13 ms·

CAPTCHAs are over (in ticketing)

• rendx 1y ago
  One option that I not see discussed in the blog post: Collecting user signals locally and using those access patterns (mouse movement, clicks, IP/site browsing history) to discriminate between "standard" site usage and bots; so like a "reCaptcha lite", not trained across many sites but trained specifically on the target. For a ticket platform like pretix that can be run self-hosted alongside the main site, this should give you enough signals to discriminate between normal users and bots, unless they are specifically targeting that site, or am I mistaken? Even just pure web server access logs may be sufficient on smaller sites so this might work even without JS?
  • jsnell 1y ago
    This seems pretty well covered by the post? Doing any kind of access pattern analysis leaves you with the problem of handling false positives, and your proposal doesn't help with the accessibility problems. IP addresses aren't a panacea here -- this is a high margin business where the attackers can switch to high cost / high quality proxies. > unless they are specifically targeting that site In this case the attackers would very specifically be targeting specific sites (ones selling tickets to events with more demand than supply).
• djoldman 1y ago
  Unfortunately, the solution to something like this is more intense KYC and lawsuits. You don't defend at the web, you defend in the courtroom and bank. I assume it's too expensive or the ticket sellers don't actually care, they just want to think they care.
  • devwastaken 1y ago
    you defend at the ID system. anonymous cert chain ID fixes this. the u.s is defined by its fraudulent business and therefore no one in power wants it.
• charcircuit 1y ago
  >Most organizers, including for-profit organizations, do not want to choose this option due to ethical concerns or concerns about community building. The alternative is selling the tickets to scalpers which doesn't seem ethically better or better at community building as compared to directly selling it to fans. Even if you assign tickets to IDs scalpers will sell access to bots instead to capture the delta between market price and the price the ticket is being sold for.
  • DrillShopper 1y ago
    Sell the tickets with a decreasing price - early tickets are very expensive, late tickets are not, and hold back between 10% and 20% until day of sale at the lowest price. Make the scalping bastards choke on it, and break FOMO all at once.
    • debugnik 1y ago
      But once tickets run out, the scalpers' price is the only price, and bots are better positioned to hold and time the market.
• nssnsjsjsjs 1y ago
  What about limiting the number of tickets per card? Or do what airlines do and you need to declare who is using the ticket. Maybe allow exchange for up to 50% of a party. Then the scalpers can't win but there is still a DOS problem to solve. Maybe a card auth -> reserve seats -> complete txn flow would help there. The card auth rate limits the amount of unbooked but temporary reserved tickets.
  • evertedsphere 1y ago
    > What about limiting the number of tickets per card? discussed in TFA > Or do what airlines do and you need to declare who is using the ticket ditto
  • smelendez 1y ago
    Locking tickets to customers is hard, especially for venues with seats. The venue and artist want people in those seats — it looks better and they spend money on concessions, merch, and often parking. You can resell at the door, maybe, but then you’re turning away paying customers who get stuck in traffic and show up late. I’m not convinced cards are a significant barrier. People already get tons of credit cards for the signup bonuses and perks, and you can get prepaid cards pretty easily. Temporary card numbers are a thing too. There are logistical challenges in getting a lot of cards in the buying pool but I don’t think they’re insurmountable.
    • technion 1y ago
      Concerts that are struggling with numbers shouldn't have a scalper problem though. If you want more people through the door, there are presumably base price tickets still for sale. This problem mostly exists in the Swift concerts that sell out in four minutes before the internet explodes with people complaining the website never loaded for them. I'm sure "might harm sales" really won't be a problem for those concerts.
• gerdesj 1y ago
  When I was a lad we bought tickets at a booth. Just saying ...
  • kimos 1y ago
    And it was terrible. For every party involved.
• landl0rd 1y ago
  I'd rather see bot resistance (important for everyone) and privacy (important for everyone) take precedence over accessibility (important for a small minority) and have laws change to reflect that.
  • singpolyma3 1y ago
    I disagree that bot resistance is important to anyone, or even a reasonable goal for anyone at all. Bots are just users
    • mikepurvis 1y ago
      Bots are not just users in the battle against spam.
      • singpolyma3 1y ago
        Then you want antispam not antibot
    • rnmg 1y ago
      Bots are users, but they aren't human users. I think it's fair to say that most web sites/apps value human users over bots (maybe that's wrong though?). But I think an argument can definitely be made the bot resistance is valuable/important to most people on the web.
    • landl0rd 1y ago
      Objectively a lack of bot-resistance can make the service unusable for everyone. Good examples include twitter, where interesting stuff gets flooded by spam DMs and indian payout farmers, and the mentioned ticketing example, where objectively a lack of resistance leads to rent-seeking middlemen scalping tickets. Similarly a lack of privacy hurts everyone. The question is basically "would you rather have an equally-shitty service for everyone in the name of egalitarianism or a good service for most?" This seems a really easy choice for me because I don't see egalitarianism/accessibility as a moral imperative.
  • 1y ago
• Matheus28 1y ago
  How about: each user creates an account with their legal ID. Obviously unique so they can’t create multiple using the same ID. Before the sale, everyone signs up. Once the sale is started, tickets are distributed using a lottery system for the users who signed up (so refreshing like mad doesn’t give any advantage). Can only buy up to 2 tickets per person (their own and an anonymous companion). ID must be shown and would be verified at entrance. If you wanna be even more strict: You could allow up to X companions, but they must not have signed up with their own account (so they don’t have an advantage for doing so). And they must provide their ID before the event as well and arrive as a single party.
  • arccy 1y ago
    I think you just described something similar to the Japanese system
  • AlienRobot 1y ago
    I'm asked for ID on MercadoLivre and PayPal already, but I think it's for tax purposes. Never tried to create two accounts with the same tax ID.
  • unscaled 1y ago
    This addresses some of the hassle around buying multiple tickets, but does not address the inherent privacy issues. But there are still some problems. First of all, this remains a hassle in most countries, since handling a national identity number (if such a number exists at all) is restricted by law. Even in some countries that do not legally restrict collection or storage of identity numbers (AFAIK the US does not restrict private sector usage of SSNs), there is rarely wide acceptance of providing your identity number for any purpose other than official government services and financial institutions. This means that in most cases, the event organizer has to resort to more traditional methods of KYC: Requesting some personal details (e.g. full name and birth date) and requiring to present an identity document that carries the details above. Verifying the identity document adds slows down entrance lines and increases the cost. The other issue with this method is privacy. You're still not breaking the suggested BAP (Bots-resistance/Accessibility/Privacy) theorem suggested by the article. Additional personal information has to be collected and stored until the time of the event. But I believe there is a way out of this. You can still create a limited resource that is more restricted than phone numbers or credit card numbers, and can be optionally verified at the venue cheaply. The only problem is that would require cooperation from the government (and a great deal of effort if you want to make it perfect). The government needs to already have an online digital KYC method that is bound to your digital ID or an online government account. Then the government can use that method to provide an anonymous federated login that provides a unique ID that cannot be traced back to any national identity number. This is essentially how Sign in with Apple works with "Hide My Email" selected: No personally identifying claims are included in the Open ID Connect ID Token and "sub" is unique (per Apple user + 3rd party service combination), but not traceable back to the the original Apple identity. Unique identities can also become ad-hoc per-event (instead of per ticket provider), which makes them completely private (ticket providers cannot track users across multiple events). At described above, this service still only provides a limited resource akin to phone numbers. For events where the profit margin from ticket scalping exceeds $100, you could still get some scalpers who'd convince collaborators to identify in with their government account and buy tickets for the scalper for $20 per ticket. If you can get 5 tickets per ID, that's $100 of easy money for 5 minutes of work. You can add simple and fast verification at the venue by requiring the users to generate a QR code that is tied to their unique ID at the venue in order to enter. The QR code cannot be generated in advance and is based on a challenge QR that is presented at the venue. This requires collaborators would have to physically come to the venue or be available at the time the scalper's agents come to redeem the paper tickets at the venue. With a QR code generation and check directly at the gate, scalping is completely impossible (at the cost of longer lines and less entrance flexibility). With printed tickets the scalper needs to send agents to physically collect the tickets and communicate with the collaborators (who need to be available at the day of the event to generate the QR codes remotely) — which greatly inflates the cost of scalping. Even when you get governments to cooperate with this approach, there are still some holes with this approach. The first issue is that eKYC needs to become popular enough to avoid a large loss in sales. The second issue is raising awareness with regards to privacy-preserving eKYC vs. regular eKYC. This two services look very similar (you log-in with your government account or ID to prove your identity), but the scope of the information shared couldn't be more different. Normalizing eKYC carries the risk of people becoming careless about divulging private information. Luckily, this could easily be solved by governments restricting private sector parties to which full eKYC is provided based on their callback domain names and registered credentials (like OAuth client ID and client secret). The last problem is the probably the most complex one to tackle: how would you accommodate tourists? After all a lot of the venues sell a large share (or even the majority) of their tickets to tourists. I can think of two possible answers. The first approach is to fall back to a manual passport-based KYC process for tourists. Tourist ticket buyers would have to enter their name and passport number in advance and the passports would be verified in person at the venue. This can be slightly sped up with automatic passport scanners if the venue has a high volume of visitors that warrants the costs. This approach seems to be where China is going: the resident ID card is used for entrance to many places and even for buying railway tickets, but tourists just use their passports. This works well when the percentage of tourists is low, but at a venue which expects a high number of tourists you'll run into all the issues I've described above. The other option is probably more of a pipe dream, but it would be nice if countries could issue a temporary (and restricted) eKYC account to visitors when they complete their ETA. Even countries without ETA can still offer a pre-registration system just for obtaining an eKYC account in advance. This eKYC account can be used to purchase tickets in the destination country in advance, but it would only be activated for generating gate QR codes when physically entering the country with the matching passport. The main limitation of this approach is that you must first obtain an ETA before purchasing tickets, but you'd usually already have concrete travel plans by the time you're purchasing the tickets.
• jsnell 1y ago
  > So what’s left? If the profit per successful abuse event is $200, the author's suggestion of limits on credit card numbers or phone numbers won't work either. Those are only effective against scaled abuse up to something like $1 / event. Bank accounts would almost certainly be more robust, but that seems quite hard to implement outside of a handful of countries where the online auth ecosystem is built around banks. With generic abuse background, but not knowing anything about the ticketing abuse ecosystem, is doing the sales on a first-come-first-serve basis an absolute necessity from a business perspective? There would be a lot more tools available if the problem was reframed from "decide instantly whether to sell this buyer a ticket" to "decide which 10k of these 100k intents of purchase received during the first 24h to sell the tickets to". And by more tools, I mean offline analysis and clustering, not just a lottery. (You'd still want to combine that with strongly personalized tickets though. It'd be how you address for bots-as-a-service, not how you address buying tickets to resell.)
  • thatguy0900 1y ago
    I could see an issue with that since most people are going to be going to events in a group, and won't want to go unless everyone gets their ticket. If I wanted to go with three people, do you lottery us as a group or individually? If I want to go with 5 people and there's a lottery, the best thing to do would be have multiple people buy 5 tickets each, multiply that by every group and you have a lot of people buying tickets who don't actully want them and people who only put one order in get shafted
    • muti 1y ago
      Require the intent to include ticket holder names/id and check it on entry to the venue, multiple intents for the same group can be deduplicated
      • calcifer 1y ago
        The article addresses that: > Of course it also harms real buyers who want to go to a concert with a +1 but do not yet know who they will bring.
• zaik 1y ago
  Sell at the economic equilibrium price (determined by auction) and whoever actually enters the venue receives the difference between the auction price and the desired price by the organizer in cash or maybe in form of a coupon for their next concert.
  • Horffupolde 1y ago
    That results in unbounded offers.
    • zaik 1y ago
      Sounds like an interesting situation! But I do see the flaw in my proposal now. It will select for the top-n richest customers, which kind of undermines the point of selling at a fixed price.
• mountainriver 1y ago
  We just need better human verification, that’s all, and the web depends on it
• frabcus 1y ago
  The option that strikes me as missing, is making users pay a cost before they are randomly entered in a lottery for the ticket. So, for example, everyone pays $0.01 on their credit card, or does a holding charge on their credit card, or registers their identity. All in a 5 minute (or 1 day!) window. And then after the window, tickets are randomly distributed amongst every card which so registered. You could check multiple things - phone and card and Government ID if necessary (lowering the privacy). This also feels fairer and less stressful - instead of a lottery based on your internet access, or ability to run lots of browsers at once. This feels harder for scalpers to do to me, as they need more fake identities, but I'd be curious about the actual ratios when trying it. What goes wrong? Another one I predict is that you can't buy digitally. For examples, the Lewes fireworks display you have to buy tickets in person in a bookshop in Lewes. Doesn't help if you make a digital ticketing system though!
  • londons_explore 1y ago
    I suspect the key thing is that the industry really wants scalpers, but must appear to act against them.
    • clipsy 1y ago
      > I suspect the key thing is that the industry really wants scalpers Why?
      • chamakits 1y ago
        Well at least one possible reason is that for live events, the company that has an effective monopoly is Live Nation. And they also own at least one of the platforms where scalpers sell their tickets; Ticketmaster. I also imagine that as an event promoter, being able to say some variation of "Another sold out show", or "Tickets sold out within seconds" creates pressure for buying early for all future events. It also takes active planned work to implement these solutions. And if they have a monopoly, they have no incentive to do that work.
      • teeray 1y ago
• abtinf 1y ago
  To fight economics is to wage war on reality itself.
  • itsanaccount 1y ago
    i love the number of people who are wholly bought into this idea that capitalisms tokens warp reality itself. its the end of history too aint it? which is just such a lack of imagination for what we are capable of, both in terms of progress and irrationality.
• sanity 1y ago
  A few months back I built a cryptographic alternative to CAPTCHAs called Ghost Keys[1] that uses a small donation as proof-of-humanity. For donating you get an anonymous keypair that works across services without repeated CAPTCHAs. The economic friction doesn't scale for bot operators, and donations fund our non-profit[2]. [1] https://freenet.org/ghostkey/ https://freenet.org/ghostkey/ [2] https://freenet.org/ https://freenet.org/
  • DoctorOW 1y ago
    > The economic friction doesn't scale for bot operators Does the number of keys need to scale? If $1 buys a key for life, and signing can be easily automated why would it stop bots?
    • sanity 1y ago
      Keys embed approximate timestamps, so services can set age limits. The system was designed for Freenet integration where reputation can be attached to keys - repeat abuse would degrade a key's public reputation over time.
  • Retr0id 1y ago
    In the event ticket situation, how does this change the economics compared to just adding $1 to the ticket price? (or whatever your minimum donation threshold is)
    • sanity 1y ago
      It would add $1 to the ticket price, the goal is more to replace CAPTCHAs (which cost essentially nothing to defeat these days), but you're right that it wouldn't be a silver bullet in the ticket scalping scenario.
• hackingonempty 1y ago
  The reality now is the ticket sellers and bands are the main scalpers and everyone else are now secondary scalpers. Now that tickets are all electronic and the ticket sellers operate secondary markets there is no "face value" anymore and pricing is dynamic. Not all tickets are released at once and many are offered at "platinum" prices at first. All through the 60's, 70's, 80's, 90's and 00's concert tickets were around $40-$50 in 2025 dollars, now that is just the service charge. Just go on eBay and look at some ticket stubs then put the price / date into the CPI calculator. It turns out that the bands couldn't beat the scalpers so they became the scalpers, charging outrageous prices with the assistance of the ticketing companies. So stopping bots isn't as important as it was when CAPTCHAs were effective, since there is a lot less money on the table for professional scalpers to capture.
  • Spivak 1y ago
    Concert tickets are still that low, you just can't go to stadium shows for supermassive artists at that price. A saturday night at a popular EDM venue with a 2k capacity headlining an artist with ~500k monthly listeners on Spotify will run you about $25 for the floor or $50 for VIP. A "sticky floor" bar venue ticket with a capacity of maybe 300 for an alt-z band with somewhere in the realm of 250k-3M monthly listeners on Spotify will run you about the same. Being up at the rails at a Girl in Red concert set me back $60 at a 5k person venue. If you want to see supermassive artists for that kind of unit price you have to "buy bulk" and go to festivals.
    • immibis 1y ago
      I don't think that when people say "a concert" they mean something that happens every Friday and Saturday night. I think it means a unique event.
  • harrall 1y ago
    Most of my concert tickets are still priced around $40 inclusive, after taxes and fees, and from the likes of LiveNation, Etix, DICE, AXS, and so on. All my friends that complain about the rising cost of concerts tickets don’t realize that they just see the same old bands year over year. These scrappy up and coming bands that they saw as a kid aren’t scrappy anymore. That’s why blink-182 can charge $700 for the pleasure and still sell out — because most of their fans are in their late 20s or 30s, have disposable income, and number in the millions. Go to a $20 show for a band today and who knows, maybe they will charge you $700 in 20 years. Plus you can tell everyone that you saw them before it was cool. /s
• healthydyd 1y ago
  Just sell paper tickets at specific type of shops: convenience stores and such. Use an ID.
• AlienRobot 1y ago
  In my opinion the web is in dire need of a system of proof of humanity. This, together with a mixed system, could solve this sort of problem. For example, there could be an API for e-mail providers to tell services that an address belongs to a human. The provider would need to implement methods to verify the user's humanity, so you wouldn't need to give every online service your personal info, only your humanity provider that vouches for you. Something like SSL certificate hierarchies could be used to ensure that smaller providers aren't vouching for bots, i.e. you have a root CA that signs their certificates, and if it's found that they don't actually do what they are supposed to do, the certificate isn't renewed. This added with some actual costs to get those certificates would give them an incentive not to lie. I know some people complain about this not being "private," but let's be real. If you purchase anything from any online website, they have your home address, your phone number, your real name as printed on your credit card, and there is a non-zero chance that some moron stored your credit card number in plain text in a MySQL database. It's always going to be safer to trust PayPal than some random website with this information. Why not do the same with human identity? Finally, if you can't sign up with any humanity provider for some reason, just make the process extremely annoying and limited. For example, if you have 100 tickets to sell, reserve 90 for people that can prove they are human and leave only 10 for potential bots, then implement a lengthy process for those users so that's not worth it for the bots. If 90% of the tickets are already purchased by people, it will be less profitable for scrapers already.
  • chrismorgan 1y ago
    > then implement a lengthy process for those users so that's not worth it for the bots This “lengthy process” will be optimised by the bots, who have incentive to do so, so that it’s not worth it for the humans.
• nikolayasdf123 1y ago
  how about on-device biometrics? most of traffic is from mobile devices anyways. they have biometrics (e.g. Apple FaceID, fingerprint). they also have DeviceCheck (Apple Hardware + Apple servers) integrity checks of device/binary that is making requests. it is also free and private. why using this technology is not part of conversation? seems like utmost strongest guarantees and perfect fit?
  • moneywaters 1y ago
    Yeah that's good solution
  • politelemon 1y ago
    It is not "free" as you must buy such a device, nor is it most of traffic, and its privacy is questionable. A solution to the problem area here needs to cater to people outside the HN echo chamber.
    • nikolayasdf123 1y ago
      As a developer or website or app, I don't need to buy a device. User has to buy it, as it is theirs device. And chances are, they are on the iphone or other apple device already. And if not, they are on Android, which has comparable biometrics options. Are you claiming that owners of websites have to purchase laptops for their website visitors? And are you claiming that Apple has worser privacy than Android? or ... holdon, there is nothing else (Huawei is out of the question, and MSFT/Symbian does not exist anymore) this is crazy talk. what are you even saying?
  • arp242 1y ago
    So how would this work in concrete terms? How will this stop bad-faith actors who will go out of their way to abuse/fake things? How does it solve the "BAP theorem"? You can't just sprinkle a term like "on-device biometrics" and declare that solves it.
• 1propionyl 1y ago
  A lot of overwrought digital solutions here and not the obvious one: Stop selling online. Sell the tickets at a small number of locations near and including the venue, with cashiers empowered to deny suspicious transactions. Could someone put together a small army of smurfs to buy up all the tickets in major cities? Sure. Could someone have someone on the inside sell them a block of tickets against policy? Sure. We can handle these cases on a locale by locale basis with a convenience trade off that seems appropriate to the place. Don't let perfect be the enemy of the good, and even worse, don't let overwrought privacy-invading and non-accessible digital solutions (that create a playing field tilted towards bad actors equipped with AI tools) be the enemy of a dead simple analog real-world one that leverages our best reputation management system: ourselves.
  • debugnik 1y ago
    > Sell the tickets at a small number of locations near and including the venue People frequently travel to major cities for concerts, do you expect them to travel twice to purchase the tickets? Either you join a much wider network of sellers than that, or this would only satisfy people already living not too far from the venue.
  • azan_ 1y ago
    People propose overwrought digital solutions because not selling online is worse in almost every aspect.
  • carlosjobim 1y ago
    Scalping is a solved problem and only happens when artists and venues encourage it. Your solution doesn't do anything against scalpers, on the contrary it encourages scalping even more.
• teeray 1y ago
  > The naive economic solution to the problem would be raising ticket prices step by step until it is no longer attractive for scalpers to resell your ticket You can also just do like The Cure did and destroy the secondary market entirely: you can sell tickets through the platform and only for what you paid for them.
  • markasoftware 1y ago
    how does this prevent the scalper communicating with the buyer to demand an out-of-band payment?
    • wetpaws 1y ago
      [dead]
    • teeray 1y ago
      If all tickets are the same price, then any buyer-seller combination will do. I believe the seller doesn’t get to choose the buyer and both are anonymous. No way to coordinate such an out-of-band payment.
      • tptacek 1y ago
        They're not all the same price. They have the same list price, but once the show (or the desirable floor section of the show) sells out, the real price floats.
      • alterom 1y ago
        They don't even have to have the same price if the seller just effectively returns the ticket back to the system. Then it's up for grabs. There's no guarantee for the buyer that an out-of-band payment will get them the ticket (someone else can get it), and there's nothing that forces them to send an extra payment once they do get the ticket.
    • threeseed 1y ago
      Because the platform doesn't need to expose the details of buyer/seller. Most tickets these days are digital.
• modeless 1y ago
  I am unsympathetic when people insist on selling things for the wrong price and then come up with these elaborate schemes for fixing the problems they themselves caused. If they would simply sell tickets for the prices people are willing to pay in the first place then they wouldn't need to invade privacy or any of this stuff. I've heard the arguments they use to justify why they don't and they're all hogwash.
  • layer8 1y ago
    Why do you think they don’t?
    • kevincox 1y ago
      Because the whole business of scalpers is exploiting the difference between the list price and the price people are willing to pay. If this gap didn't exist scalping wouldn't be profitable. (As far as this article as discussing. They also serve some use for reselling tickets when you meant to go but can't but this doesn't have any more downsides)
      • deleted 1y ago
        [deleted]
      • layer8 1y ago
        Yes, but what do you think is the reason why they are not doing what you argue they should do?
        • nothrabannosir 1y ago
          Because there is a perverse incentive for performers to lean into scalping: selling out quickly is a mark of success. NPR's "Planet Money" had an episode a while back that covered exactly this. Not all artists lean into it of course, and it's usually not the actual artists anyway but labels, producers, etc. In that same episode they covered how LiveNation owns both TicketMaster and many venues themselves, and leverage access to the venues for power in the ticketing market. It may have been this one but I'm not 100%: https://www.npr.org/sections/money/2013/06/25/195641030/episode-468-kid-rock-vs-the-scalpers https://www.npr.org/sections/money/2013/06/25/195641030/epis...
• izabera 1y ago
  every time this comes up, the thread immediately gets 300 comments suggesting that everyone pays whatever amount to keep the bots at bay twitter sells blue checks for $8/mo and it's full of bots
  • charcircuit 1y ago
    The problem is not that bots are buying tickets. The problem is that the tickets sell out too fast.
• Incipient 1y ago
  This is a trivially solvable problem with essentially little friction for buyers. The industry doesn't WANT to solve this. I don't see why anyone believes or entertains the idea they are even trying.
  • mqus 1y ago
    The author builds a ticket system and says it's not trivially solveable. What's your trivial solution then?
    • everfrustrated 1y ago
      Sell tickets using an auction to set the price.
      • j16sdiz 1y ago
        This has huge impact on the friend base. Certainly not trivial
    • Incipient 1y ago
      Names on tickets, and an in-application/website transfer+fee process that stops people putting on a mark up. Revert to the current anonymous ticket process for any lower popularity event for simplicity if required.
      • theamk 1y ago
        I want to go to concert, and going alone is no fun. I've convinced my 3 co-workers. I buy 4 tickets for us. Situation 1: My co-workers could not get time off work, so I am asking my tennis buddies instead. I am transferring tickets to their names. Situation 2: I am actually a scalper! I've got paid 10x times the price (via venmo), and I am transferring tickets to those random people. How do you tell those 2 apart?
        • nextn 1y ago
• yread 1y ago
  There will be a concert for 750th anniversary of Amsterdam in June (held on the highway ring around the town which will be closed). Tickets were free, sold out in 5 mins, immediately available from scalpers for 200 euros. https://nos.nl/artikel/2568164-chaos-bij-ticketuitgifte-voor-jubileumfeest-op-a10-in-amsterdam https://nos.nl/artikel/2568164-chaos-bij-ticketuitgifte-voor...
  • tripplyons 1y ago
    This is a great example of the problem with ticket prices. The problem is that the price they were originally sold at was not a fair market price.
    • theamk 1y ago
      Well yes, the concert is funded by city, and they wanted everyone to have a chance at attending, no matter what their income was. Not everything needs to be sold. The problem there was not having enough security - it's like store giving out free popcorn, and someone comes and steals the whole cart. In the physical world, there would be someone standing next to the cart watching that people take reasonable amounts. In the digital world, nothing was done, so thieves stole a lot. Not sure what the best solution was to be there... I like the idea of giving people few days to sign up, then randomly choosing who gets to go. Of course this has its own problems - for example you want to allow groups, but this can be abused. Identity verification helps with that, but this makes ticket checking much slower....
      • xxs 1y ago
        A solution: It's NL and the everyone has a personal id. There is a national service to validate that, too. One week accepting of requests - a person can submit multiple id (incl. children). At the end of the period a random lottery with some bias to people registered in the city (in the end the event is paid by them)
• amai 1y ago
  What about this schema: The first ticket you buy costs the normal price. The second ticket costs twice the price. The third ticket is four times the price and so on. Scalpers who buy many tickets at once will go bankrupt before they can buy all the available tickets.
  • jszymborski 1y ago
    You can even limit max tickets sold to one person at two or three, but the trouble, as I understand it, is that it's hard to identify individuals as being... well individuals.
• mschuster91 1y ago
  The solution is, as always, simple: regulation. In this case: - break up Ticketmaster, Live Nation and their European friends. Ban vertical integration. And for good measure (and to placate the public who is out for blood, and I mean that one in the literal sense - ask a random on the street about what they'd do to scalpers and TM, I'd bet good money on at least 50% going for one or another form of violence), place their execs behind bars for a decade. - mandate that a ticket holder has the right to transfer a personalized ticket for free (plus, in the case of actual paper tickets, a reasonable small service charge for postal fees) - in conjunction, ban the sale of tickets above face value, including any sort of deals, and place significant fines on violators of both ends. This completely eliminates the "second hand" scalper market. Of course, black markets will still crop up, but when both sides cannot be certain the opposing trade partner is a cop... Unfortunately, this would also kill a lot of income for the big players - chiefly, the ticket sale platforms that currently make an insane amount of money on bogus charges for name changes on tickets as well as running their own resale markets where they can double or triple dip on fees (depending how often that specific ticket gets sold back for whatever reason). And that is why such a movement will probably never happen during our lifetime.
  • ahtihn 1y ago
    Why should ticket sales be regulated? Why should the government care about what price event tickets sell for? Concerts are pure luxury. I like going to concerts, but I don't see a reason why the government should intervene? Scalpers exist because artists underprice tickets on purpose.
    • mschuster91 1y ago
      > Why should ticket sales be regulated? Why should the government care about what price event tickets sell for? Simple: because a government should take care about what its citizens want. And on top of that, the economy (aka artists and venues that really REALLY don't want to deal with TM but have no other choice) also wants it. That's why anti-trust legislation was created. It just fell out of practice to actually use it.
    • BrenBarn 1y ago
• nextn 1y ago
  An option I'd like to see implemented is to make the customer put down a bond. Besides charging the customer for the ticket, also charge them another higher amount that gets refunded x days after the concert. If the customer is found to be a scalper don't return the bond. Scalpers can't pay high bond amounts at scale combined with the risk of not having the bond returned.
  • xandrius 1y ago
    Also filtering people who don't own much to begin with?
    • VladVladikoff 1y ago
      Yeah when I was a teen I might have had $40 for a show but not $500 for a bond.
    • kimos 1y ago
      This is the issue with most proposed solutions here. Artists (bands) want to sell tickets to fans and people who appreciate them. And many (probably most) have very little money. They are able to scrape and save for a ticket. But not some bond deposit, arbitrary ticket fees, auction pricing, etc..
  • Retr0id 1y ago
    How do you figure out whether they're a scalper or not?
  • abduhl 1y ago
    How do you determine scalpers? I buy 6 tickets for me and my friends and we all get sick. Are we scalpers? I buy 1 ticket and a work trip gets foisted on me the next day so I try to resell. Am I a scalper? Won’t everyone just charge the ticket buyer the price of the bond? So this still only harms the fans that want to see the show. The scalpers just need to have more up front capital in your system.
    • nextn 1y ago
• koch 1y ago
  What I don't quite understand is why we haven't merely come to the conclusion that, like everything else, the internet costs money. Running servers and services costs money, and by giving it away for "free" from the get-go encases certain types of problems in the platform itself. I'm not talking about paying your ISP, I'm talking about accessing websites. I guess what I'm getting at is that there is no cost to making a request over the internet. Why not? Why doesn't every http request have a corresponding price associated with it? You can access the resource if you pay. I imagine this would be a minuscule amount ($0.00001 or less per request). Then, instead of trying to solve for monetizing eyeballs or personal data, these problems are solved with economics.
  • LegionMammal978 1y ago
    From TFA: > If a spammer needs to spend 0.0001 € in power to access the site only to gain a marginal profit of 0.00005 €, they are losing money with every site access. However, if a ticket scalper needs to spend 0.0001 € in power to buy a ticket that they will later sell at a 200 € profit, this will not stop them.
    • tptacek 1y ago
      And, long before the proof-of-work thing was popularized, people were already farming out high-margin captcha solves to cube farms full of people in Asia.
  • landl0rd 1y ago
    This fixes indians in boilerrooms and nigerian spam emailers but specifically not ticket scalpers. The profit is too large. Also because users don't actually control the number of HTTP requests they make. Think of sites that load individual icons rather than sprite sheets. Think of sites that fire off 1,000 tracking calls per minute. So respectfully screw that.
    • const_cast 1y ago
      Maybe if we do this then those sites will be disincentivized from doing all the tracking. Because consumer's will get their bill, say "what the fuck", and go to a competitor.
• cedws 1y ago
  I don’t get it - why not just tie the ticket to a name and address at time of purchase? Then verify that matches the person using government issued ID upon entry?
  • abetusk 1y ago
    How would you handle the following conditions? * I buy a ticket for a friend (maybe as a present) but don't actually want to go to the concert * I buy more than one ticket for a group of people (I'll be attending the concert) * I buy a ticket but have to cancel at the last minute and want to give it to a friend * I don't have an easily available government ID (maybe I never got a drivers license, maybe my drivers license expired, etc.) * People attending the event aren't American. They will have their passports from other countries. How will you verify each passport is valid? * The event draws of people from a majority of the 50 states in the USA, with each state having different government IDs (driver's license) with different versions of the IDs within each state. What are the logistics of validating the IDs presented? In the base case of one ticket per individual that has a valid government ID that has their current address printed on the ID, what service are you using to validate this ID and to validate that the presenter of the ID is associated with the ID? What is the cost and how many transactions can it handle per second?
    • gruez 1y ago
      >How would you handle the following conditions? It doesn't, but that's fine, because it's the cost of preventing scalpers. Everyone just accepts that you can't buy a flight ticket as a present, for instance.
      • abetusk 1y ago
        This is maybe the answer, but I'd like to at least acknowledge that this is what's being proposed: Buying tickets for shows has the same security requirements and domestic and international flights.
        • sealeck 1y ago
• spoonsort 1y ago
  Tunnel-visioned article, honestly. I mean, why does he gloss over the fact that scalpers don't care about captchas - they can just outsource solving them to other humans. Giving your driver's license or passport to some entertainment company's security-unaware sysadmins doesn't seem like a good idea either. Maybe just accept the fact that you gotta be lucky to see most famous band in the world in person. There are only x hundred seats for 10 million people...
  • davidmurdoch 1y ago
    Maybe read it first?
• 1oooqooq 1y ago
  who cares about tickets for shows. but try to buy an airplane from airchina and experience first hand being a false positive bot. just hope there's another airline serving your destination.
• akrymski 1y ago
  Could someone explain why tickets aren't sold via an auction mechanism? Surely that's the only fair way to distribute anything of limited supply
  • cptroot 1y ago
    The answer is mentioned in the article. Not all concerts want only people with means to attend. The venue might want to be accessible to low-income members of the community, or it might be a benefit concert, with free tickets and a donation drive.
    • akrymski 1y ago
      What's wrong with giving out some free tickets to low income members of the community?
      • mixmastamyk 1y ago
        Nothing in theory, but ticket sellers probably don’t want to get into the means-testing business.
        • akrymski 1y ago
          You can't hand out money (which you're doing if you're giving away something of market value for nothing) without taking on the responsibility of deciding who gets it. Even charities have to put in the work.
          • mixmastamyk 1y ago
            You can if you just DGAF, like TM. Reminded of this sketch: https://snltranscripts.jt.org/76/76aphonecompany.phtml https://snltranscripts.jt.org/76/76aphonecompany.phtml
  • RainyDayTmrw 1y ago
    That's only "fair" in a certain, academic sense, which claims that willingness to pay more money makes someone more "deserving" - completely ignoring socioeconomic status. That also offends a lot of people who oppose the above reasoning.
• MallocVoidstar 1y ago
  > A related option is to strongly bind purchase limits to other resources that are not easy to acquire quickly in large amounts, such as allowing only X tickets per (verified) phone number Phone numbers are very easy to get in large numbers. US-based SMS numbers that will pass verification for buying sneakers are ~$0.25 each.
• sholladay 1y ago
  As a human, I’ve had a bunch of positive experiences with Cloudflare Turnstile. It always seems to correctly identify me as a human faster than I could solve a CAPTCHA, without me having to do anything. I can’t speak to how effective it is at catching bots, though. Maybe it just errs on the side of assuming human?
• kassner 1y ago
  I can’t claim I’m the first one to think about this, but every time Ticketmaster shows up on HN I keep coming back to this idea: Sell the tickets with regressive price based on time. Sales starts say 2 months before event, initial price is truly exorbitant, say one million dollars. Price decreases linearly down to zero (or true cost price). At any point, people can see current price and the seats left. Now every potential spectator is playing a game of chicken: the more you wait, the lower the price, but also lower are the chances that you’ll have a ticket. That would capture precisely the maximum amount of dollars that each person is willing to pay for it. This idea sounds extremely greedy, because it is, so I can’t fathom that no one ever pitched this in a Ticketmaster board meeting. My idea, however, was a bit less greedy. Once you sold the last ticket, that would be your actual (and fair) price-per-ticket for the concert, and everyone would be refunded the difference. You’ll never know how low it will go, so you shouldn’t overpay and hope it will lower later. I’m pretty sure Ticketmaster will skip this last part if they decide to implement this. There are multiple issues with my idea, it’s elitist, promotes financial risks on cohorts poorly capable to bear them, etc etc, but it will definitely fix the scalpers problem. Pick your poison.
  • jmalicki 1y ago
    This is a similar idea to a second price auction, but in reverse. Everyone puts in their maximum price they're willing to pay, and the lowest price that fills the seats is what people pay. The advantage to this model is that there is no financial risk to overpaying. Of course with an open bid continuous auction there are problems with bid shading (manipulating the auction by posting prices mostly meant to influence other bidders), but it's overall economically very close to your idea.
    • immibis 1y ago
      People don't know the maximum price they're willing to pay. There's actually a probability distribution, not a hard cutoff, and certainly not one known in advance. The higher the price is, the less likely I am to buy it. Auctions work for two classses of people: spherical humans in a vacuum, and economists.
  • 1y ago
• razzledazzle201 1y ago
  Isn’t world coin an answer?
  • j16sdiz 1y ago
    Isn't dystopia an answer? Yes, but no.
• fdsafaefew 1y ago
  [flagged]
• kylecordes 1y ago
  My usual gripe: Somehow it is unethical for person/organization/etc putting on an event to make more money on tickets in hot demand. ...but ethical for opportunistic arbitrageurs to make that money. This suggests a highly misguided notion of ethics.
• timshell 1y ago
  I'm a founder in this space (www.roundtable.ai; YC S23) Behavior is a big missing link. Many CAPTCHA services (including Google reCAPTCHA v3) claim to use behavioral analyses, but you can disprove this using Operator to fill out a form and see reCAPTCHA and other bot detection systems flag it as a human. At Roundtable, we rely on first-order behavioral markers (keystroke, mouse, scroll, click) etc. When first-order are sufficiently spoofed, analyze higher-level cognitive traits (e.g. incongruent effect in Stroop)
  • _rami_ 1y ago
    (Author here) Interesting! How do you differentiate between a bot and a screenreader user? Both won't move their mouse, scroll, etc but only send a single click event
    • timshell 1y ago
      Yup, we had this with open-end analysis (see: https://www.producthunt.com/stories/how-to-detect-ai-content-with-keystroke-tracking https://www.producthunt.com/stories/how-to-detect-ai-content...) We had some people use voice software to fill in survey responses. This flagged computer-generated assistance. Generally speaking, it'll be more than a single click event (e.g. see https://x.com/_magrawal/status/1925985289568211168 https://x.com/_magrawal/status/1925985289568211168)
  • metladsl 1y ago
    that's not entirely true. reCAPTCHA v3 relies on your Google account as a signal and what activities it has performed out in the wild. It's not exactly privacy-conscious, but certainly behavioral.
    • timshell 1y ago
      Here's a GIF where reCAPTCHA v3 can't detect Operator: https://x.com/_magrawal/status/1925543620217905641 https://x.com/_magrawal/status/1925543620217905641 'Behavioral' is loosely defined, but it seems like the behavioral tells of Operator are quite simple
• a2128 1y ago
  I always love when I come across a website using Google's reCAPTCHA v3. Usually they have it on their register page, and I get a confusing error message because I didn't pass it and the website owners put no option to do anything about it or prove my humanity in any way. Then I try the same thing on Chromium instead of Firefox and magically it lets me pass. The internet used to be complicated requiring institutional knowledge about where to go and how to make things work, then it became simple, now it's back to becoming complicated requiring institutional knowledge about how to make things work.
• chrismorgan 1y ago
  On proof of work, the situation is actually really bad in more fields than just ticketing. As noted in the article, proof of work isn’t about distinguishing between computers and people, it’s about making things expensive for everyone. Put bluntly, it’s rate limiting. Unfortunately, it’s bad rate limiting: it only works if there’s a level playing field. The trouble is that, when the value of a target is high enough, people figure out ways of cheating. This can be illustrated with Bitcoin mining. It uses SHA-256 hashing, and at first, mining was done on CPUs. But it turns out you can implement SHA-256 on GPUs, and it’s waaaay more power-efficient/fast; and so CPU mining rapidly became unviable. Then came FPGAs maybe (can’t remember if this was really a separate stage, or rapidly passed) and ultimately ASICs, all making it faster and more power-efficient. The best Bitcoin mining rigs are more than four million times as power-efficient as any web browser in my powerful four-year-old laptop. So that’s Bitcoin. Now how about these online bot prevention things, which must rely on only being able to use CPUs, doing proof-of-work? They use SHA-256. Yes, the algorithm that Bitcoin has rendered useless for proving work on a CPU. Anubis and ALTCHA say they use SHA-256, and a glance at Friendly Captcha’s worker source includes familiar magic numbers. So you know what comes next: if these things become valuable enough targets, people offload the solving to GPUs and ASICs. And once you have a power level difference factor of a few thousand or million, you can’t fix it by adjusting problem difficulty. No, current proof of work schemes are bad rate limiting, and they’ll need to rethink everything completely if they become popular. I just don’t get why they didn’t at least start with something like Argon2d, which would at least stave off the evil day. Did they learn nothing from cryptocurrency? SHA-256 is almost the worst choice imaginable for a proof of work scheme, because of how much effort has already gone into undermining it. I genuinely believe these bot prevention things would be approximately as effective, at least for now (and their choice of SHA-256 shows this is all they care about) if their script replaced the proof of work with a simple busy loop of similar duration, told the server it had done so, and the server trusted it. In their present form, I imagine someone who knows what they’re doing with hooking stuff in a headless browser, and writing code for a GPU or an ASIC, could effectively bypass any one of these services in less than a day, reducing the cost by a factor of thousands or millions.
  • reisse 1y ago
    You miss a big difference between cryptocurrency and PoW captchas: it's very hard to change hashing/PoW method in a blockchain (you need ack from 50% + 1 validators, and all the validators are by definition heavily invested into the current proofing method - they have natural reason to object), but it's very easy to change hashing in a PoW captcha. So here any cheating will start a whack-a-mole game, where the defenders have the upper hand (changing PoW method is cheap, using multiple PoW methods is cheap, investing into ASICs isn't).
• cyp0633 1y ago
  Even privacy unfriendly methods may not solve the problem. Buying large concert tickets in China has required the buyer's personal ID since several years ago, and the personal ID associated with the ticket cannot be changed after the order is placed. At the entrance of those concerts they do verification based on ticket, ID card and facial recognition. There are still many scalpers who offers tickets even after they're "sold out", though. What they do is to let buyers lie they forgot their ID cards so that there's a higher possibility of entering with the ID card provided by scalpers (which they used to buy tickets). And by the way, the scalper don't have to provide their own ID card - personal information leakage is so common here.
• timeattack 1y ago
  1. Digital tickets are purchased via mobile-friendly site or app. 2. Tickets are verified at entrance via time-sensitive QR code displayed in the app. 3. You can "resell"/transfer a ticket to another account (say, friend) via app for a small nominal fee with the cost of ticket refunded to you, but only if you provide ID (of any sort, which can be more or less reliably confirmed). 4. Ticket can be printed to obtain non-time-sensitive QR code, but only if you provide ID.
• bbbbvcx44 1y ago
  I'm finally seeing what Altman saw with his world coin
• HenryBemis 1y ago
  > In 2014, Google presented the one-click CAPTCHA and later, with reCAPTCHA v3, the “invisible CAPTCHA”. Similar services are offered by other companies like Cloudflare, Akamai, and others. They rely on analyzing everything they know about you and feeding it into a large machine-learning model to compare you with behavior... > This requires the creation of extensive centralized profiles about the people visiting your site. Very nice wording to avoid/workaround GDPR/EDPS attention. So, they compare "me" to a "behaviour". Notice the words.. not "my behaviour" to "ProfileType_004 behaviour". Because that would be "profiling" and GDPR don't like profiling! So.. On the second quote, again, they compare something vague to "centralized profiles" (what I wrote as "ProfileType_004" above (or whatever they are called in each vendor). Again, the ether is compared/matched to a profile, so.. they profile us :) ufff...
• drog 1y ago
  I felt that captcha is over when I struggled to solve microsoft rotating planet captcha when I tried to restore account there. It looked like those IQ test questions.
• robalni 1y ago
  I feel like the only protection against AI in general, not just for tickets, is trust. If I trust you, you can do whatever you want as long as I trust you. If I don't trust you, you can do whatever you want; I will just block or ignore everything you do. It's when we try to interact with random people that we get problems. Doing that will become less and less possible the more AI grows. We will have a future where trust is very important.
• 9woc 1y ago
  1. outlaw ticket reselling 2. only allow tickets refund to the original seller
• red_admiral 1y ago
  If they really want to solve the problem, how about this - kind of like the ESTA for travel: Individuals must register an account with government issued ID and the same level of KYC security as to open a bank account. This must be done a certain time in advance before the tickets for an event open. You can only buy tickets for yourself or other already registered users whose username (or similar) you know - and only as long as you are buying a ticket for yourself too. Some kind of exchange mechanism were a buyer can return a ticket to the pool and if someone else buys it, they get slightly less back than they paid in the first place, effectively allowing them to "resell" a ticket but at a slight loss (even if the platform takes a cut). Please don't use blockchain for this. Maybe you can go full Chinese train tickets on this: you buy a ticket on an account backed by your government ID, and then your ID is what opens the platform gate for you. Your ID is your ticket.
  • lentil_soup 1y ago
    that's addressed in the article. It's the privacy unfriendly solution of venn diagram
    • jppittma 1y ago
      The government needs to support OAuth2.
• neallindsay 1y ago
  Computers keep getting better at acting like humans, but humans don't get any more obviously human.
• avastel 1y ago
  Yeah, not (too) surprising after a few years in the anti-bot industry. Last week I looked into a Binance CAPTCHA solver that didn’t use a browser at all, just a basic HTTP client. The attacker had reverse engineered the entire signal collection and response flow, including how the CAPTCHA was marked as solved. They were able to forge the expected telemetry despite some obfuscation. https://blog.castle.io/what-a-binance-captcha-solver-tells-us-about-todays-bot-threats/ https://blog.castle.io/what-a-binance-captcha-solver-tells-u... This is pretty standard now in bot-heavy spaces like ticketing or sneaker drops. CAPTCHA often just ends up being a protocol to collect signals, and if those aren’t tightly bound to the browser/runtime, they get spoofed. Also not surprised PoW isn’t holding up. Someone reverse engineered the PerimeterX PoW and converted it to CUDA to accelerate solving: https://github.com/re-jevi/PerimiterXCudaSolver/blob/main/powsolver.cu https://github.com/re-jevi/PerimiterXCudaSolver/blob/main/po... At some point, it’s hard to make PoW slow enough for bots without also killing UX for humans on low-end devices.
• fadsiooie3 1y ago
  [dead]
• carlosjobim 1y ago
  I work professionally in ticketing with ticket sales system. The problem with scalpers is completely solved, and the only reason why scalpers can operate is because the artists and venues deliberately allow for it. It's incredibly easy to remove scalpers: Sell each ticket with a name attached, ask for ID at the door. That's it. Whatever hacker argument against this you are thinking up right in this moment, it is just wrong. "What if I don't know who I'm going to ask to go with me?" - Then buy your ticket once you've figured that out. As for tickets that are so popular that servers can't handle the demand: Make a lottery and give people one day to sign up for the lottery.
  • mixmastamyk 1y ago
    Implementing costs that not all parties want is tradeoff, not a solution.
    • carlosjobim 1y ago
      What costs are you talking about?
      • mixmastamyk 1y ago
        Loss of privacy, slowdown at the entrance, employee training on validation, not being able to hand a ticket to a friend later (you mentioned). Other things I’ve forgotten but others have mentioned on this page. Scalpers have helped me out several times when I didn’t hear about an event until the last minute, so I don’t always think of them as an enemy to eliminate. Patio11 has a piece on how, often, the optimum amount of fraud is not 0. Scalpers aren’t exactly that but informs the discussion.
        • carlosjobim 1y ago
          Loss of privacy? That your name is on your ticket? Then don't go, or reach out to the organizers and let them know you are a person who needs special protection and they will accommodate you and your entourage. Your name is on your bus card also, and your airline ticket, but I don't hear anybody complaining about loss of privacy for that. Employee training on validation? They look at the ID and see if the name matches the name on the ticket. Anybody can do that without any training. > Scalpers have helped me out several times when I didn’t hear about an event until the last minute, so I don’t always think of them as an enemy to eliminate. They helped you by screwing over other people. You do not have higher value than any other person. Besides, organizers can save expensive last-minute tickets without needing scalpers.