4 ms·
This is a case where the airline should sign the information in the QR code. Lounges get the airlines' public keys and pick the one for the passenger's flight a
by curun1r 9y ago
This is a case where the airline should sign the information in the QR code. Lounges get the airlines' public keys and pick the one for the passenger's flight and, after verifying the signature, can trust the information in the QR code. No API access necessary.
Don't over think, just use HMAC. It's disturbing how often that advice is needed.
- tyingq 9y agoYes, that's a solution, but the boarding pass is used by different entities like the TSA. So it's unsurprisingly a big political event to change what's encoded. It's similarly surprising how often devs think the problem is solely technical :)
- saryant 9y agoAFAIK the portion of the barcode related to the TSA actually is signed in some cases. That's part of the integration required for airlines to let their passengers use TSA PreCheck.