Hacker News Reader

Comment by dec0dedab0de | Hacker News Reader

What there really should be is a wallet equivalent of an ics file. It doesn't need to support everything, static images would be enough for most use cases. Advanced features could then require the current model.

But that would require collaboration, and standards, which seem to have gone away as smart phones came in.

View on HN

W3C Verifiable Credentials [1] does almost exactly what you suggested and was recently approved as a top-level W3C standard. Adoption has been sluggish outside of digital identity (with Android [2] and the EU digital identity wallet being notable exceptions), but I think it is because the family of standards is relatively new.

[1] https://www.w3.org/TR/vc-overview/

[2] https://developer.android.com/identity/digital-credentials

This has existed since the first version, except it needs to be signed with a valid apple cert.

A .pkpass file is a zipped directory that has a json file and some assets. There's no need to have a more limited version, a pass is already very limited.

The issue is spoofing. Major event ticketers are unwilling to publish passes if there's nothing to stop someone else from publishing a pass that is indistinguishable from their's and thus is an avenue for fraud.

The difference with events is that an ics file is not something someone's going to try to sell you or that you'd want to buy. But anyway, all Apple would have to do is stop checking the signing.

This exists, .pkpass. You mostly don’t know about them because iOS tries to abstract away the file system, and because each one has to be code signed by a registered Apple Developer account.

Apple has .pkpass

As alluded to in the ancestor comment, signing the .pkpass requires an Apple developer account.

The problem is that those are treated almost like an app, you need a $99/year developer certificate to publish them.

Many third party ticketing solutions venues and events use do support this, but for instance if you want to sell tickets for a party and self-host, you need another external integration, or a developer account. Generating a PDF with a QR code, and publishing an .ics file is essentially free.

My guess is that the are requiring this in order to reduce the amount of fraud there (I am sure there still is some, but...). Apple really does not want to be involved when someone can't get into the Taylor Swift concert that they paid some scammer a lot of money for the Apple Wallet ticket they got.

Having an authenticated developer account at least provides some level of speed bump to scammers, and a better starting point for the police.

There are many events that are still sending you a pdf file with your tickets. Until fairly recently, that included major venues too.

The charitable explanation is that the wallet is designed for credit cards, and tickets were an after thought. Though I suspect it is really Apple trying to keep a walled garden, just like they always have.

Reply on news.ycombinator.com