Then you would only need to print one barcode rather than lots of tickets. And if you buy tickets online it saves having to go collect them as you already have your barcode!
Barcode alone might be insecure, but must be some way of having a single ticket instead of separate ones. Needs to be cheap and quick to process at the venue end.
Sometimes depends on what your priority is: ease of sale (do it all electronically) or ease at the venue (quickly tearing tickets).
Would work well if all this can be held on your phone – no need to print anything out – but that could get tricky if you're buying tickets for multiple people, who may not all arrive at the same time.
It's also tricky getting all the kit out to multiple venues, particularly on the Fringe where so many are temporary and a range of different systems are used.
How about this though... you buy the ticket in advance through an app, then when you reach the venue your phone recognises you've arrived (GPS?) which triggers an image on the screen. The front of house staff just need to see the image as you go through and everything is logged automagically.
Along the lines I was thinking - a phone app that acts as a digital wallet and ticket all in one. Could have the option to send any of your tickets from yours to a friend, or send them back to a festival box office for friends to collect printed tickets without the app (eg if you were going to go as a group and bought the tix but then couldn't make it yourself). Could also return a ticket (to venues that accept them) if you got held up at work, for sale to a returns queue for example.
It would need to be designed to cope if the phone was out of signal at the door of the venue, so tickets would be locally stored on the device and GPS might be tricky. Could always use GPS as a first option and either wifi or bluetooth based location or even a fixed barcode that front of house scan with your phone to tell it where it is.
It would be much quicker than traditional barcode systems as customers could all have their "tickets" onscreen in the queue and there'd be no need to wait for a lookup on the database at the door. The app could sync back with the system when it had signal back to update which tickets had ultimately been used and allow venues to keep count of audiences.
Plus, since it depends on customer's own technology it's easier for them (nothing extra to get/keep/lose), very easy for the venues to deploy, and self-limiting at first to more tech-savvy customers which would allow for a gradual introduction without a sudden system support burden.
It's basically just an on-device email client with a bit of anti-fraud security built in...
Hi Andrew, it would be interesting to see if other festivals/events have something similar. The fact that each event in Edinburgh generally needs its own ticket sets it apart from a number of festivals and conferences.
Might be something to discuss with Red61 and other providers when things calm down in September/October.
(One day I'll tell you about the Fringe's 'buy by text and get it delivered by moped' scheme in 2000. Not much take up.)
The staff would still have to check/record every ticket at the door somehow.
1) If they didn't, the potential for fraud is far to high - just showing an image on your phone screen to staff could easily be copied.
2) Venue staff must know how many audience they have for fire regs, at the time of the show. Having the app send back if the ticket was used later won't work, that will be to late. (also, you have no guarantee that the app will actually be able to do that - it might never be run again and so never have the chance).
BBC uses barcodes on their tickets, next to a big warning saying "only one person with this barcode will be admitted" to discourage you from copying it. I took that to mean they would scan them all at the door, but actually they didn't, so you could have copied their tickets :-)
If you want ideas, look at the airline industry. There you have tickets (boarding passes) with barcodes. These can be issued at a counter (check-in), printed at home, or shown on your mobile via an app where you are logged in to your account. The app stores to ticket so it works off-line.
The airport (venue) scans the barcode on the issued/printed/mobile ticket and confirms validity.
Venues would need to have barcode scanners, but these could be iPod touches with a QR scanner app linked to the venues ticketing database via wifi. There would be hardware and development costs, but these could be offset against reduced need for hardware for self-service printing of tickets and box office staff as tickets could be printed at home or shown on a mobile.
The only difference with the airlines is that you will want to make the tickets transferable (which airline tickets are not) but the self-printed tickets will be transferable as they do not need to be shown with ID.
No reason why you could not have one person who has booked for more than one person have all booked tickets barcodes on one mobile device.
Thomas P - good suggestions but there are challenges. The biggest difference between airline and venues is the temporary nature of the venues (even wifi can be challenging to deploy in some environments esp without access to a suitable uplink connection in place and 3G signal is too unreliable in many areas) but moreso the speed at which the queue need to be processed - seating a venue on a festival style turnaround means that even the couple of seconds it takes to scan a QR and connect back to a database (even with local caching) is too long. An airline can ask you all their security questions, tag your bag etc while the other parts of the process are ongoing. In general where people roll out barcode-based ticketing they add permanent infrastructure and additional door staff to offset the delays, but that would be very challenging for many festival venues.
Also, many visitors don't have easy access to printers during their stay so print-at-home ticketing can be problematic.
James B - in fact, most venues don't need an immediate count of the numbers of people attending. Real-time capacity management is generally done by just making sure that all the audience are in a seat (presuming you have a fully seated venue). In an evacuation in most scenarios counting the stubs isn't a priority - there's too much potential for an overcount (accidentally tore the credit card slip as well as the tickets) or undercount (some stubs got dropped by the usher or not torn).
In common with other public spaces most venues focus on having a procedure for staff to verify each space is clear as they leave the building. For the vast majority of spaces it's faster and more accurate to verify nobody's in than it is to verify the exact right number of people are out. So the main reason for checking which tickets are used would be for statistical purposes etc, so if there was a short delay till the app could upload (or it didn't happen) that would be no worse than the current scenario of having a cup full of ticket stubs which nobody does anything with!
Absolutely agree on potential for fraud, but maybe there's a way to come up with some pool of images/colours that are triggered by an algorithm when the "ticket" is activated at the in such a way that it would be impossible or very difficult for an attacker to guess ahead of time what the screen would look like for that ticket at the door of that venue...
@Andrew C. Interesting stuff about fire procedures. I've always thought counting tickets was a stupid way of dealing with crowds in a fire situation but every theatre I've worked in has insisted on in.
However, the only certain way to deal with fraud is to check every ticket against a central DB. You say have a pool of images that attackers can't guess ahead of time, but that's not the problem - what if I buy one ticket and let my mates copy it?
On megabus, you book online and are given a long number that drivers are meant to check against a list they have on a clipboard. But they almost never do. I know at least one person who travels on megabus for free by just making up a suitable looking number.
@JamesB - well, people implement all sorts of systems, but there's certainly no regulation requiring it. Many places I've worked, for example, would just send people home immediately in a full evacuation - as they don't have anywhere big enough to get them to stand while they're counted!
I was thinking there might be a way that when the "ticket" is sent to the device it has a combined encryption including being tied to that device (presuming the IMEI or some other ROM type serial number is accessible to an app) so copying tickets from device to device wouldn't work unless you modified the app source to change the decryption routine.
I guess for absolute security you'd still need an external input as a time-based encryption could be spoofed by changing the settings on the clock... hm.
Could be a fun project for a cryptography specialist. Essentially it's a kind of two-factor authentication challenge.
Cryptography will make absolutely no difference at all if all you have is an image on the screen that is shown to a ticket person who just checks it visually. Because my mate can just copy the image on my screen and show the image, bypassing any cryptography you've made my phone do.
Central DB that everything is checked against. Only way to be secure.
And if you have the phone show the ticket based on time, that's another whole list of things that could go wrong; phone clock wrong, show late ...
Andrew C - the boarding passes are QR scanned as they load the plane when there is a big queue of people to get on the plane - I wasn't referring to check-in. If you have ever been behind someone in a fringe show queue who still has their four tickets unseparated in a long chain and waited for the front of house staff to have to separate every ticket and then rip the stubs off, you will know that can take much longer. Half the audience are Edinburgh based, a proportion bought tickets in advance before coming up to Edinburgh, so plenty of opportunity for home-printing. Others can use the self-service kiosks for ticket printing or have the QR code on their mobile.
As for connectivity, if you are going to the cost of setting up this sort of system, buying/hiring QR scanners, then you need to factor in the cost of extending venue wi-fi networks if the coverage is not already good enough. But that is not a large expense, assuming you already have wi-fi or wired network and you are just extending it to cover every venue entrance.
In terms of security, existing tickets are hardly secure. It is not too complicated to copy an existing ticket onto card and cut/perforate to size. Unnumbered seats make it hard to find the duplicated ticket.
But the time-based images etc is all far too complicated and unnecessary.
It may that you wouldn't even need real-time DB look-up. Your scanner app could have a pre-downloaded lost of codes for all sold tickets and it just has to match the QR codes presented and alert if there are any duplicates or non-matches. If you have multiple entrances, you may need some form of connection to avoid duplicates being presented at different entry points.
Fair point on the speed at the boarding gate and the speed of people separating tickets although again I think it's different - most people are there well in advance as instructed, rather than all arriving at once a minute or two beforehand having run from somewhere else which happens fairly often around the festivals.
Lots of venue sites don't already have a wi-fi or wired network in place, and in some (Underbelly for example) the physical structure of the building would make it pretty expensive to install. Also, in many places, operators have annual leases so there's no guarantee that if they invest in physical infrastructure they'll have access to it the next year (though maybe a cross-city strategic approach could help here). And 3G is very difficult - we've had real trouble with mobile card terminals here this year for example which just aren't resilient enough to operate in this kind of environment.
Though you make a fair point that perhaps there could be scanners that are designed to be used offline - maybe with a local wireless network to link terminals at multiple doors. I suppose you could argue that if you could isolate network problems, the hardware's cheap enough to have a few spares in case the actual terminal breaks down.
And in terms of security, you'd be surprised how hard it is to make a copy of a ticket so perfect that venue staff (who see huge numbers of them and quickly get used to them) won't notice. Many have colour printed backgrounds and a separate black printed ticket information - it's fiddly to reproduce that effect without access to a ticket printer. Many venues have slightly different designs from year to year too, so there's a limited window of opportunity. If the staff are ripping tickets, they'll probably notice the feel and weight of the card too.
As with anything digital, there's maybe more of a barrier to knowing how to copy an e-ticket, but once you can you can copy it flawlessley and nobody would ever be able to spot it unless they were cross-referencing it somehow with a master database.
Have you ever seen a ticket printer run out of ink? If you carefully hold most festival tickets over a heat source you can watch them turn black.
Best to try this _after_ the show, although I worked in a box office that received a string of tickets that had somehow ended up in a tumble dryer. You could still make out what they had once been for, so reprints were duly sent out - the originals were pinned to the office wall.
@Andrew C - at Underbelly we already have wifi throughout our venues, public and private networks - have had for many years. There may be a few gaps that would need to be filled if we had to have reliable access at the entrance to every space, but that would be very marginal extra costs/hassle to do that.
19 comments
Then you would only need to print one barcode rather than lots of tickets. And if you buy tickets online it saves having to go collect them as you already have your barcode!
too easy to hack i reckon. though it always seems like a good idea.
Barcode alone might be insecure, but must be some way of having a single ticket instead of separate ones. Needs to be cheap and quick to process at the venue end.
Alternatively a loyalty card with chip it in which records tickets on?
Sometimes depends on what your priority is: ease of sale (do it all electronically) or ease at the venue (quickly tearing tickets).
Would work well if all this can be held on your phone – no need to print anything out – but that could get tricky if you're buying tickets for multiple people, who may not all arrive at the same time.
It's also tricky getting all the kit out to multiple venues, particularly on the Fringe where so many are temporary and a range of different systems are used.
How about this though... you buy the ticket in advance through an app, then when you reach the venue your phone recognises you've arrived (GPS?) which triggers an image on the screen. The front of house staff just need to see the image as you go through and everything is logged automagically.
Along the lines I was thinking - a phone app that acts as a digital wallet and ticket all in one. Could have the option to send any of your tickets from yours to a friend, or send them back to a festival box office for friends to collect printed tickets without the app (eg if you were going to go as a group and bought the tix but then couldn't make it yourself). Could also return a ticket (to venues that accept them) if you got held up at work, for sale to a returns queue for example.
It would need to be designed to cope if the phone was out of signal at the door of the venue, so tickets would be locally stored on the device and GPS might be tricky. Could always use GPS as a first option and either wifi or bluetooth based location or even a fixed barcode that front of house scan with your phone to tell it where it is.
It would be much quicker than traditional barcode systems as customers could all have their "tickets" onscreen in the queue and there'd be no need to wait for a lookup on the database at the door. The app could sync back with the system when it had signal back to update which tickets had ultimately been used and allow venues to keep count of audiences.
Plus, since it depends on customer's own technology it's easier for them (nothing extra to get/keep/lose), very easy for the venues to deploy, and self-limiting at first to more tech-savvy customers which would allow for a gradual introduction without a sudden system support burden.
It's basically just an on-device email client with a bit of anti-fraud security built in...
Hi Andrew, it would be interesting to see if other festivals/events have something similar. The fact that each event in Edinburgh generally needs its own ticket sets it apart from a number of festivals and conferences.
Might be something to discuss with Red61 and other providers when things calm down in September/October.
(One day I'll tell you about the Fringe's 'buy by text and get it delivered by moped' scheme in 2000. Not much take up.)
The staff would still have to check/record every ticket at the door somehow.
1) If they didn't, the potential for fraud is far to high - just showing an image on your phone screen to staff could easily be copied.
2) Venue staff must know how many audience they have for fire regs, at the time of the show. Having the app send back if the ticket was used later won't work, that will be to late. (also, you have no guarantee that the app will actually be able to do that - it might never be run again and so never have the chance).
BBC uses barcodes on their tickets, next to a big warning saying "only one person with this barcode will be admitted" to discourage you from copying it. I took that to mean they would scan them all at the door, but actually they didn't, so you could have copied their tickets :-)
I'm setting up a rival scheme :-)
http://ideas.edinburghfestivals.co.uk/submissions/4261-what-if-we-had-a-really-simple-paperless-ticket-scheme-staff-just-have-a-list-of-names-at-the-door-and-you-show-id-see-1st-comment
Debates between ticketing systems: 'twas ever thus! (I've posted a comment to the paperless thread.)
If you want ideas, look at the airline industry. There you have tickets (boarding passes) with barcodes. These can be issued at a counter (check-in), printed at home, or shown on your mobile via an app where you are logged in to your account. The app stores to ticket so it works off-line.
The airport (venue) scans the barcode on the issued/printed/mobile ticket and confirms validity.
Venues would need to have barcode scanners, but these could be iPod touches with a QR scanner app linked to the venues ticketing database via wifi. There would be hardware and development costs, but these could be offset against reduced need for hardware for self-service printing of tickets and box office staff as tickets could be printed at home or shown on a mobile.
The only difference with the airlines is that you will want to make the tickets transferable (which airline tickets are not) but the self-printed tickets will be transferable as they do not need to be shown with ID.
No reason why you could not have one person who has booked for more than one person have all booked tickets barcodes on one mobile device.
Thomas P - good suggestions but there are challenges. The biggest difference between airline and venues is the temporary nature of the venues (even wifi can be challenging to deploy in some environments esp without access to a suitable uplink connection in place and 3G signal is too unreliable in many areas) but moreso the speed at which the queue need to be processed - seating a venue on a festival style turnaround means that even the couple of seconds it takes to scan a QR and connect back to a database (even with local caching) is too long. An airline can ask you all their security questions, tag your bag etc while the other parts of the process are ongoing. In general where people roll out barcode-based ticketing they add permanent infrastructure and additional door staff to offset the delays, but that would be very challenging for many festival venues.
Also, many visitors don't have easy access to printers during their stay so print-at-home ticketing can be problematic.
James B - in fact, most venues don't need an immediate count of the numbers of people attending. Real-time capacity management is generally done by just making sure that all the audience are in a seat (presuming you have a fully seated venue). In an evacuation in most scenarios counting the stubs isn't a priority - there's too much potential for an overcount (accidentally tore the credit card slip as well as the tickets) or undercount (some stubs got dropped by the usher or not torn).
In common with other public spaces most venues focus on having a procedure for staff to verify each space is clear as they leave the building. For the vast majority of spaces it's faster and more accurate to verify nobody's in than it is to verify the exact right number of people are out. So the main reason for checking which tickets are used would be for statistical purposes etc, so if there was a short delay till the app could upload (or it didn't happen) that would be no worse than the current scenario of having a cup full of ticket stubs which nobody does anything with!
Absolutely agree on potential for fraud, but maybe there's a way to come up with some pool of images/colours that are triggered by an algorithm when the "ticket" is activated at the in such a way that it would be impossible or very difficult for an attacker to guess ahead of time what the screen would look like for that ticket at the door of that venue...
@Andrew C. Interesting stuff about fire procedures. I've always thought counting tickets was a stupid way of dealing with crowds in a fire situation but every theatre I've worked in has insisted on in.
However, the only certain way to deal with fraud is to check every ticket against a central DB. You say have a pool of images that attackers can't guess ahead of time, but that's not the problem - what if I buy one ticket and let my mates copy it?
On megabus, you book online and are given a long number that drivers are meant to check against a list they have on a clipboard. But they almost never do. I know at least one person who travels on megabus for free by just making up a suitable looking number.
@JamesB - well, people implement all sorts of systems, but there's certainly no regulation requiring it. Many places I've worked, for example, would just send people home immediately in a full evacuation - as they don't have anywhere big enough to get them to stand while they're counted!
I was thinking there might be a way that when the "ticket" is sent to the device it has a combined encryption including being tied to that device (presuming the IMEI or some other ROM type serial number is accessible to an app) so copying tickets from device to device wouldn't work unless you modified the app source to change the decryption routine.
I guess for absolute security you'd still need an external input as a time-based encryption could be spoofed by changing the settings on the clock... hm.
Could be a fun project for a cryptography specialist. Essentially it's a kind of two-factor authentication challenge.
Cryptography will make absolutely no difference at all if all you have is an image on the screen that is shown to a ticket person who just checks it visually. Because my mate can just copy the image on my screen and show the image, bypassing any cryptography you've made my phone do.
Central DB that everything is checked against. Only way to be secure.
And if you have the phone show the ticket based on time, that's another whole list of things that could go wrong; phone clock wrong, show late ...
Andrew C - the boarding passes are QR scanned as they load the plane when there is a big queue of people to get on the plane - I wasn't referring to check-in. If you have ever been behind someone in a fringe show queue who still has their four tickets unseparated in a long chain and waited for the front of house staff to have to separate every ticket and then rip the stubs off, you will know that can take much longer. Half the audience are Edinburgh based, a proportion bought tickets in advance before coming up to Edinburgh, so plenty of opportunity for home-printing. Others can use the self-service kiosks for ticket printing or have the QR code on their mobile.
As for connectivity, if you are going to the cost of setting up this sort of system, buying/hiring QR scanners, then you need to factor in the cost of extending venue wi-fi networks if the coverage is not already good enough. But that is not a large expense, assuming you already have wi-fi or wired network and you are just extending it to cover every venue entrance.
In terms of security, existing tickets are hardly secure. It is not too complicated to copy an existing ticket onto card and cut/perforate to size. Unnumbered seats make it hard to find the duplicated ticket.
But the time-based images etc is all far too complicated and unnecessary.
It may that you wouldn't even need real-time DB look-up. Your scanner app could have a pre-downloaded lost of codes for all sold tickets and it just has to match the QR codes presented and alert if there are any duplicates or non-matches. If you have multiple entrances, you may need some form of connection to avoid duplicates being presented at different entry points.
Thomas, sorry been caught up with the day job!
Fair point on the speed at the boarding gate and the speed of people separating tickets although again I think it's different - most people are there well in advance as instructed, rather than all arriving at once a minute or two beforehand having run from somewhere else which happens fairly often around the festivals.
Lots of venue sites don't already have a wi-fi or wired network in place, and in some (Underbelly for example) the physical structure of the building would make it pretty expensive to install. Also, in many places, operators have annual leases so there's no guarantee that if they invest in physical infrastructure they'll have access to it the next year (though maybe a cross-city strategic approach could help here). And 3G is very difficult - we've had real trouble with mobile card terminals here this year for example which just aren't resilient enough to operate in this kind of environment.
Though you make a fair point that perhaps there could be scanners that are designed to be used offline - maybe with a local wireless network to link terminals at multiple doors. I suppose you could argue that if you could isolate network problems, the hardware's cheap enough to have a few spares in case the actual terminal breaks down.
And in terms of security, you'd be surprised how hard it is to make a copy of a ticket so perfect that venue staff (who see huge numbers of them and quickly get used to them) won't notice. Many have colour printed backgrounds and a separate black printed ticket information - it's fiddly to reproduce that effect without access to a ticket printer. Many venues have slightly different designs from year to year too, so there's a limited window of opportunity. If the staff are ripping tickets, they'll probably notice the feel and weight of the card too.
As with anything digital, there's maybe more of a barrier to knowing how to copy an e-ticket, but once you can you can copy it flawlessley and nobody would ever be able to spot it unless they were cross-referencing it somehow with a master database.
Have you ever seen a ticket printer run out of ink? If you carefully hold most festival tickets over a heat source you can watch them turn black.
Best to try this _after_ the show, although I worked in a box office that received a string of tickets that had somehow ended up in a tumble dryer. You could still make out what they had once been for, so reprints were duly sent out - the originals were pinned to the office wall.
@Andrew C - at Underbelly we already have wifi throughout our venues, public and private networks - have had for many years. There may be a few gaps that would need to be filled if we had to have reliable access at the entrance to every space, but that would be very marginal extra costs/hassle to do that.
1 – 19 of 19
Comments are closed.