6 ms·

A few months ago I went to Las Vegas to watch U2 at the Sphere. When I learned that I needed to open the app or website in order to get in I panicked in fear of

by 725686 2y ago

A few months ago I went to Las Vegas to watch U2 at the Sphere. When I learned that I needed to open the app or website in order to get in I panicked in fear of the shitty internet that is common in massive events, so I opened my tickets since I left the hotel. Unless this stuff works completely offline, it is a terrible idea.

dylan604 2y ago
There's no way that I trust the developers of a company like Ticketmaster to install their app on my device.
- NavinF 2y ago
  You don't trust your OS to sandbox it? With a threat model like that, I wouldn't use any apps other than the browser
  - immibis 2y ago
    Maybe you are using a fully open phone, but mine has an OS made by Google and almost every app tracks my location without my consent.
    - nahikoa 2y ago
      For the past 9 years, Android has allowed users to disable location permission per app. More recently, you can choose to share "noisy" location, which just provides an approximation of your location.
      - pompino 2y ago
        Google will never stop spying themselves but will give you the ability to stop their competitors from spying on you. Heh..
    - NavinF 2y ago
      I'm an app dev. How exactly would I track your location without your consent?
      - immibis 2y ago
        For example, based on my IP address, nearby wifi networks, and camera footage.
        ssl-3 2y ago
        > IP address Great. So an app can plug my IP address into a geolocation query, and might ultimately determine that I'm somewhere in $city. Or maybe the next city over. Or maybe half a continent away. But sure, this "works" without consent, since there is no extra step to enable networking for an app. > nearby wifi networks This doesn't work without consent. > camera footage This doesn't work without consent.
        NavinF 2y ago
        Web apps also get your IP. Why aren't you using a VPN if you care about that? Web apps can also get the rest if you click accept when it asks for camera access. What exactly do you lose by installing an app?
  - dylan604 2y ago
    From the AppStore: Data Linked To You: Purchases, Location, Search History, Usage Data, Financial Info, Contact Info, Identifiers, Sensitive Info. Nope Nope Nope.
    - NavinF 2y ago
      That explains nothing. I'm pretty sure it's talking about info that you type into form fields in the app. Same reason FB "links" your health info even though it has no access to the health info stored by your OS. The same applies if you use their website. It'll still ask for that info with a web form.
      - dylan604 2y ago
        > Same reason FB ...is not installed on any of my devices
  - jimbobthrowawy 2y ago
    If anyone is in the situation that they need to put an untrustworthy app on their android device, the "work profile" feature can segment it off further. Insular is an app that lets you create and manage one of these profiles on the device itself: https://gitlab.com/secure-system/Insular https://gitlab.com/secure-system/Insular
    - notpushkin 2y ago
      Work profile is really neat, yeah. I'm using Shelter for this, it's quite nice: https://f-droid.org/en/packages/net.typeblog.shelter/ https://f-droid.org/en/packages/net.typeblog.shelter/
  - _puk 2y ago
    I mean, that horse has already bolted.. https://www.nytimes.com/2024/05/31/business/ticketmaster-hack-data-breach.html https://www.nytimes.com/2024/05/31/business/ticketmaster-hac...
    - NavinF 2y ago
      Yeah that has literally nothing to do with their app. If you submitted your data on their website, it'd be leaked just the same
      - dylan604 2y ago
        You're implying that the data from the app is stored in a different more secure manner than the data from the website? That makes zero sense. The fact that they got hacked and is the only thing that matters, not which mode of input you provided the data they did not protect.
        NavinF 2y ago
        No, I'm asserting that the app acquires as much data as the website (ie. whatever you typed into their forms) and it gets leaked all the same. Refusing to install the app makes no sense if you still use the website
        sbarre 2y ago
        An app absolutely can track more data than a website. You don't have the website open/active on your phone at all times, but you have the app installed at all times, even when it's not running. You do know that apps can record data in the background, right? A website is also sandboxed by your browser in a much stricter manner than an app is on your phone, at least by default. I don't have specific information on the Ticketmaster app here, but to say that an app is the same as website from a tracking perspective on a phone is absurd.
        NavinF 2y ago
- jen20 2y ago
  What is the worst that can happen? I have it installed on my iPhone and deny whatever permissions it asks for. I have enough confidence in the sandbox that "installing an app" is basically never an issue (though I don't out of the principle that most things companies have apps for just shouldn't be apps).
  - dylan604 2y ago
    > What is the worst that can happen? I don't know the worst, but juice is not worth the squeeze in my opinion. If you recall, Ticketmaster was just recently hacked, so the worst pretty much happened in that any data they had collected on their users is potentially been leaked. So if they can't protect that data, then I'm not participating in giving them data.
    - xp84 2y ago
      Sure, but the data you give them is pretty much a condition of attending their shows, not whether you use their app, Chrome, or a PC in the library to buy the ticket. Regardless, they will get some contact and basic financial info for you unless you avoid all their concerts (which is certainly a principled and defensible choice!)
      - dylan604 2y ago
        They do not need to know my address, my phone number, credit card number or any of the other BS that "they need" including my name. Their website has a ton of trackers uBlock blocks, so their website is trying to collect even more data than what their "forms" request.
        jen20 2y ago
        How would an iPhone app (I don’t know about android) collect any of that?
        dylan604 2y ago
swozey 2y ago
I used to work or a mobile event app company that made a lot of the big festival/conference apps. Everything was built to function locally from a sqlite file on your phone that was constantly updated when you did have coverage. It was 100% expected that you would have no cell signal the entire event and we built in as many mitigations as we could think of. This was 2013ish, I think there are a lot more mesh network devices that can relay signal nowadays but I'm not involved anymore in that stuff. It was the best on-call I've ever had because.. nobody had cell signal while the event was on to complain about something. This person complains that people didn't have network access on their phones when they were at the gate. I can only assume that they waited till they were at the gate to install/use the app so it never got its offline data. Always open your event apps before getting to the event. Sometimes they're completely bare bones and have to reach out and pull that apps specific database so its sure you have the latest. Most of the event apps are a template that is modified for each event and just has different assets/sqlite.
- rkagerer 2y ago
  ...or just let us print g*d@mn paper tickets.
tptacek 2y ago
As the article notes, this ticket system does in fact work offline.
- mattmaroon 2y ago
  Well, as it also notes, it works offline if you remember to open the ticket before you get there, and they don't (or at least didn't used to) give you sufficient warning. I found out that's how it works the hard way when it was new by having to walk a half mile back from the venue to get service to load the tickets. There's also the chance the ticketmaster app won't work properly later even if you did do it. I've had other apps shit the bed for no apparent reason in offline mode before. I add them to my wallet now just in case.
  - tptacek 2y ago
    Sure, I'm just reacting because TOTP is like the textbook example of a system designed to work without interactive access to a networked resource. The whole as TM designed it has crappy affordances, but you could fix that without breaking the design.
    - mattmaroon 2y ago
      Ah, yeah. I’m just hoping the justice dept breaks them up and ticket sales move to something like the airline model.
      - lotsoweiners 2y ago
        Why though? Lord knows I hate Ticketmaster as much as everyone else but “airline model” sounds fucking terrible. I hope I never see the day where I’m removing belts and shoes to get into a concert. To be fair though I always get at least somewhat reasonable concert prices by doing presale. Sign up for the artist’s “presale club” and/or get the credit cards that have presale as a perk. Get in queue ahead of time. You won’t have to deal with the dynamic pricing/public sale shenanigans that we hear about. On Reddit I often see people complaining about paying at least 2x what I paid for similar tickets.

by 725686 2y ago

dylan604 2y ago

There's no way that I trust the developers of a company like Ticketmaster to install their app on my device.

NavinF 2y ago
You don't trust your OS to sandbox it? With a threat model like that, I wouldn't use any apps other than the browser
- immibis 2y ago
  Maybe you are using a fully open phone, but mine has an OS made by Google and almost every app tracks my location without my consent.
  - nahikoa 2y ago
    For the past 9 years, Android has allowed users to disable location permission per app. More recently, you can choose to share "noisy" location, which just provides an approximation of your location.
    - pompino 2y ago
      Google will never stop spying themselves but will give you the ability to stop their competitors from spying on you. Heh..
  - NavinF 2y ago
    I'm an app dev. How exactly would I track your location without your consent?
    - immibis 2y ago
      For example, based on my IP address, nearby wifi networks, and camera footage.
      - ssl-3 2y ago
        > IP address Great. So an app can plug my IP address into a geolocation query, and might ultimately determine that I'm somewhere in $city. Or maybe the next city over. Or maybe half a continent away. But sure, this "works" without consent, since there is no extra step to enable networking for an app. > nearby wifi networks This doesn't work without consent. > camera footage This doesn't work without consent.
      - NavinF 2y ago
        Web apps also get your IP. Why aren't you using a VPN if you care about that? Web apps can also get the rest if you click accept when it asks for camera access. What exactly do you lose by installing an app?
- dylan604 2y ago
  From the AppStore: Data Linked To You: Purchases, Location, Search History, Usage Data, Financial Info, Contact Info, Identifiers, Sensitive Info. Nope Nope Nope.
  - NavinF 2y ago
    That explains nothing. I'm pretty sure it's talking about info that you type into form fields in the app. Same reason FB "links" your health info even though it has no access to the health info stored by your OS. The same applies if you use their website. It'll still ask for that info with a web form.
    - dylan604 2y ago
      > Same reason FB ...is not installed on any of my devices
- jimbobthrowawy 2y ago
  If anyone is in the situation that they need to put an untrustworthy app on their android device, the "work profile" feature can segment it off further. Insular is an app that lets you create and manage one of these profiles on the device itself: https://gitlab.com/secure-system/Insular https://gitlab.com/secure-system/Insular
  - notpushkin 2y ago
    Work profile is really neat, yeah. I'm using Shelter for this, it's quite nice: https://f-droid.org/en/packages/net.typeblog.shelter/ https://f-droid.org/en/packages/net.typeblog.shelter/
- _puk 2y ago
  I mean, that horse has already bolted.. https://www.nytimes.com/2024/05/31/business/ticketmaster-hack-data-breach.html https://www.nytimes.com/2024/05/31/business/ticketmaster-hac...
  - NavinF 2y ago
    Yeah that has literally nothing to do with their app. If you submitted your data on their website, it'd be leaked just the same
    - dylan604 2y ago
      You're implying that the data from the app is stored in a different more secure manner than the data from the website? That makes zero sense. The fact that they got hacked and is the only thing that matters, not which mode of input you provided the data they did not protect.
      - NavinF 2y ago
        No, I'm asserting that the app acquires as much data as the website (ie. whatever you typed into their forms) and it gets leaked all the same. Refusing to install the app makes no sense if you still use the website
        sbarre 2y ago
        An app absolutely can track more data than a website. You don't have the website open/active on your phone at all times, but you have the app installed at all times, even when it's not running. You do know that apps can record data in the background, right? A website is also sandboxed by your browser in a much stricter manner than an app is on your phone, at least by default. I don't have specific information on the Ticketmaster app here, but to say that an app is the same as website from a tracking perspective on a phone is absurd.
        NavinF 2y ago
jen20 2y ago
What is the worst that can happen? I have it installed on my iPhone and deny whatever permissions it asks for. I have enough confidence in the sandbox that "installing an app" is basically never an issue (though I don't out of the principle that most things companies have apps for just shouldn't be apps).
- dylan604 2y ago
  > What is the worst that can happen? I don't know the worst, but juice is not worth the squeeze in my opinion. If you recall, Ticketmaster was just recently hacked, so the worst pretty much happened in that any data they had collected on their users is potentially been leaked. So if they can't protect that data, then I'm not participating in giving them data.
  - xp84 2y ago
    Sure, but the data you give them is pretty much a condition of attending their shows, not whether you use their app, Chrome, or a PC in the library to buy the ticket. Regardless, they will get some contact and basic financial info for you unless you avoid all their concerts (which is certainly a principled and defensible choice!)
    - dylan604 2y ago
      They do not need to know my address, my phone number, credit card number or any of the other BS that "they need" including my name. Their website has a ton of trackers uBlock blocks, so their website is trying to collect even more data than what their "forms" request.
      - jen20 2y ago
        How would an iPhone app (I don’t know about android) collect any of that?
        dylan604 2y ago

swozey 2y ago

I used to work or a mobile event app company that made a lot of the big festival/conference apps. Everything was built to function locally from a sqlite file on your phone that was constantly updated when you did have coverage. It was 100% expected that you would have no cell signal the entire event and we built in as many mitigations as we could think of. This was 2013ish, I think there are a lot more mesh network devices that can relay signal nowadays but I'm not involved anymore in that stuff. It was the best on-call I've ever had because.. nobody had cell signal while the event was on to complain about something. This person complains that people didn't have network access on their phones when they were at the gate. I can only assume that they waited till they were at the gate to install/use the app so it never got its offline data. Always open your event apps before getting to the event. Sometimes they're completely bare bones and have to reach out and pull that apps specific database so its sure you have the latest. Most of the event apps are a template that is modified for each event and just has different assets/sqlite.

rkagerer 2y ago
...or just let us print g*d@mn paper tickets.

tptacek 2y ago

As the article notes, this ticket system does in fact work offline.

mattmaroon 2y ago
Well, as it also notes, it works offline if you remember to open the ticket before you get there, and they don't (or at least didn't used to) give you sufficient warning. I found out that's how it works the hard way when it was new by having to walk a half mile back from the venue to get service to load the tickets. There's also the chance the ticketmaster app won't work properly later even if you did do it. I've had other apps shit the bed for no apparent reason in offline mode before. I add them to my wallet now just in case.
- tptacek 2y ago
  Sure, I'm just reacting because TOTP is like the textbook example of a system designed to work without interactive access to a networked resource. The whole as TM designed it has crappy affordances, but you could fix that without breaking the design.
  - mattmaroon 2y ago
    Ah, yeah. I’m just hoping the justice dept breaks them up and ticket sales move to something like the airline model.
    - lotsoweiners 2y ago
      Why though? Lord knows I hate Ticketmaster as much as everyone else but “airline model” sounds fucking terrible. I hope I never see the day where I’m removing belts and shoes to get into a concert. To be fair though I always get at least somewhat reasonable concert prices by doing presale. Sign up for the artist’s “presale club” and/or get the credit cards that have presale as a perk. Get in queue ahead of time. You won’t have to deal with the dynamic pricing/public sale shenanigans that we hear about. On Reddit I often see people complaining about paying at least 2x what I paid for similar tickets.