21 ms·

Reverse engineering Ticketmaster's rotating barcodes

• fwaz7snm7mdm7md 2y ago
  1000
• haburka 2y ago
  Isn’t this a bit like irresponsible disclosure? Since this may be considered a security vulnerability. Although it’s all client side, I’m sure there’s some basis for a lawsuit here.
  • bangaladore 2y ago
    It is my opinion that you do not need to responsibly disclose "security by obscurity" Additionally, what is irresponsible here? Its not like this gives you the capability to clone tickets without first having a ticket in the first place.
  • AlotOfReading 2y ago
    How is this a security vulnerability? It's displaying the exact bits Ticketmaster uses and explaining what those bits are. They're not circumventing security systems, just the requirement to use the app.
  • efitz 2y ago
    The app-based barcodes don’t seem to be solving a security problem for customers - they seem to be for the purpose of ensuring that traditional scalping doesn’t work, forcing ticket resale into a market that TicketMaster can profit from. I would consider it unethical to publish details of an unpatched vulnerability that allowed ticket forgery, but I don’t think it’s unethical to bypass DRM-like controls for personal convenience rather than commercial purposes. Of course opinions may differ on this.
  • willcipriano 2y ago
    Responsible disclosure is something you pay for, not something you are entitled to.
  • jjcm 2y ago
    It requires sniffing your own session credentials first, which I don't see as a security vulnerability. The only thing it allows you to do is sell your ticket, which is legal to do.
  • Thaxll 2y ago
    Everyone want Ticketmaster to die.
    • criddell 2y ago
      Except for a lot of performers and venue operators. Ticketmaster is paid well to be the bad guy. They often share the fees with both the performer and the venue.
      • magnetowasright 2y ago
        I'm sorry to be that guy but do you have literally any source for this? Might just be the musicians I like, or the fact that negativity is better for clicks, but I've never seen an artist saying they get any benefit from ticketmaster's fees and other such shenanigans; I've only seen artists and venues saying that they don't get any money or benefits at all from ticketmaster's racketeering.
        • criddell 2y ago
          From the Ticketmaster website: > ticket fees (which can include a service fee, order processing fee, and the occasional delivery fee) are determined by and shared between the parties who have a hand in making live events happen including venues, Ticketmaster, sports teams, leagues and promoters When the artist doesn't want their fans to be charged big fees - they have some say in it. Robert Smith of The Cure made a stand on this last year and got Ticketmaster to refund a bunch of money.
          • rty32 2y ago
            > they have some say in it That's a very carefully crafted sentence. How much, exactly, do artists have a say? Do artists equally have the same amount of "say"? And why are we even discussing all these nonsense in the first place?
  • 12_throw_away 2y ago
    "Responsible disclosure" is poorly defined corporate wishcasting, and certainly not any sort of best practice or legal shield.
    • Aachen 2y ago
      The public prosecutor does not pursue cases where responsible aka coordinated vulnerability disclosure was applied. I'd say that's a legal shield of some kind at least, and it is generally also considered best practice in the industry. There's exceptions to everything but, in the general case, I'm not sure where you're getting these viewpoints from
      • blincoln 2y ago
        "The public prosecutor does not pursue cases where responsible aka coordinated vulnerability disclosure was applied." That seems like a pretty substantial claim to make without any sort of "in [country/state/province/etc.]" qualification, let alone a reference.
        • Aachen 2y ago
          https://www.om.nl/onderwerpen/cybercrime/coordinated-vulnerability-disclosure---ethisch-hacken https://www.om.nl/onderwerpen/cybercrime/coordinated-vulnera...
      • deleted 2y ago
        [deleted]
  • coldpie 2y ago
    Nah. Ticketmaster is unethical enough that spreading information that harms them or helps them go out of business is ethical.
  • speed_spread 2y ago
    If it runs on my CPU and shows up on my screen after I paid for it, it's mine and I can do whatever I want. Anybody who thinks otherwise can fuck off outright.
    • warkdarrior 2y ago
      That's exactly the same policy I apply to AGPL software. I paid for it ($0, as mandated by the developer) and it runs on my CPU.
  • jcranmer 2y ago
    I'm struggling to come up with a good basis for a lawsuit. CFAA abuse is the first thing that comes to mind, but this is a real stretch for that, and SCOTUS shut that stretching down a while ago. DMCA doesn't come into play, since this isn't circumventing any copyright protection schemes. So this kind of leaves you with some form of contract violation, but even that seems like a stretch here. Tortious interference or interference with prospective business? I mean, I don't see any events complaining about this (hell, Ticketmaster itself arguably has some contract liability issues with the fact that their technology relies on cell service which tends to be spotty in dense crowds). So you're kind of left with some individual contract liability issue, which is literally not worth the cost of litigation.
• cortesoft 2y ago
  > There’s no risk that your ticket won’t get you in Isn’t this not true? The risk with printable tickets is that a seller could sell it to multiple people, who all print it out, but then only the first person who uses it can get in? Even if the venue doesn’t check to see if a ticket has already been used, only one person can sit in the actual seat.
  • gruez 2y ago
    >is that a seller could sell it to multiple people, who all print it out They can't "print it out" because it's a rotating code.
    • SamBam 2y ago
      > "The risk with printable tickets is..."
  • 8organicbits 2y ago
    Previous sentence: > If you bought the ticket off the event’s official ticketing agency (not a sketchy reseller)
  • TrackerFF 2y ago
    Ticketmaster has a system for transferring tickets, if you want to buy or sell tickets. There could very well be a reason for someone to only sell a physical ticket, or not transfer it through ticketmaster, but I have yet to find anyone but scammers that want to do that. The reason is, just as you mention, that scammers will try to sell multiple tickets. Then one (or many) sucker turns up to the avenue, only to discover that the ticket has already been validated.
    • _lyxd 2y ago
      >Ticketmaster has a system for transferring tickets, if you want to buy or sell tickets Sure, and it is terrible. They can block you from transferring the ticket you bought, and can set a minimum resale price (effectively ensuring you cannot recoup anything) You should to own what you purchase, simple as.
• mschuster91 2y ago
  > This is a contradiction in TicketMaster’s marketing. They can’t have robust DRM on their tickets if those tickets can still be viewed offline. The "robust DRM" is called "ID cards". Here in Europe, it's become commonplace to tie soccer tickets to ID cards that are verified at the gates to keep hooligans (or those suspected of being hooligans, which is a status that is way WAY easier obtainable than one might reasonably assume) out, and high-class events that attract scalpers like a pile of dungs attracts flies have been doing that for even longer.
  • gruez 2y ago
    >They can’t have robust DRM on their tickets if those tickets can still be viewed offline. https://en.wikipedia.org/wiki/Trusted_Computing https://en.wikipedia.org/wiki/Trusted_Computing
  • 12_throw_away 2y ago
    Huh, weird, a turns out an old, low-tech solution is much more secure than Ticketmaster's roll-your-own weird TOT-QR "security" (even considering the magic animation that that makes it "in a sense, alive") (Not that requiring ID doesn't raise the same and also other consumer rights issues)
    • mschuster91 2y ago
      The thing is, unlike most of Europe, the US doesn't have a legal mandate for anyone to possess an ID card, and so in practice you got 50 states worth of driver's licenses, library cards, military or government employment IDs that can be used (or faked)... so you can't really use these for legitimately verifying anything unless you want to spend a lot of time and money to train your staff to spot fakes. Banks can do that but no one wants to do that for the goons that run security at venues for minimum wage.
      • IncreasePosts 2y ago
        Sure, but realistically no one is going to get a fake ID with a certain name on it so they can go to a concert with that person's tickets.
• londons_explore 2y ago
  v2 of this will require an Android/iOS app which will make use of the platforms secure storage abilities for the key. On non-rooted devices, those are pretty much impervious to the user trying to inspect their contents.
  • Aachen 2y ago
    And this is why those companies love DRM'd (non-rooted) devices and try to detect when you broke this form of DRM: you can't get at your data, not even to make a backup of it; they're in full control. Also for security (can't grant root to malware if you don't have the permission to grant that), but also for everything else
  • dmurray 2y ago
    You could extract the barcode at all times in the future by setting the system clock (you can do this on non-rooted phones, and keep it that way at least if you do it in airplane mode). The Android docs mention a "secure timer" in the hardware security module, but I'm not sure that it can be used to prevent this. https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.html https://developer.android.com/reference/android/security/key...
• jszymborski 2y ago
  Truly a noble cause.
• ikesau 2y ago
  Really good post! I also found this quote which distilled their position in the 404media coverage of the situation. > “What I can say for sure is that TicketMaster and AXS have had every opportunity to support scam-free third party ticket resale and delivery platforms if they wished: By documenting their ticket QR code cryptography, and by exposing apps and APIs which would allow verification and rotation of ticket secrets,” Conduition told me in an email. “But they intentionally choose not to do so, and then they act all surprised-pikachu when 3rd party resale scams proliferate. They're opting to play legal whack-a-mole with scammers instead of fixing the problem directly with better technology, because they make more money as a resale monopoly than as an open and secure ecosystem.” from https://www.404media.co/scalpers-are-working-with-hackers-to-liberate-non-transferable-tickets-from-ticketmasters-ecosystem/ https://www.404media.co/scalpers-are-working-with-hackers-to...
  • yard2010 2y ago
    [flagged]
    • jagged-chisel 2y ago
      Hash chains already existed. But someone created blockchain anyway.
    • dymk 2y ago
      Not all cryptography is blockchain
    • deleted 2y ago
      [deleted]
  • cypherpunks01 2y ago
    I dug up the court docs referenced in that article, it's pretty interesting- AXS Group LLC v. Internet Referral Services LLC (2:24-cv-00377) District Court, C.D. California Amended complaint: https://storage.courtlistener.com/recap/gov.uscourts.cacd.911397/gov.uscourts.cacd.911397.39.0.pdf https://storage.courtlistener.com/recap/gov.uscourts.cacd.91... Docket: https://www.courtlistener.com/docket/68163191/axs-group-llc-v-internet-referral-services-llc/ https://www.courtlistener.com/docket/68163191/axs-group-llc-... One item of the complaint is regarding the "secure.tickets" site, which I wrote about in an earlier comment below (https://news.ycombinator.com/item?id=40906148#40910690 https://news.ycombinator.com/item?id=40906148#40910690). Basically, brokers are using the "secure.tickets" and similar websites to proxy ticket barcodes to buyers, without going through the actual ticket transfer mechanisms on the primary ticketer AXS/TM, (similar to how this blogger does). Then resellers are delivering these ticket URLs, hosted on random websites, to Seatgeek and Stubhub customers, and those platforms are supporting their delivery by telling their customers that the tickets are legit. Sounds like AXS is fighting back against this practice.
• chazeon 2y ago
  Another case of abusing ToTK, an excellent technology that promised convenience, security, and offline access. Similarly, Duo builds their stuff off ToTK and then fending off (or makes it very, very hard) you from using a third-party ToTK authenticator with their sites. This company just jettisons the fine promise of available offline that was made by ToTK.
  • Arch-TK 2y ago
    TOTP?
  • xnx 2y ago
    Tears of the Kingdom?
• frizlab 2y ago
  How about the “Add to Apple Wallet” option? He did not talk about that at all, but AFAIK the ticket would be fully available offline and not in Ticketmaster app, no? It’s actually an elegant solution IMHO.
  • abofh 2y ago
    They mentioned avoiding google wallet, so we can assume android, and that apple wallet wasn't considered for not being an option for them.
  • tkems 2y ago
    I just added a ticket to my Google Wallet for a concert last night and it was very similar to the Ticketmaster/LiveNation app. The PDF417 barcode changed and had an animation around it. My guess is that it is the same or very similar on Apple devices.
    • rareitem 2y ago
      So items inside google/apple wallet don't need to be 'static'?
      • padthai 2y ago
        No, I have flight tickets autoupdate when there is a delay.
        • reddalo 2y ago
          I've only seen the flight data change, not the code itself.
          • xp84 2y ago
            The barcode is just another field in there, so it can be updated the same as anything. Passkit is very simple. For the barcode part you just tell it type of code (from the available types) and value to encode.
• arscan 2y ago
  I recently purchased tickets via SeatGeek and was provided a link to one of these barcodes, which accepted as a querystring parameter an access token that seemingly had a long expiration attached to it. It was hosted on “downloadmytickets.com”, which doesn’t look legitimate and caused me to do this same type of analysis to see how it all worked. Whether or not this was a way to bypass the “security” to enable sale via third parties, or just a very untrustworthy-looking official domain, I don’t know. But in the end it worked fine at the venue. Definitely more stress involved than I would have liked though.
  • cypherpunks01 2y ago
    Yes, these systems are getting more popular recently, I believe they are typically being run by large ticket broker platforms. I don't know about the specific site you mentioned, however the large broker platform Automatiq runs a number of domains like this, where they effectively proxy the original ticket token, recreate it with TOTP just as in this article, and display it to any user who has the right link in a similar format to how TM displays it. They advertise this service as "Transferless Delivery" to their ticket reseller customers. The main Automatiq one is called "secure.tickets". It reduces work for sellers, because they never even have to transfer the tickets out of their Ticketmaster account anymore. Of course, it's horrible for buyers because they have no idea whether the random website link they were sent is actually going to serve them a barcode corresponding to a real ticket or not, or whether the site will be up, and they have no rights to the ticket as far as the primary ticket issuer (TM) is concerned, buyers don't even know the name on their own tickets. Seatgeek and StubHub seem to be aware of these systems because of how closely they work with ticket brokers, and just coach customers to accept them if they are from any of the domains known to them. See https://support.seatgeek.com/hc/en-us/articles/20740307164435-Wallet-ticket-transfers-FAQ https://support.seatgeek.com/hc/en-us/articles/2074030716443... the Automatiq site is called out specifically on that page.
• noodlesUK 2y ago
  This sort of ticketing thing is a trivially solvable problem. It is solved at every airport in the entire world millions of times per day. You provide the name of each concertgoer when you buy a ticket, and they show up with their ticket and ID. You often need to show your ID at these kinds of venues to prove you're old enough to drink beer anyway.
  • whydoineedthis 2y ago
    A lot of concert goers are under 18 and dint have valid state id.
  • cogman10 2y ago
    Yup. I have to believe the reason the likes of ticket master isn't fixing this is because they are selling/auctioning/reserving some percentage of tickets to scalpers or "3rd party sellers". Requiring ID is such an obvious solution that I have to believe these convoluted approaches are only there so the secondary market can exist and so ticket master can wash their hands when prices get out of control on that market.
    • oehpr 2y ago
      I have to presume that the driving impetus of all of this is that they're trying to avoid the actual requirement of checking the ID. Like, they want to improve the flow of traffic through admissions. But I mean, obviously, any kind of system like this strikes me as the same sort of thing as DRM. That you can somehow protect the message from the person you're sharing the message to. How can you avoid reselling if you don't verify the original purchaser? It just seemes ridiculous on its face.
      • jrockway 2y ago
        Yup exactly. Some events are pretty bad at opening the doors early. The Brooklyn Nets seem to open 30 minutes before the game, so they need to get 20,000 people through 20 metal detectors in 30 minutes. Every second extra they add to the process is a second you don't have to buy a $25 drink, and that's how they make their money. We check IDs for flights because airline yield management demands that there be no resale, or business travelers would be traveling on leisure fares.
• londons_explore 2y ago
  Isn't this vulnerable to ticket 'selling' by simply sharing the username and password of the ticketmaster account? it's not like a ticketmaster account is 'worth' anything, so the seller can simply set up a new one for their next purchase.
  • pxx 2y ago
    actually, aged ticketmaster accounts are worth something! people will buy them for a few dozen dollars, as they get priority in ticket queues.
  • blincoln 2y ago
    Setting up separate accounts for every ticket purchase seems like a LOT of overhead (especially scalpers buying many tickets at once and piecemealing them out), and is easy to defeat, e.g. require out of band auth via the phone number associated with the account before logging in for the first time on a new device.
    • rty32 2y ago
      Based on the highly questionable PS/Xbox accounts sold on eBay, I think that's just what scalpers could do as part of their everyday job.
  • Closi 2y ago
    Well you can transfer the ticket to someone else for free anyway, so not really an issue. Or you can transfer it to another name and print it out - just the name on Ticketmaster's system has to match some ID you have in the print scenario.
• phoronixrly 2y ago
  With regards to the end of the article. > Can I work for a bad company and still be a good person? > No. https://apenwarr.ca/log/20201121 https://apenwarr.ca/log/20201121
  • deleted 2y ago
    [deleted]
  • probably_wrong 2y ago
    I'm glad we cleared that up. Now all that remains is a good, measurable definition of what a bad company is.
    • munk-a 2y ago
      You're trying to get quantitative about a qualitative problem.
      • blowski 2y ago
        So if you think a company is bad you shouldn’t work for them. Perhaps many of the people working for TicketMaster don’t think they’re a bad company.
      • its_ethan 2y ago
        That's their point. They're poking fun at how the OP is speaking in absolutes about something subjective/ opinion based.
        • Dylan16807 2y ago
          Speaking in absolutes about an opinion is just fine. OP wasn't the one trying to define it.
      • probably_wrong 2y ago
        The problem is that "bad company" is such a nebulous concept as to be useless, as the JSON license showed with their "shall not use this software for evil" clause. No matter which company you choose, someone somewhere will find a justification for why they are actually not bad. Weapons dealer? Protecting your nation. Destroying local businesses? "They are just adding efficiency to the market". Kill someone with bad practices? "Still safer than the alternative". Ticketmaster? "The scalpers are giving a subvention for those who cannot afford the real price". Setting up a straw "bad company" and knocking it down doesn't help anyone on the real problem of people working for unethical companies.
• irjustin 2y ago
  I agree with the bad implement but the opening complaining that "old way of printable tickets was great why change it" have so many problems. Scalpers are the problem that you have to accept. At the time of purchase, there's no way to tell the difference between a legit purchaser and a scalper or even someone who bought it and simply can't go and needs to resell. IDs, ticket limiters, CCs, etc, etc. All methods can be circumvented by someone dedicated enough. You can only make it "not scalable" but the tickets still need to be transferable, securely. Unless we're willing to go ID checking at the gate, there's not going to be a true solution.
  • Y_Y 2y ago
    That's because there isn't a difference between a "legit purchaser" and a scalper except their intentions, which you can't get from amy kind of barcode.
  • jjmarr 2y ago
    Buying something at a low price and selling it at a high price is arbitrage 101 and is free money. The "true solution" is to sell tickets at their actual market price instead of pretending that the face value of concert tickets isn't increasing due to a larger population and greater demand.
    • coldpie 2y ago
      > The "true solution" is to sell tickets at their actual market price That is *a* solution but it isn't *the* solution. The fact that many smart people are not choosing that solution is an indicator that there are some factors to the problem that you aren't considering.
    • danudey 2y ago
      IOW the true solution to scamming is to raise prices so high that only the extremely wealthy can afford them, regardless of how accessible the actual concert/act/group/promoter wants the show to be. The "real" solution here would be for Ticketmaster (or whoever) to actually make a ticket non-transferrable somehow, and then allow for tickets to be transferred directly through the original website for at most the original ticket price, and refund me the money. For example, if I have a $200 ticket and I can't make it and want to sell it, I can post up a link to the original ticket seller's website (in this case Ticketmaster) where someone else can go buy it, and, if they do, I get a refund of the amount they paid. I can say how much I'm willing to accept (full price, $150, whatever) and someone can go buy "my" ticket, potentially at a loss if I'm willing to accept it. Ticketmaster can make money on these tickets by charging a non-refundable processing fee or whatever to everyone (the original buyer and any subsequent re-buyers). They make a tidy profit, everyone gets what they want. The only complications are 1. making the tickets non-transferrable but also work offline is a difficult technology problem 2. Ticketmaster is an unregulated monopoly and thus has no incentive to behave in the best interests of the market or its customers when they could rake in millions more by screwing everyone except the scalpers
• 999900000999 2y ago
  >Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. You’re using them to exclude people from entertainment events. I can definitely think of worse things programmers are doing aside from making it mildly difficult to see Taylor Swift . I have personal qualms with working in certain industries because of this, but Ticketmaster ultimately provides a luxury. You don't need to see a concert, and if you have such an issue with their business practices you can do something else with your Friday night . I've actually never had an issue with Ticketmaster. At a point a certain other ticket provider just blocked me without any explanation, and I had to go down to the box office to buy tickets. That sucked, but compare to airlines who do weird things like print off tickets without the actual seat number, Ticketmaster doesn't bother me too much.
  • digging 2y ago
    > Ticketmaster ultimately provides a luxury. You don't need to see a concert I don't agree. Entertainment/recreation is a need. Music is an important part of the human experience, and seeing it live, with other fans, is really valuable to some people. And the fact is, the value a person places on the experience is totally orthogonal to their ability to use/afford Ticketmaster. And it's not just about Taylor Swift - even local shows can be difficult to access without quarrelsome online portals. (But also, someone being obsessed with Taylor Swift isn't a personality flaw.)
    • 999900000999 2y ago
      You can find a bar with a band playing. I suggest Kingston Mines if you're in the Chicago area. Ticketmaster doesn't own have a monopoly on music. You can vote with your wallet.
      • ssl-3 2y ago
        "Fed up with high prices and long lines and ticketing SNAFUs for big shows with your favorite artists?" "Clearly, the best answer to this is to forget about all of the music you think you like. Just forget all about it." "Instead, go to the bar and see a band. It doesn't matter if you like the music or not; after all, we know that every live music performance is exactly the same as any other!"
• RScholar 2y ago
  > Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. This is one of the most powerful truths underlying the world we currently inhabit. The sooner we can agree to behave accordingly, the better our prospects for ripping the reigns of society from the hands of those whose only animating principles are avarice and exploitation.
  • mym1990 2y ago
    This is not only a truth of the world we currently inhabit, it has always been a truth, of all the worlds we have inhabited. Power and greed go hand in hand for a reason and the struggle to find the balance is, and will always be present.
    • joelfried 2y ago
      It was not true of this world 150 years ago that any person with sufficient learning could tap buttons to create an experience to be found in the hand of the majority of living humans. I agree power and greed go hand in hand - absolute power corrupts, absolutely - but this bit? This is new.
  • toomuchtodo 2y ago
    https://www.amazon.com/New-Kingmakers-Developers-Conquered-World-ebook/dp/B0097E4MEU https://www.amazon.com/New-Kingmakers-Developers-Conquered-W... ("The New Kingmakers: How Developers Conquered the World") https://web.archive.org/web/20200915000000*/https://try.newrelic.com/rs/newrelic/images/The_New_Kingmakers.pdf https://web.archive.org/web/20200915000000*/https://try.newr... [pdf]
  • dylan604 2y ago
    The fact we have had less than benevolent wizards and shamans, why would we expect to have modern day equivalent of only benevolent coders? It's such a fairy tale level of expectation that it seems childish. Spending any energy in trying to make real world a fairy tale is just wasted.
• marcodiego 2y ago
  > I now know everything I would need to duplicate TicketMaster’s barcodes Until they change their encoding. Requiring the installation of a proprietary app to do anything should be forbidden.
• james2doyle 2y ago
  Fantastic article. Really easy to understand. Side note: this is actually a great advertisement for server side rendering! If they didn't do all this client side rendering, exposing data in JSON APIs, then I doubt this reverse engineering would have been possible.
  • shaftway 2y ago
    Except then I'd need to have a good data connection at the venue, and the odds of that are infinitesimally small.
    • james2doyle 2y ago
      I see what you mean. The barcode wouldn't work offline. It seems like that didn't matter at the venue though? The spotty internet connection not allowing the code to load was the first part of the article wasn't it?
      • shaftway 2y ago
        The article goes into that. If you open up the app ahead of time and download the ticket, it gets enough information to re-generate the barcode every 15 minutes. It's only a problem if you don't go into the app and fetch the data ahead of time.
• superfrank 2y ago
  > I remember a time when printable tickets were ubiquitous. One could print off tickets after buying them online or even (gasp) in-person, and bring these paper tickets to get entry into the event when you arrive I go to 1-2 concerts a month so I'm well aware of how scummy TM is, but the problem with PDF tickets is that people sell fakes or sell the same ticket multiple times. I know multiple people who've been scammed this way. I get not wanting to use your phone for everything, but the changing barcode isn't just technology for the sake of technology, it's actually there to solve a problem. > PDF tickets work even if your phone loses internet connection So do the digital barcodes if you add them to your phones wallet. TM even sends you an email before every event that says: >> If you haven't already, download the Ticketmaster app or sign into your Ticketmaster account via mobile web. From My Events, tap view then add tickets to your phone's wallet for easy access at entry. TM's help page for the Mobile Entry tickets also says (https://help.ticketmaster.com/hc/en-us/articles/9786597785617-How-do-I-use-Mobile-Entry-tickets https://help.ticketmaster.com/hc/en-us/articles/978659778561...) >> We encourage you to download your tickets to your digital wallet before you leave for your event. This ensures that you can always access your tickets. > If you bought the ticket off the event’s official ticketing agency (not a sketchy reseller), you know for sure that they’re real. The problem is that that isn't how the real world works. Ignoring the massive scalping problem currently happening (that TM is complicit in) sometimes plans change or people learn about events after the initial sale. Personally, any time I have to buy or sell through a reseller, I use StubHub, but I know plenty of people who don't want to use them as they charge high fees and they aren't much better than TM from a moral stand point. Also, I get the impression that if TM locked all tickets so that they could only be resold on TM, the author of this article would have a problem with that.
  • crazygringo 2y ago
    Exactly all of this. I found the article really interesting from a tech perspective. And I have no love for TicketMaster, but the migration from paper/PDF tickets to scannable changing QR codes is inevitable, precisely to combat scammers. TicketMaster does a lot of bad things, but this doesn't seem to be one of them. And learning to download the digital tickets in advance -- either to the app or your Apple wallet -- is just a thing you learn to do, the same way you learn to download a bunch of podcasts before your airline flight that charges for (or doesn't have) WiFi. (And if your ticket was a PDF, you'd similarly be stuck if you couldn't get internet at the venue and hadn't downloaded it in advance.)
• 725686 2y ago
  A few months ago I went to Las Vegas to watch U2 at the Sphere. When I learned that I needed to open the app or website in order to get in I panicked in fear of the shitty internet that is common in massive events, so I opened my tickets since I left the hotel. Unless this stuff works completely offline, it is a terrible idea.
  • dylan604 2y ago
    There's no way that I trust the developers of a company like Ticketmaster to install their app on my device.
    • NavinF 2y ago
      You don't trust your OS to sandbox it? With a threat model like that, I wouldn't use any apps other than the browser
      • immibis 2y ago
        Maybe you are using a fully open phone, but mine has an OS made by Google and almost every app tracks my location without my consent.
        • nahikoa 2y ago
          For the past 9 years, Android has allowed users to disable location permission per app. More recently, you can choose to share "noisy" location, which just provides an approximation of your location.
          • pompino 2y ago
            Google will never stop spying themselves but will give you the ability to stop their competitors from spying on you. Heh..
        • NavinF 2y ago
          I'm an app dev. How exactly would I track your location without your consent?
• mattmaroon 2y ago
  Off topic (though the post does go into it a bit): Ticketmaster's current form is entirely due to a failure of government. Decades from now, case studies will be written on how one company managed to have a monopoly on an industry that is so not a natural monopoly.
• kls0e 2y ago
  super entertaining read! many thanks.
• lakerz16 2y ago
  I hate TM and ridiculous fees as much as anyone, but this article is overly hyperbolic. There's a section named "Pirating Tickets", that just explains how to re-create a barcode that you already paid for. You're not using this to rob anyone of anything. And at the end, "Have fun refactoring your ticket verification system". Why? There are no vulnerabilities here. A rotating barcode (even if following a known pattern) is still more secure than a static barcode on a piece of paper.
  • CYR1X 2y ago
    It's piracy in a way that's analogous to ripping like Netflix content. You are breaking away from DRM which is piracy. They also cite the potential to have multiple tokens valid per one ticket which would let multiple people get in with the same ticket.
    • lakerz16 2y ago
      I'd argue that a few extra people sneaking in on the same ticket (assuming this is even possible) is more like sharing your Netflix credentials than ripping Netflix content and having it be shareable with the entire world. You're also walking into a stadium/concert in plain view of security cameras, so the stakes and deniability are different as well.
      • giaour 2y ago
        Not a lawyer, but "subverting DRM" (even if it's trivial or really stupidly designed) can be a crime in and of itself in the US under the DMCA. There are a bunch of exceptions to this, so I have no idea if OP's work is actually illegal.
        • joquarky 2y ago
          Security researchers are an exception, but the title of "security researcher" is undefined
        • greenish_shores 2y ago
• justinclift 2y ago
  https://archive.md/hrgE0 https://archive.md/hrgE0 / http://web.archive.org/web/20240521005653/https://conduition.io/coding/ticketmaster/ http://web.archive.org/web/20240521005653/https://conduition...
• RicoElectrico 2y ago
  What's the deal with PDF417? Why did they choose it over QR?
  • ssl-3 2y ago
    Perhaps a better question is: Why not PDF417? What functional improvement would be had by using a 2D QR code?
    • chocolatkey 2y ago
      One possible reason I can think of is that phone camera apps will not proactively read PDF417 barcodes like they will QR codes, thus discouraging people from thinking they can scan and decode them.
      • ssl-3 2y ago
        That's may be a good reason. My phone's default camera app can recognize QR and UPC (and certainly other things; but I have other tools that I usually use when actually-using barcodes so I'm not that familiar with this part of the camera app), but it doesn't seem willing to do anything with PDF417.
    • RicoElectrico 2y ago
      PDF417 has non-square pixels (or rather as it's called in barcode nomenclature "modules") which feels very janky - it was meant for linear scanners after all. Oh, and quoting Wikipedia: In practice, a PDF417 symbol takes about four times the area of a DataMatrix or QR Code.
      • ssl-3 2y ago
        Yes. They're clearly different things. Which of these aspects offers a functional improvement in this application? ("Feels janky" doesn't quite cut the mustard, I don't think.)
• liendolucas 2y ago
  It's baffling that you have to carry a mobile phone to access a show. What if you run out of battery? Or if you accidentally break the screen just before entering the venue? The more the technology evolves the more we find horrible uses for it. People should fight back by refraining from purchasing tickets from them, I know is not easy for people to miss their favorite artist but until a monopoly is broken there is no other effective way to prevent them from doing what they want.
  • chuckadams 2y ago
    You can still print the ticket on paper. Tho nowadays that means a trip to a FedEx store for me, since I refuse to keep buying inkjets I only use a couple times a year.
    • omega3 2y ago
      Laser printers have solved this - I don’t expect to change the toner for a decade.
      • lnxg33k1 2y ago
        I bought a laser printer, I think something around 19 years ago, and it broke before I could finish the toner
    • jcranmer 2y ago
      > I refuse to keep buying inkjets I only use a couple times a year. Laser printers are the solution, and Brother laser printers seem to remain the most highly-regarded.
      • davkan 2y ago
        Yup, I use my brother laser printer to print probably 20 pages a year and it’s been going strong for 5 years now on the cartridge that it came with when I bought it on eBay.
      • bonestamp2 2y ago
• sandworm101 2y ago
  What I find really interesting is that there are so many scams that that the rejection of tickets is common enough to go unnoticed. Someone testing out their new "F-ticketmaster" ticket generation tool is free to test it in the real world. If it doesn't work they will simply be turned away the door like so many others who have been scammed. Nobody would notice the test. But if each ticket is for a particular seat, would ticketmaster notice if too people came with tickets for the same seat? I bet not. I bet they just trust their ticketing system to be foolproof. If anything they might just reject the second ticket without any way to know which was authentic.
• LordShredda 2y ago
  I can't buy a ticket in my country, because my phone number is foreign. Can I use this to have someone buy it for me and transfer it to me?
• TeeWEE 2y ago
  One things this articles kind of misses: You need that unique token... Ok, you can get it in some way.. But ticketmaster should keep it private, then, even if you know the algorithm. You still cant do a lot without the token...... So he reversed engineered it, but its still secure: You need the token.
• lisper 2y ago
  > They can’t have robust DRM on their tickets if those tickets can still be viewed offline. Of course they can. All they need is a secret key embedded somewhere that the app can access but you can't. It's just a happy circumstance that they used a simple protocol in which the key is easily extracted. But they could have used a proper PKI protocol instead, which would have made it much harder, if not impossible, to hack.
  • wackget 2y ago
    If the app can access it (offline, on your device), then what stops a developer from using tools to extract the token from the device, either from wherever it's stored in memory or using an interactive debugger to extract it as the app requests it?
    • lisper 2y ago
      Nothing stops a (sufficiently motivated) developer from doing that. But it will stop a muggle.
• torcete 2y ago
  A $COACH_COMPANY in the UK has recently announced that they are moving to only app-purchased tickets. Except tickets purchased directly from the driver, which is VERY expensive. Well, F.U. $COACH_COMPANY. I don't want to have to install your app for that, but I guess I won't have any other option if I need to get to the airport.
  • grishka 2y ago
    What is one supposed to do if they don't have a smartphone and/or an internationally accepted bank card?
• PaulHoule 2y ago
  A system like that could work in an entirely disconnected mode where the "ticket" device has a cryptographic token whose signature can be checked at the door without either side having internet access. The weakness of that system is that you can't "revoke" or sell tickets. Such revocation would be possible though if either the ticket or the validator device is internet connected. I saw the New York Red Bulls play not long ago and had to use Ticketmaster's system for the first time. I travel with a tablet, not a smartphone, and I was expecting trouble. Turns out the only trouble I had was that they didn't want to let me in with a tablet but they did when I explained my ticket was on my tablet. It did require an internet connection but Red Bull Arena has great WiFi so that was no problem.
• hinkley 2y ago
  There's a faire this week in Oregon that draws people in from 500 miles away. I've been a couple times, and what I've learned that was still not common knowledge to faire vendors as recently as last year is that T-Mobile brings out a mobile cell tower to support the faire, and no other cellular network does. So if you're trying to accept electronic payments, the whole thing tends to fall over and you only get to sell to people who brought loads of cash and prioritized hitting your booth first. Only the vendors on T-Mobile are able to take purchases for a big part of the day, and a few other people who use the rare billing system that is fine queuing up Visa transactions until after the bulk of people leave. The line for the cash machine sucks up a substantial part of your time budget for the faire, meaning you probably miss out on some things altogether.
  • acureau 2y ago
    That's a pretty smart business move by T-Mobile, I didn't know mobile cell towers were a thing
    • hinkley 2y ago
      I’ve never been clear what the main purpose of these things is but they do seem to get deployed for trade shows and such. Maybe for natural disasters? Then there are microcells, which can be privately owned. I worked at a place that had one when I was in mobile. There was a period of time when one of the carriers would sell you one if you were having connectivity issues. It’s possible for instance, living on a hill, to have a cell signal on your roof but not in the rest of the house and they can work as a repeater.
      • ssl-3 2y ago
        I first heard of CoWs (cell towers on wheels) from Woodstock '99, when they tried to repeat the debacle of Woodstock '94. (AFAIK, the CoW did not work.) The idea of cellular networks is simple: Put the "source" of the bandwidth near where the people need it. The idea of CoWs is also simple: It's the same thing, but it's dynamic and flexible. --- There was a time in my life when I was using AT&T as an all-you-can-eat LTE provider through a third party as my home Internet access, because reasons (and hear you me, if DOCSIS had been an option then none of this would have happened). Armed with a hotspot device that had external antenna connectors, band selection, and a Yagi antenna, I found a cell tower that I thought to be about 14 miles away that had consistently good Internet bandwidth. It was a ton better than several other much-closer towers (some only 1 or two miles away), presumably because it had better backhaul(s). I made quite a study of things to get that dialed in and working reliably. And it was reliable for months. But then: One day, the signal had turned to shit. So I did the right thing and I drove over to where I thought that tower was, 14 miles out, to have a peek. And the tower was right where I expected it to be. But there were men actively working on the tower (with ropes and stuff), and a CoW of much-smaller stature was parked there and providing (rather lesser) backup service. Which, you know: That explained that. --- They additionally get used some for natural disasters if a tower fails, and also sometimes for other dynamic events like festivals and concerts and such. They're pretty useful when they work, in that a tiny sliver of bandwidth is superior to zero bandwidth. When properly-managed they can reduce contention on neighboring towers so that regular people doing their regular things are less-affected by whatever dynamic event is happening nearby.
• colmmacc 2y ago
  It's one thing for customers phones' wifi issues to be a problem, but it's an even worse problem if the scanner itself needs reliable connectivity. That makes me wonder if there is some kind of delegated deterministic derivation step in the secrets too (which wouldn't be obvious in this kind of analysis), so that the handheld scanners can avoid an on-line dependency.
  • Closi 2y ago
    They needed reliable connectivity in the previous scenario (checking barcodes against a central db) - they just setup a local private wifi network for the handsets and all the venue devices. Otherwise I can't see how you would avoid replay attacks.
    • colmmacc 2y ago
      You can do time-based binding. Many TLS/Quic 0RTT take this approach; where the signature is only valid for a second or so. It's not as good as a real strike register, but probably ok for this kind of environment. Of course the barcodes would need to be more dynamic, but that's doable.
      • deleted 2y ago
        [deleted]
• dandigangi 2y ago
  This was a fun read. I wonder if they reported it to a bug bounty program of theirs. Based on his writing how he feels about their business I'm going to guess no.
  • ec109685 2y ago
    This isn’t a vulnerability. It has to work this way if offline access is permitted.
• uniq7 2y ago
  > I paid three hundred US dollars for this high-tech experience. That's a good incentive for companies to keep up with the "high-tech experience".
• gspencley 2y ago
  > Shame on you for abusing your talent to exclude the technologically-disadvantaged. Very minor nitpick: I don't like the term "technologically disadvantaged" here. While it is undoubtedly true that there are many people who are without smart phones due to economic reasons, or because their battery died or their phone was just stolen ... there are also lots of people, myself included, who would CHOOSE to forgo a smart phone when attending a concert / event. My wife and I live in a city with a Caesar's hotel and casino within walking distance. When there are shows and concerts we are interested in, we don't hesitate to buy tickets. When we go to such a show for a date night, we would like to leave our phones at home. Some of this might be due to our being middle aged, and so we're not glued to our phones 24/7, but it's also just a hassle to bring them through security, and to often have to put them in those lock bags because they don't want people recording etc. So to us, e-tickets are evil for no other reason than the fact that it assumes that we want to have a phone on us and to use it as a ticket. I will happily pay the fee for a physical ticket whenever available.
• RcouF1uZ4gsC 2y ago
  > Software developers are the wizards and shamans of the modern age. No they are not. The big difference is that wizards and shamans closely guarded their secrets to keep their position secure, while software developers will happily give them away to as many people as possible. This means that software developers as such have close to zero leverage.
• ThouYS 2y ago
  nice, more of this please. the constant abuse through everything digital has to be fought
• gwbas1c 2y ago
  > If they had issued me normal, printable PDF tickets I could save offline to my phone Uhm, you can save the tickets to Google Wallet.
  • hnuser435 2y ago
    This doesn't work on GrapheneOS.
• limaoscarjuliet 2y ago
  I got tickets for a concert in UK, which could only be bought if you had UK Ticketmaster app. No, the international version of Ticketmaster app did not have these. Had to get me a blank Android phone, had to initialize it pretending I'm in UK via VPN, so I can see the UK Android Playstore (got my phone number blocked by Google in the process - "too many verifications from this number"). Then, it finally let me get the tickets and actually see the dreadful barcode in the app. This is horrible. Please stop.
• jofla_net 2y ago
  I know the discussion has drifted into the larger realm of ethics and civic responsibility. But with respect to the original title, I always thought that it would be trivial to create a software 'tumbler' the logic of which was based on primitive examples, such as this. Edit: each user could have thier own initial state. https://en.wikipedia.org/wiki/Alternating_step_generator https://en.wikipedia.org/wiki/Alternating_step_generator granted you'd need to ramp up the bits to make them less crackable. Then all you'd need is some translation to 2-d QR scancode graphics and a silly sliding bar and voila! Ticketmaster hegemony. But yes, its disgusting that i've needed a phone for events...
• grishka 2y ago
  Impressive. I had no idea mobile-only tickets are a thing. For me it's always been the other way around because sometimes some events would insist on a printed ticket even if it comes as a PDF with a barcode. This sort of thing became annoying enough to me that I bought a printer. But then ticket resale online marketplaces aren't a thing around here either. When people resell event tickets, it's usually an entirely DIY affair.
• lifeisstillgood 2y ago
  I am sure this is pointed out elsewhere, but ticketmasters business model is based on lying to the public so that the artists and venues don’t have to. Taylor Swift is a nice-ish person and wants her fans to think they can buy tickets for her shows at about 25 bucks because that’s a lot of money for a 12 year old and she does not want to alienate her fans. Her manager is an evil cackling bastard and wants to get as much as he can. He knows if he sells all the tickets for 25 bucks he will lose money in the tour and the people who resell the tickets for 2000 will make 1975 dollars profit. So he does a deal with ticketmaster. They will sell 100 seats at 25 bucks, then announce “wow that sold out quickly” and then pretend that the other 5000 tickets they have are sold, and then resell them on secondary sites (ie ticket master is actually selling you orignal tickets through secondary markets). Then they give the cash to the evil manager who twirls his moustache. All the rest, the adding extra charges at end of sales process, the ridiculous rush to buy at a given moment in time instead of some auction or lottery, the whole thing of backhanders to venues, all that is secondary to enabling Taylor swift to take a huge cut without seeming like a evil moustache twirling money grabbing manager.
  • IncreasePosts 2y ago
    Can you provide a source for artists getting a cut of the greater-than-MSRP resale market?
    • xhkkffbf 2y ago
      Why shouldn't the artists get a cut of the greater-than-MSRP resale? Yeah, I realize that some pretend that the MSRP is the real price, but if anyone should get a cut of the jacked up fees, it should the people on the stage or producing the show.
      • peddling-brink 2y ago
        I don’t think anyone is arguing otherwise. The frustration is the inaccurate pricing and other monopolistic behavior from TM et al.
      • 2y ago
• Zopieux 2y ago
  Agreed, fuck Ticketmaster. Sincerely.
• AlexanderTheGr8 2y ago
  Nice reverse engineering! As a hacky way for the non-tech-savvy, couldn't you use a temp account to create ticketmaster account and then buy the ticket and then sell the temp account information to bypass their rules? This reverse-engineering also breaks if ticketmaster forces venue staff to only scan if the barcode is in the ticketmaster app. Unless you create a lookalike app to trick the staffers.
  • jasomill 2y ago
    Good luck forcing a check like this at a busy event venue. I once paid at Starbucks with the Apple Wallet barcode appearing in a photo of my phone displayed on the back of a DSLR. Plopped my not-remotely-iPhone-like Nikon D800 on the counter lens-down, LCD-up, barista scanned it without a second thought.
  • xp84 2y ago
    I am not an expert, but I think one of their layers of protections (that is, to ensure that TM itself gets the greatest share of scalping money) is applying much greater scrutiny to freshly-created accounts when it comes to the in-demand events. I'm not sure how they effectively bootstrap new legit users of course, but I've been offered I think around $100 to sell my Ticketmaster account, which is old. (I can't recall how they found me, perhaps it was an ad just stating that they'd buy an account older than X years).
    • hunter2_ 2y ago
      > bootstrap new legit users Phone number? The friction/expense of a scalper getting a new one for every sale would seem sufficient. Although I guess the scalper could reclaim (via password reset or whatever) accounts after the show to some extent.
• drowntoge 2y ago
  > If you take a closer look at your ticket, you may notice that it has a gliding movement, making it in a sense, alive. That movement is our ticket technology actively working to safeguard you every second. This part made me want to throw up, preferably a couple of buckets full, right onto the heads of the marketing team who came up with it. Kudos to the author of the article. Great work and a great read to go with it.
  • xp84 2y ago
    Those little blue bars are some hard workers. They don't even sleep! Just moving back and forth all day, protecting me. <3
• GuB-42 2y ago
  Does anyone knows how Ticketmaster works, really? I have been to Ticketmaster events that use reasonably priced, printable tickets, you could even buy a printed ticket with cash. In fact, even though there are so many Ticketmaster events, they are not all working the same way. And Ticketmaster doesn't have the monopoly on shitty practices, the article gives a good example in the beginning. What I suspect is that Ticketmaster is nothing more than a service provider. The venue/event organizer/... looks at the Ticketmaster catalogue and pick the product they want. There are "evil" products in that catalogue, and they are probably the ones with the best returns, but I am sure people have a choice. I'd even go as far as calling Ticketmaster "Evil as a Service". So people can say "fuck Ticketmaster" instead of saying "fuck Taylor Swift". I would be very surprised if artists (and their agents) at the level of Taylor Swift didn't have a say regarding ticket sale practices, even with Ticketmaster. Of course, the monopolistic practices of Ticketmaster are a problem, people are most likely paying more than they should because of it, but all the crap with apps, resale platforms, etc... I am pretty sure the event organizers, maybe the artists themselves are as much to blame.
  • orangecat 2y ago
    I'd even go as far as calling Ticketmaster "Evil as a Service". Correct, except rather than "evil" it's "market-clearing pricing". Of course many people see no distinction there.
  • bonestamp2 2y ago
    > but I am sure people have a choice Often, they do not. The DOJ is currently suing TicketMaster because they have exclusive agreements with nearly all of the large venues and that prevents those venues from using other ticket providers. To be fair to TicketMaster, they argue they are not a monopoly because there are many smaller venues that they are not exclusive with. But, TicketMaster even requires that artists use TicketMaster's promotional agency if they want access to these large venues. And more evil stuff! Details here... https://www.justice.gov/opa/pr/justice-department-sues-live-nation-ticketmaster-monopolizing-markets-across-live-concert https://www.justice.gov/opa/pr/justice-department-sues-live-...
    • 2y ago
• LeonM 2y ago
  Let's face it, the real problem with ticket sales is scalping. OP may not like Ticketmaster, and doesn't want to install the app, but the majority of fans don't have a problem with that. The real problem for most fans are the scalpers who push prices out of their budget. Of course we all like to dream up all sorts of technical crypto solutions to this, preferably decentralized to remove evil Ticketmaster from the equation. But I don't think the ticket scalping problem is a technical problem per se. I believe it is because tickets are currently sold under the wrong terms, which encourages scalping. A possible solution could be to make tickets non-transferable, but always refundable. So only you (the buyer of the ticket) can use it, but you can't resell it. But if you decide not to go, you should be able to refund the ticket to the ticket office for full price. The ticket can then be sold again to someone else, for the same price. Now, of course this is a naive idea. There are many practical and technical challenges to it, not to mention the politics of the entertainment industry. I'm not too familiar with the event industry, so I'm not sure if this would even align all the incentives, but it would benefit the fans and the performers who care about their fans.
  • mlyle 2y ago
    The problem is scalping. Unfortunately, this "solution" is Ticketmaster cementing their control of the ticket marketplace and spying on their users.
    • jmholla 2y ago
      And (and I think you were implying this), Ticketmaster giving themselves complete control over the still existing scalping market which they use to boost their own profits without any benefits over the standard scalping market (arguably also including further downsides).
      • mixmastamyk 2y ago
        Yup, they finally outscalped the scalpers. What a windfall the covid push to ban cash and digitize tickets was for them.
  • 2y ago
• xg15 2y ago
  > This ticket is digital. Saving data offline is the same as copying it to your hard drive. If data can be copied, it can be transmitted. If it can be transmitted, it can be shared. If it can be shared, it can be sold. Is this still true in the age of locked-down bootloaders, secure enclaves, TPMs etc?
  • nedt 2y ago
    That data might be part of a backup to your Mac. Maybe it’s even just a sqlite file.
• GuB-42 2y ago
  > My phone has no internet connection... Who thought it was a good idea to require an internet connection at an event. For anything, not just ticketing. It is as if the people who designed these apps never went to a large event. No internet is the rule, not the exception. Sometimes, you can't even send a SMS. Apps designed for use in events should always work offline, and if internet use is justified, take into account latencies in minutes and use bandwith sparingly. Failing to do that will make the experience terrible for everyone, as bandwidth will be saturated by thousands of phones trying to do something with that damn app. At least Ticketmaster does it somewhat right here. The app is supposed to refresh the ticket 20 hours before the event, to account for the fact that the internet may be unavailable at the gate.
• scottfits 2y ago
  Very cool post, but as someone who has been on the other side of the situation, I do have sympathy for what they are trying to accomplish. I bought a ticket that someone had double sold, and by the time I got to the door, they turned me away and said the ticket had already been used. So their system has good intentions, they just need to make it work offline.
• tacker2000 2y ago
  Would be interesting to see the same done for the UEFA ticket app. They use QR codes that are activated/visible only when the user in on site, detected via Bluetooth. They claim that secondary use is then not possible.
• zachmu 2y ago
  People always cite exclusivity deals / monopoly power when it comes to Ticketmaster's dominance, but I also recall reading post-mortems about several failed competitors that indicate the problem Ticketmaster solves (massive spikey demand with strict guarantees on the seats selected) is quite technically challenging. I know, it doesn't seem like it would be that hard to solve, you're probably already thinking how you would do it. But you can't ignore that many others have tried and failed.
• tamimio 2y ago
  Great post. While I'm all for messing up greedy companies, this is a clear example of why JavaScript should never be used for security. Executing the code locally, plus the ability to read the source code, fundamentally goes against securing your application. It doesn’t mean that not having those will make the application more secure, though.
• deamanto 2y ago
  I'd also like to highlight another bad practice by Ticketmaster. When you purchase a ticket from them and resell it on their marketplace, once someone purchases it, they(Ticketmaster) hold your funds and only give you the money ~7-14 business days after the event is over. They say this is to verify the validity of the ticket. On the buyer side, you purchase the ticket from the marketplace and it gets added to your account immediately. (I think) You get the barcode some time ~1 week before the actual event begins. The confusion for me? Ticketmaster owned the ticket and all logic relating to the validity of it. The logic to validate this shouldn't be complex at all. They OWN the ticket. They KNOW it's legitimate because it never left their database. Yet they double dip and hold both buyer and seller funds. Events can be close to a year in the future but the seller won't see that until after that event ends.
  • garaetjjte 2y ago
    Possibly it's fraud prevention, in case payment for the original ticket was fraudulent and chargeback occurs after the ticket is resold on marketplace?
    • LorenPechtel 2y ago
      That does sound like a very reasonable thing to do. Otherwise you have a threat vector of steal card, buy ticket, sell ticket, pocket the cash, card owner disputes, now Ticketmaster has paid a stolen identity who took the money and ran. Anything that can be used to monetize stolen cards will tend to be used for the purpose even if it's inefficient.
  • tesrx 2y ago
    Excellent point. I wonder if Ticketmaster profits by making interest off of holding those funds?
    • mixmastamyk 2y ago
      Wonder no more—yes.
• farceSpherule 2y ago
  People here have no clue how much it costs to pay for a tour. Up to $1M per week.
• jamisonbryant 2y ago
  > "Screenshots won't get you in" I'd say this highly depends on the fastidiousness of the ticket taker and the rules of the venue. I purchased Major League Baseball tix recently through my employer which uses a 3rd-party seller site that has restrictions like this (a moving graphic behind the barcode with the admonishment not to take a screenshot because it won't work). I was unable to attend the event that night so I sent my wife a screenshot of the ticket. Two tickets, in fact. They were taken with zero issue.
• bogota 2y ago
  Shitty companies doing shitty things. I think this is the expectation in 2024.
• ashu1461 2y ago
  I wonder why did they implement this gimmick while having access to all the resources in the world. Or maybe they thought that this is smart.
• zharknado 2y ago
  > Based on this, it might be reasonable to assume the rawToken is only valid for a 20 hour period Bet your bottom dollar it’s good for 24h and they added 4h of buffer in their API guidance to handle admissions after the start of the show “for free.” Not that this really gets you anything, just made me chuckle.
• Drygord 2y ago
  Reverse engineering? More like “reading plain English”! For a billion dollar corp that is some atrociously poor security
• jenny2244 2y ago
  [flagged]
• jenny2244 2y ago
  [dead]
• nmeofthestate 2y ago
  "besides the fact that I don’t want to install their spyware on my phone." There's no other mention of spyware in the article - does anyone know what this is referring to?
  • kornakar 2y ago
    I think it's just usually any 3rd party app is to be considered spyware nowadays.
    • nmeofthestate 2y ago
      OK - just general tin-foil hattery.
• prmoustache 2y ago
  The solution to scalping is simply to not buy tickets from scalpers. Never did, never will. How hard is that really?
• radsquirrel 2y ago
  I worked a summer job in a Ticketmaster box office ten years ago and had access to the whole of their UK customer database in order to print off ticket collections. I’d type in a customer’s post code and up came all of the data Ticketmaster held on them… including their password in plaintext.
  • poet123432 2y ago
    I had to create an account just to reply to this; as much as TM has it's faults this is just false, it does not store passwords in any reversible way or at least hasn't for more than 2 years and all evidence removed. Source: I am an engineer within TM that has worked on integration between various booking products in the UK market.
    • dehugger 2y ago
      Well there is an 8 year delta between your timeline and the OPs... so I don't see any contradictions here.
    • radsquirrel 2y ago
      Glad to hear their security has improved since then! This was the 2014 Commonwealth Games and I had only recently learned about password hashing so I was particularly shocked that they were exposing passwords to thin clients used by front line employees.
    • dml2135 2y ago
      As an engineer within Ticketmaster, I'd be curious to hear your take on the conclusion of the article. > I think we can all agree: Fuck TicketMaster. I hope their sleazy product managers and business majors read this and throw a tantrum. I hope their devs read this and feel embarrassed. It’s rare that I feel genuine malice towards other developers, but to those who designed this system, I say: Shame. > Shame on you for abusing your talent to exclude the technologically-disadvantaged. > Shame on you for letting the marketing team dress this dark-pattern as a safety measure. > Shame on you for supporting a company with such cruel business practices. > Software developers are the wizards and shamans of the modern age. We ought to use our powers with the austerity and integrity such power implies. You’re using them to exclude people from entertainment events. > Have fun refactoring your ticket verification system.
• thih9 2y ago
  > TicketMaster markets their SafeTix technology as a cure-all for scammers and scalpers Scammers - yes; but how scalpers? Does this mean there is no way to resell or give the ticket to another person? Edit: The answer was couple of sentences later; looks like yes, unless via an official marketplace. I like this even less than scalpers. "SafeTix makes it harder for people to resell tickets outside of TicketMaster’s closed, high-margin ticket-resale marketplace, where they make a boatload of money by buying low and selling high to customers with no alternative."
• BigBalli 2y ago
  Great post, bummer this will probably mean we can no longer use this as soon as the implement something stronger.
• totaldude87 2y ago
  This is Gold - but also Ticketmaster is a evil monopoly Disclaimer: This isn’t from a real SafeTix barcode. I don’t want TicketMaster to be able to identify and harass me. Bullshit, TicketMaster. It’s a CSS animation. Get over yourself. I think we can all agree: Fuck TicketMaster
• mechanicalpulse 2y ago
  Great read, though I am compelled to comment on this ad-hoc date/time conversion: $ date=$(python3 -c 'import datetime; print(datetime.datetime.fromtimestamp(1707074879).isoformat())') Consider reaching for `date` from GNU coreutils instead: $ date -Is -d @1707074879 Fewer keystrokes, faster execution, and the output includes the TZ offset.
  • karttu 2y ago
    Great article indeed, but that python line triggered me too. It's a good reminder though. We are all smart individuals with wealth of knowledge, but we never know everything.
• SoftTalker 2y ago
  I don't understand how they're allowed to get aorund the first sale doctrine? Once I buy a ticket, it's my property. I should be able to sell it, by any means I want, to any person I want, at any price we agree upon.
  • worik 2y ago
    And they do not have to sell you bulk tickets that makes scalping a viable business They want to monopolise scalping
  • valleyer 2y ago
    Just addressing the how: the first sale doctrine applies to copies of copyrighted works, not to tickets.
    • SoftTalker 2y ago
      OK, but the "first sale" doctrine really just says that copyrighted works are like any other item that is bought and sold? So I haven't read their fine print lately---is Ticketmaster is not selling you a ticket, but a non-transferrable license to attend the event?
• loloquwowndueo 2y ago
  Mirror this before it gets a DMCA takedown or something.
• highcountess 2y ago
  I get the loathing for Ticketmaster and all, but can we just also acknowledge that the only reason they can do what they do because the various entities they collaborate with participate in the monopolistic cartel scheme? Can we also please acknowledge that if people stop going to the things Ticketmaster sells tickets to, they will stop these practices? No one is forcing people to participate in these things; I don’t. Lastly, it even calls itself Tomicketmaster. And you didn’t realize you are a Ticketslave? It is right there, in the name! Right in front of your eyes! It always amazes me what they can get away with and people just behave like buffalo on the Serengeti, stampeding through the crock infested river … “those crocks are the worst! Ok, Karl, we are up next” Instead of chiding your TicketMASTER devs and alpha slave MBAs, maybe stop being a TicketSLAVE altogether. Has that dawned on any buffalo? Fun fact, to drive the point home. Guess how the predators of the Serengeti are treated when they want to go to an event. You think they deal with Ticketslavery even though the Ticketslaves is how the cabal makes its money?
• khana 2y ago
  [dead]
• nj5rq 2y ago
  > If you take a closer look at your ticket, you may notice that it has a > gliding movement, making it in a sense, alive. I feel like I am in a Disney movie.
• Gelob 2y ago
  you can add them to your apple/google wallet and boom internet doesn't matter, but he ignores that.
• projektfu 2y ago
  It's a little bizarre to me that they are annoyed at being dependent on the signal but want to avoid Google Wallet because ... privacy? What privacy do they have so far? I can understand keeping your credit cards off of it, because Google is obviously getting a list of all your purchases. But there's nothing really private about having a ticket to a concert through Ticketmaster. They "take your privacy seriously" and sell your information to commercial partners and send you offers of things they think you're interested in.
• MisterTea 2y ago
  Reading this reminded me when last year I found a few old venue printed ticket stubs to concerts I went to the in the late 90's and 00's. I almost threw them out when I realized they weren't really taking up space and could be maybe put into a collage or photo/scrap book. I just suppose I find it laughibly absurd that something as mundane as a ticket stub was replaced by an energy wasting Rube Goldberg contraption that doesn't do anything for the person who wants to go to the concert.