3 ms·

> This is a contradiction in TicketMaster’s marketing. They can’t have robust DRM on their tickets if those tickets can still be viewed offline. The "robust DR

> This is a contradiction in TicketMaster’s marketing. They can’t have robust DRM on their tickets if those tickets can still be viewed offline. The "robust DRM" is called "ID cards". Here in Europe, it's become commonplace to tie soccer tickets to ID cards that are verified at the gates to keep hooligans (or those suspected of being hooligans, which is a status that is way WAY easier obtainable than one might reasonably assume) out, and high-class events that attract scalpers like a pile of dungs attracts flies have been doing that for even longer.

gruez 2y ago
>They can’t have robust DRM on their tickets if those tickets can still be viewed offline. https://en.wikipedia.org/wiki/Trusted_Computing https://en.wikipedia.org/wiki/Trusted_Computing
12_throw_away 2y ago
Huh, weird, a turns out an old, low-tech solution is much more secure than Ticketmaster's roll-your-own weird TOT-QR "security" (even considering the magic animation that that makes it "in a sense, alive") (Not that requiring ID doesn't raise the same and also other consumer rights issues)
- mschuster91 2y ago
  The thing is, unlike most of Europe, the US doesn't have a legal mandate for anyone to possess an ID card, and so in practice you got 50 states worth of driver's licenses, library cards, military or government employment IDs that can be used (or faked)... so you can't really use these for legitimately verifying anything unless you want to spend a lot of time and money to train your staff to spot fakes. Banks can do that but no one wants to do that for the goons that run security at venues for minimum wage.
  - IncreasePosts 2y ago
    Sure, but realistically no one is going to get a fake ID with a certain name on it so they can go to a concert with that person's tickets.
    - ssl-3 2y ago
      The problem isn't scams. The problem is that Americans are not required to have an ID -- at all. No federal law requires it, and there is none issued by default. (This is not the same as saying "Americans don't have to carry an ID" even though that is also true.)
      - IncreasePosts 2y ago
        Americans aren't required to have an ID, but that is only relevant to government related services. Private businesses like concert venues are within their rights to card you in some manner, and refuse admittance if you don't provide ID.
        ssl-3 2y ago
        Yes, that's all true. But none of that somehow makes this side of the pond the same as the other side of the pond. An idea that works in one place doesn't necessarily work in the other.
  - BobaFloutist 2y ago
    How hard is it to get access to a database to confirm that a scanned ID is valid, and corresponds to the name written on it?
    - its_ethan 2y ago
      Hopefully pretty hard.
      - BobaFloutist 2y ago
        Not a database you can trawl for your own uses, just something that if you scan an ID pops up validating(/rejecting) it and lists the associated name. I guess you could abuse that to turn partial IDs into more realistic ones? But that feels like a stretch. I can't see it being that useful for much more than confirming that an ID isn't a fake, which seems hard to abuse.
    - mschuster91 2y ago
      Easy if you're government (every random cop on a traffic stop must be able to do that after all) but really REALLY hard for private entities. The exception is anything that is accepted by airports for international travel aka, for you Americans, only a passport - ICAO 9303 is very detailed on how you can access the data stored on them. The specs and a basic understanding on how to communicate with smartcards are decent enough to get you to a readout in maybe a weekend worth of work. The authentication is either via a code derived from the MRZ or a dedicated access code printed on the document.

gruez 2y ago

>They can’t have robust DRM on their tickets if those tickets can still be viewed offline. https://en.wikipedia.org/wiki/Trusted_Computing https://en.wikipedia.org/wiki/Trusted_Computing

12_throw_away 2y ago

Huh, weird, a turns out an old, low-tech solution is much more secure than Ticketmaster's roll-your-own weird TOT-QR "security" (even considering the magic animation that that makes it "in a sense, alive") (Not that requiring ID doesn't raise the same and also other consumer rights issues)

mschuster91 2y ago
The thing is, unlike most of Europe, the US doesn't have a legal mandate for anyone to possess an ID card, and so in practice you got 50 states worth of driver's licenses, library cards, military or government employment IDs that can be used (or faked)... so you can't really use these for legitimately verifying anything unless you want to spend a lot of time and money to train your staff to spot fakes. Banks can do that but no one wants to do that for the goons that run security at venues for minimum wage.
- IncreasePosts 2y ago
  Sure, but realistically no one is going to get a fake ID with a certain name on it so they can go to a concert with that person's tickets.
  - ssl-3 2y ago
    The problem isn't scams. The problem is that Americans are not required to have an ID -- at all. No federal law requires it, and there is none issued by default. (This is not the same as saying "Americans don't have to carry an ID" even though that is also true.)
    - IncreasePosts 2y ago
      Americans aren't required to have an ID, but that is only relevant to government related services. Private businesses like concert venues are within their rights to card you in some manner, and refuse admittance if you don't provide ID.
      - ssl-3 2y ago
        Yes, that's all true. But none of that somehow makes this side of the pond the same as the other side of the pond. An idea that works in one place doesn't necessarily work in the other.
- BobaFloutist 2y ago
  How hard is it to get access to a database to confirm that a scanned ID is valid, and corresponds to the name written on it?
  - its_ethan 2y ago
    Hopefully pretty hard.
    - BobaFloutist 2y ago
      Not a database you can trawl for your own uses, just something that if you scan an ID pops up validating(/rejecting) it and lists the associated name. I guess you could abuse that to turn partial IDs into more realistic ones? But that feels like a stretch. I can't see it being that useful for much more than confirming that an ID isn't a fake, which seems hard to abuse.
  - mschuster91 2y ago
    Easy if you're government (every random cop on a traffic stop must be able to do that after all) but really REALLY hard for private entities. The exception is anything that is accepted by airports for international travel aka, for you Americans, only a passport - ICAO 9303 is very detailed on how you can access the data stored on them. The specs and a basic understanding on how to communicate with smartcards are decent enough to get you to a readout in maybe a weekend worth of work. The authentication is either via a code derived from the MRZ or a dedicated access code printed on the document.