Slashdot Mirror
Scalpers Earned $25M Gaming Online Ticket Sellers
SeattleGameboy writes "An indictment has been issued for online ticket brokers known as 'Wiseguy Tickets and Seats of San Francisco.' From 2002 to 2009, they used bots, server farms, and CAPTCHA hacking to buy vast number of premium tickets (Springsteen, Miley Cyrus, NFL, MLB playoffs, etc.) and made $25 million in profits. 'They wrote a script that impersonated users trying to access Facebook, and downloaded hundreds of thousands of possible CAPTCHA challenges from reCAPTCHA. They identified the file ID of each CAPTCHA challenge and created a database of CAPTCHA "answers" to correspond to each ID. The bot would then identify the file ID of a challenge at Ticketmaster and feed back the corresponding answer. The bot also mimicked human behavior by occasionally making mistakes in typing the answer, the authorities said.' I guess you can break any system like CAPTCHA if you want it badly enough."
In his Glitter and Doom tour, Tom Waits pioneered an effective anti scalpers scheme.
Tickets for Waits' summer shows were limited to two per person but, in an effort to beat ticket touts, a valid I.D. (passport or driving licence) matching the name on the ticket was required to gain entry. Any concert-goer who did not have a valid I.D. or was found to be in possession of a ticket that had been resold – electronic scanners were employed – was not allowed in and did not get a refund.
From http://en.wikipedia.org/wiki/Glitter_and_Doom_Tour#Tickets
why user agent knows all info required to identify captcha and why this identification info is unique. Somebody designed weak captcha system and it was broken. End of story.
How about a dutch auction?
Start the price offensively high, and drop it as the concert date approaches. The organiser gets paid the price the market will bear, the scalpers are out of the loop - because by definition, anyone willing to pay a stupid price for a guaranteed ticket will already have paid it.
You still get the same effective problem - that rich fans are prioritised over poor fans, but more money goes to the artist and the organiser, so they could throw a few benefit concerts or something to sweeten the deal.
that Stubhub is owned by Ticketmaster? I can't believe this. The last two times I tried to get into concerts at the Rochester Auditorium Theater and the War Memorial (Blue Cross Arena), it was difficult. Somehow all the good seats vanished almost immediately. But no, there are seats that magically appear on Stubhub. All you have to do is pay $300 for a $75 seat. Infuriated, I refused (obviously, I've been out of the loop for a while). So for one concert I bought tickets from someone on eBay (double the face value!) and for the other I just got cheap tickets in a poor location. Apparently this kind of poor service has no effect since the venues are sold out anyway. This makes me not want to go to events like this and just buy the DVD! Maybe you have to be a teenager to put up with this BS. I still have the antiquated belief that ticket resellers should not make more money than the artists or promoters. You don't see Wallstreet brokers doing this. Oh, wait...
Sorry, but gray text on gray background is making my eyes bleed.
Actually, the Miley Cyrus tour did implement ID-verification, and it didn't work.
Instead of requiring picture ID, the Miley Cyrus tour required the presentation of the credit card used to purchase the tickets.
(For an audience with average age well under the 18 required to have a credit card in the US, this had some negative customer service implications.)
The brokers responded by getting credit card companies to issue them one-time-use credit cards. They used these cards to purchase the tickets and mailed the patrons the credit card with their tickets.
Brokers are clever process hackers and I have yet to encounter an anti-broker scheme that actually works.
Perfectly, if people are willing to pay $5/bag for it. If they're not, then the guy will have 19 useless bags of flour. What will most likely happen is someone else will come in and offer cheaper flour, it's the nature of the market since such a high price will create a deadweight loss. Free market at work.
At the end of the day, isn't that what the supermarket does anyways? They buy flour for $x and then they resell it for $x+$y. What keeps them in check? Competition from other supermarkets.
In the old days, ticket wholesalers would hire hobos to stand in physical line. In the Internet era, is it now necessary for ticket wholesalers to not only put a hobo in front of a computer, but to apply for a credit card for the hobo as well? And this is because Slashdot readers now all of a sudden support click-through EULA's on websites? The crux of the indictment is that Wiseguys defeated Ticketmaster's et al human identification by defeating Captchas and using purchased varied IP addresses.
The ticket windows (Ticketmaster et al) are trying to engage in price control, which never works. Ticket windows had limited success in outlawing ticket brokers. Now in the Internet era it seems ticket windows have discovered a legal avenue to harass the ticket brokers by calling automated Captcha completion "hacking".
Wiseguys never engaged in malware or theft. They merely sought to purchase what the ticket windows had for sale in response to the market distortions -- in the form of price controls -- the ticket windows had set up.
If you leave the door open, then you are stupid for letting in the flies, if you leave the screendoor closed but the main door open, you are stupid in thinking it will be enough to stop a robber, and if you only use a metal plated door, you are stupid in thinking it will stop the terminator. CAPTCHAs have never really worked, even to the new image and text combo ones, i saw that came close once, but it was based on a few QA style system, so not 1 or 2 but 3 or 4 questions about the person just like when you call a phone bank service.
Anyways, the best way to really get security is with the secureid system, i have used and see its enormous advantage, the ID switches every so often, so even if you know the main password, you need the id to add the last part to concatenate to the rest. However, how many people log unto a website are able to have a system like that that can be verified other then companies giving their employees these. In this situation, I would say, make ticket sales phone based only. If this is something that is time sensitive and that in order to avoid one guy getting all the tickets based on a software that runs, then make it phone based only.
If you have a website ECommerce site, and it is used to sell products, the person logging to buy up all your products only makes you more money, but tickets is not in the same league as let's say buying a laptop or iphone off the internet. People are not too lazy that calling by phone will get them a secured ticket, but then again it would fall on ticketmaster to handle to cost of the phone lines...
which is something they want to avoid, unless they invest almost the same amount in R&D for a better system then what they got...either way, I guess I wont be going to see Metallica anytime soon.
Well, if the supermarket doesn't just buy up "a whole bunch of coffee" but is basically waiting at the pier when the ship loaded with coffee arrives and buys all of it although they only needed 0.1% of it for themselves then it is dishonest and they're clearly trying to exploit others.
What are you talking about? Their job is to sell stuff. If they can sell 100% of it, then they need 100% of it.
Also, this is a classic case of where "voting with your money" just doesn't work because the profit margins and the demand are both so high that even if you could get say, 80% of the prospective customers to agree not to buy from scalpers you'd still be looking at them selling a boatload of tickets
That is people voting with their money. If they are stupid enough to value the tickets to a live concert so highly, then that in fact shows the "real" value of the tickets to the fans.
which is totally what she said
You missed the point. The scalper did you a service by even giving you the chance to see the concert. If there were no scalpers and every ticket sold was legit then there would be no tickets on ebay and your action of missing the ticket sale means you have zero options to attend.
Would you prefer that the concert simply have been priced at the scalpers prices from the get go? At least that way there might be some tickets left when you finally got around to checking the box office.
>> understand the illegality yet?
No.
>> , and so some people like you can't appreciate their evil up front.
Good thing we have you around to protect us from ourselves!
This is mickey mouse Econ 101 stuff. The only way your scenario ends in 'people starve' is if there is only one supplier of flour (i.e. flour is controlled by a monopoly). Even libertarians (many of us, anyway) agree that monopolies have to be treated a little differently, at least in cases where the nebulous 'public good' is involved -- typically infrastructure or telecom where you have private companies gaining access to both public and private land and need some oversight.
This is certainly not the case with your flour example, though let's give you a pass on the analogy since someone else can make more-or-less identical flour, which is tough to do with a Springsteen concert.
There are a variety of methods for ticket sellers to combat scalping, and a variety of reasons (which vary by state and country) which often restrict a vendor from selling the same product at two different prices based on the buyer. For example, ticketmaster can charge me $100 for an orchestra seat and $60 for a balcony seat, but (AFIAK) they can't charge me $100 for an orchestra seat but then make my buddy pay $140 for another orchestra seat at the same time; they can raise all their prices or have 'early bird discounts' but those things affect all transactions. They can only sub-divide on a limited scale, e.g. 'American express discount' or other things which apply to fairly large groups but not individuals. So you have a certain degree of rigidity that is being forced on the market, since there are clearly some people who would pay $200 for an orchestra seat, but pricing all their orchestra seats at $200 would never fly -- so they sell them to scalpers who can turn around and sell them at whatever price they want through a variety of outlets. Those prices can change every day (we'd never put up with Ticketmaster doing that) because there are effectively multiple small markets as opposed to a single larger one.
As for whether or not all this should be legal, the practical reality is that it's very tough to eradicate when you have a static, tiered market that actually wants to behave like a funnel. You'd pretty much have to mandate that tickets be linked to the actual person attending at the time of purchase, which means no resales, no gifts, no last-minute 'oh crap i can't go who wants to buy my ticket?' A simple, free-market solution would be to give somebody a 'lock-in' ticket price in which they could voluntarily tie the ticket to themselves (non-transferable) and get a lower price - that would cut into the scalping market quite a lot. I'd guess that it isn't legal to do as the ability to re-sell something that you've bought is usually quite well protected, but that's a question for the law and not a free market criticism.
You missed the point. The scalper did you a service by even giving you the chance to see the concert. If there were no scalpers and every ticket sold was legit then there would be no tickets on ebay and your action of missing the ticket sale means you have zero options to attend.
Logical fallacy present. You're assuming tickets would have sold at the same rate whether scalpers were present or not. This is pretty laughable (appeal to ridicule *points and laughs* ). If there wasn't monetary interests being indulged, you'd have much slower movement of tickets by people with legitimate interests involved. This is patently obvious simply because there's fewer people involved. Scalpers create *artificial* demand. They are the antithesis of free market. After all, they don't care if they sell ALL their tickets, just that they make a profit, so the more they buy, the higher they can set *their* per ticket price, and the fewer overall they'd have to sell. Scalpers don't provide a service, they break the system.
Canada: The US's more awesome sibling.
What I want to know is, why was a few hundred thousand reCAPTCHA challenges enough to have a reasonable chance of getting a duplicate? Shouldn't the number of possible challenges be several orders of magnitude higher to discourage this kind of attack?
The problem is that the CAPTCHA approach is flawed. Any similar type of challenge-response system can be abused for illegal activity.
I met a guy who was a pilot in Vietnam. They had (and still have) a system where everyone carries a card with a grid of numbers and letters on it, and you can authenticate someone over the radio by picking a couple spots on the grid and they respond with, for example, the character adjacent to them. Well, he forgot his card one day and was queried by a controlling agency using the authentication card. He told them to stand by, switched frequencies, and issued the same challenge to another agency. They responded, and he switched back and passed it along to successfully authenticate himself.
Evil is the money of root.