Hacker News Reader

Comment by wrs | Hacker News Reader

Did I interpret correctly that this sends a push notification every minute telling your phone to download a new code? If so, that seems like a battery problem…

View on HN

The article mentions they need to be refreshed every week, so I'd guess at most once a week.

The RefreshAt is a week, but if the code is actually valid for a week, it's not clear why a simple screenshot of the code didn't work.

I don't know security that well but if the puregym app refreshes the token then the old tokens would expire immediately right?

Nope. As I read it, any token less than a week old would work. So for any user, they have 7 * 24 * 60 tokens live at any time.

He said the code from Monday didn't work on Tuesday

Yeah, screenshot on Monday, messed with the app that evening, tried using it Tuesday morning -- dead.

I've seen people on PureGym's Twitter successfully refreshing screenshots weekly though, and the API response suggests the same.

That being said, I couldn't find a validation endpoint to check if mine got invalidated by something specific (maybe signing out?) or if there's some other magic happening.

I wonder if opening the app invalidated it, and those people who had it working just screenshot once.

My gym has a similar system but I realised it's time based and the app functions without Internet. I installed the app onto an old android with no sim, logged in at home over WiFi and it successfully regenerated QRs without data

It seems like it did work and they didn't want to deal with manually updating it weekly

Because you’d have to waste the time to take a new screenshot every week, of course.

Probably invalidates old tokens when a new one is generated.

I think ideally you'd do it maybe every day or so, so that if the user goes offline for a while, or the server you're running goes down or something, the pass will continue to work for at least 6 days. It buys you a lot of time to fix things.

You can send background push notifications which are delivered when the phone is ready for them. They don't deliver when the phone is low battery or in low battery mode. It's specifically made to reduce battery consumption.

Higher priority push notifications require a user visible UI element and ca be delivered regardless of certain low power situations.

It sounds like this only helps power consumption after you've already run low on power. Seems like processing frequent notifications would accelerate your progress toward that low power state.

Yeah but many people turn on Low Power Mode manually every time they unplug or via automation at a high threshold.

> Higher priority push notifications require a user visible UI element

The QR code for a pass sure sounds like a priority user visible UI element.

Only if it’s visible, from the sound of it these are background notifications so that the QR code can be ready if you open the pass.

Reply on news.ycombinator.com