Hacker News Reader

Comment by roebk | Hacker News Reader

This was the same situation for the UEFA Women’s Euros in England this year.

For those wondering, the app was simply for storing, transferring, and displaying your tickets. A ticket being a QR code for you to scan at the stadium turnstiles.

Was the app required? Absolutely not, there was nothing specific that the mobile app could do that a simple website couldn’t (apart from the screen brightness jumping to 100% when displaying the QR code). I’m sure even a printed QR code would of sufficed.

Both UEFA and FIFA should reconsider their approach to ticketing.

View on HN

> there was nothing specific that the mobile app could do that a simple website couldn’t … I’m sure even a printed QR code would of sufficed.

I don’t know about that app specifically, but most of the major ticketing providers are doing dynamic barcodes[1] now that are effectively TOTPs for entry. You can’t do this reliably on the web for a major event because you can’t assume network connectivity, and obviously a printout or screenshot won’t work.

1. https://techcrunch.com/2019/05/16/ticketmaster-put-an-end-to...

> You can’t do this reliably on the web for a major event because you can’t assume network connectivity

I can't believe I'm saying this, but you could've use PWA instead (except for brightness).

You're not wrong, but the pushback for doing an app like this as a PWA will always be discoverability - it's a lot easier to just say "search UEFA 22 in the App Store" than it is to point people to a URL and teach them how to use the add to Home Screen functionality.

But dont these apps require network access to function?

Not at the venue, no. The relevant tokens are saved locally and the barcodes are rendered on-device once you’ve accessed the ticket, which you can do hours/days in advance.

Some of TicketMaster’s API docs for this are publicly available so you can get an idea of how it works - https://developer.ticketmaster.com/products-and-docs/apis/pa...

How exactly does that not work with browsers and local storage though? It seems like they're just caching stuff in the app and they definitely can do the same in browser storage.

> How exactly does that not work with browsers and local storage though?

On iOS, at least, local storage for web apps doesn't have guaranteed persistence. Safari can and will "randomly" clean up, usually if the device is low on storage. This happens less frequently for pinned PWAs but still happens.

If you need to absolutely guarantee that your thing will work on an offline mobile device, you have to use a native app.

I just used (against my will) the Axs app to go to a local show. It required location services to be enabled and didn't show the random qr code until it could verify I was at the venue.

I haven't seen a paper ticket in a long time.

It's not the same thing. There are two apps, not one - one is for ticketing, the other is supposedly for "COVID".

Second: the UK government does not have a death penalty for being LGBTQ (or blasphemy.) It's been decades since any form of official corporeal punishment happened in the UK, whereas in Qatar it's probably been weeks, at best.

Paper tickets can be resold into the tout/scalper market. Electronic tickets can't. That's a nice feature for FIFA.

You would be surprised how well app screenshot in full screen with the qr code works.

Seen this many times with covid vaccination passes.

No idea about this app, but presumably that's the reason why quite a few apps show animations and a rotating code word alongside the QR codes, so staff can easily spot that kind of thing.

Doesn't work for these tickets since they're generating new underlying values as time passes.

Even Costco has self-modifying barcodes now, so covid vaccination passes are behind on the times.

It seems like it adds a barrier, but wouldn't the scalpers just sell phones with the app and ticket loaded? Old Android phones are quite cheap.

For countries that already require you to register SIM cards with your government ID, I wouldn't be surprised if one day they require that all phones be biometrically locked to their owner.

When producing a QR code, the signature could include the date that the QR code was generated, and the date that the phone was biometrically linked to the user (signed by a device-specific key in the secure enclave, itself signed by the manufacturer's key).

Venues could then require that you were using a phone that had been soul-bound to you since before the tickets were first available for purchase.

(For the avoidance of doubt, what I'm describing here is the basis of an Orwellian dystopia, not something that I think should ever be implemented.)

What stopping you from taking a screenshot of the qr code and send it to the buyer? The timestamp can be bypassed by sending the screenshot when the buyer is already at the ticket-checking gate.

These apps generate a new code based on the time, etc. Its basically a TOTP password for an event.

They still get scalped but you have to do it through their approved scalper app

Reply on news.ycombinator.com