventors, and rights to their writings and discoveries. At what point does it extend those rights to a random unaffiliated attorney or corporation that engages in zero productive innovation or authorship? I agree that the argument your replying to is flawed, none of this applies to Ticketmaster here specifically, but the contemporary system absolutely is broken in several ways that were seemingly never intended by its original codification.

Re: Reverse engineering Ticketmaster's rotating barcodes

#715

Post by Teever »

mattmaroon wrote: post #698
Sesse__ wrote: post #689

Earlier quoted context omitted.

> If the idea behind the system was to give people a financial incentive to innovate No, it wasn't. The idea behind the system was to give people a financial incentive to be _open_. Patents are a trade with the commons; you would give up your secrets for a limited time period of exclusivity. People would innovate with or without patents, but they would keep that innovation to themselves. With software, both sides of…

That is an ahistorical view of the history of patents. Openness had never even occurred to anybody when patents were originally invented. Back then, it didn’t matter. Humanity hadn’t come up with much that you couldn’t figure out how it worked if you had one in your hands. It may have taken millennia to invent movable type, for example, but somebody who saw it could have copied it immediately. Its relatively recent t…

That's an absurdly reductionist take on ancient innovation.

What about chemistry that mad everything from baking recipes, optics for physics, paint for art, forging techniques... The list goes on and on.

There are so many subtle ways of doing things that were silo'd in small communities or regions.

Re: Reverse engineering Ticketmaster's rotating barcodes

#716

Post by drewmcarthur »

nativeit wrote: post #714
massysett wrote: post #697

Earlier quoted context omitted.

U.S. Constitution at least seems to side with innovation, not openness. Constitution article 1 section 8 says Congress shall have power "To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries" This says nothing about publication, only about progress and exclusivity.

It doesn’t say anything about selling patents to third parties to abuse either. It specifies authors and inventors, and rights to their writings and discoveries. At what point does it extend those rights to a random unaffiliated attorney or corporation that engages in zero productive innovation or authorship? I agree that the argument your replying to is flawed, none of this applies to Ticketmaster here specifically,…

I would support patents that could only ever belong to the actual inventor.

Re: Reverse engineering Ticketmaster's rotating barcodes

#717

Post by LorenPechtel »

garaetjjte wrote: post #601
deamanto wrote: post #409

I'd also like to highlight another bad practice by Ticketmaster. When you purchase a ticket from them and resell it on their marketplace, once someone purchases it, they(Ticketmaster) hold your funds and only give you the money ~7-14 business days after the event is over. They say this is to verify the validity of the ticket. On the buyer side, you purchase the ticket from the marketplace and it gets added to your ac…

Possibly it's fraud prevention, in case payment for the original ticket was fraudulent and chargeback occurs after the ticket is resold on marketplace?

That does sound like a very reasonable thing to do. Otherwise you have a threat vector of steal card, buy ticket, sell ticket, pocket the cash, card owner disputes, now Ticketmaster has paid a stolen identity who took the money and ran.

Anything that can be used to monetize stolen cards will tend to be used for the purpose even if it's inefficient.

Re: Reverse engineering Ticketmaster's rotating barcodes

#718

Post by LorenPechtel »

csomar wrote: post #515
lakerz16 wrote: post #94

I hate TM and ridiculous fees as much as anyone, but this article is overly hyperbolic. There's a section named "Pirating Tickets", that just explains how to re-create a barcode that you already paid for. You're not using this to rob anyone of anything. And at the end, "Have fun refactoring your ticket verification system". Why? There are no vulnerabilities here. A rotating barcode (even if following a known pattern)…

Are you sure you understood the article? The token is supposed to be a secret and the TOTP generation should happen remotely. This is not the case and this suggest a fundamental lack of security practices at the company.

Which would increase the problem he described--too many people trying to get in overloading the local bandwidth.

It's enough to defeat screenshotting and the 20 hour bit would defeat large scale malicious use.

Not good security but probably good enough, especially in stopping the resale of stolen tickets.

Re: Reverse engineering Ticketmaster's rotating barcodes

#719

Post by firewolf34 »

IncreasePosts wrote: post #412
guhcampos wrote: post #143

Earlier quoted context omitted.

Piracy here just means you can use it to sell your ticket without using their platform, which is analogous to just sending someone the PDF or handing over the piece of paper as always. While this has the upside of breaking you free from TM's obnoxious practices, it also obviously opens up for scalpers and all.

Scalping is still possible without understanding the tech - you could just stream a video of the bar codes and sell the stream instead of selling the ticket.

The whole point of their system isn't to eliminate the possibility entirely it's to make it impractical to get around for the vast majority of concert-goers, and it clearly succeeds at this.

Recording the ticket with a video is everyone's first thought at defeating their restriction, and is no doubt the first thing they thought of when designing it. Hence, the codes expiring too quickly that you'll need a new video before you get through the line at the entrance of the venue. And messing with videos in a pressured line of people in front of a bouncer, is, as others have said, simply not practical for the vast majority of cases.

So it's kind of irrelevant - practically speaking - that it is possible.

Re: Reverse engineering Ticketmaster's rotating barcodes

#720

Post by quantified »

dml2135 wrote: post #595
trustno2 wrote: post #489

Earlier quoted context omitted.

They have an effective monopoly.

On large venues for big name artists. Granted, I live in NYC, which probably has one of the most vibrant local music scenes in the country. But it's not like nowhere else has local bands that play at small venues. It feels like a lot of the people that complain about ticketmaster's monopoly have never branched out from Billboard chart artists.

There are a lot of musicians that aren't on the charts that play in Ticketmaster-controlled venues.
Post reply on HN