Database - Abuse Prevention - Multi-use/Re-entrance

[samwukong]

Issue

The Internet-facing database for validating QR tickets should be able to distinguish once a QR code has been scanned at an event to prevent reuse abuse.

User Story

I go the event ticketing website and download my QR code. I have a friend who wants to go to the event and so I send them a copy of the QR code.

Discussion

This one is a tricky issue, IMO.

On the one hand it might be simple enough to say that the QR is a one-time use.

However, this probably wouldn't really work well, since there are a lot of events that have a reentry practice.

• At a movie theater I can come and go just showing my ticket.
• At a theme park I can leave the park and then return later showing the same ticket.
• At a conference I might leave and return.
• etc...

So, what mechanism can ensure that a QR code is reasonably only permitting one entry at a time, while respecting and permitting re-entrance policies?

I suppose that this one might need a little more of a process mapping done to imagine where controls could be implemented.
I'll also spend a little time thinking about this, if desired.

[Crypto2099]

This is certainly a tricky one to figure out. The way we are handling it for cNFTcon is that the QR ticket is in turn exchanged for an IRL item (i.e a badge or wristband) that then provides access to the event or certain areas depending upon the admission type. In this way, we only need the QR code to be used once. I do not readily see a way to do re-admission w/o a database replay attack vector but we can certainly spend some more time thinking about it.

[latheesan-k]

We could add an event level configuration "Ticket Valid For" and have a sensible default like 5 minutes (in case ticket got scanned twice or more in short span of time).

This way, when someone uses a ticket older than "Valid For" period, the ticket can be flagged as invalid.

[samwukong]

I suppose that this could be another method to control for this. Certainly there are events that do this already, so it's not out of the realm of feasibility. It would be on the individual event to determine what degree of assurance they want that a QR is only used once. This makes sense.

The way we are handling it for cNFTcon is that the QR ticket is in turn exchanged for an IRL item (i.e a badge or
wristband) that then provides access to the event or certain areas depending upon the admission type.

Another useful way to control for this. This could be defeated easily enough if the time chosen is constant (for all events) or known for a specific event. But sometimes just a little added difficulty (designed chaos until the timing is determined) is enough to deter lower level offenders.

We could add an event level configuration "Ticket Valid For" and have a sensible default like 5 minutes (in case ticket
got scanned twice or more in short span of time).

I'm not exactly sure how a high a priority this latter control would be to implement as an option. Probably determining complexity of the solution vs competing features would help triage it. It would seem easier to have mention of the possibility of re-entrance abuse in when an event owner goes to create an event.