Why do my tickets have QR codes on them?

[cf111]

Never seen this or the asteriskes before and after the passenger numbers before, they're on "old" stock as well, which is weirder.

I've not tried to scan them with an app or anything, but does anyone know what information they might contain?

 

[Captain Chaos]

I don't know. They seem to be becoming more and more common, yet nobody has actually explained nor knows what they are there for!

 

[Rich McLean]

Never seen this or the asteriskes before and after the passenger numbers before, they're on "old" stock as well, which is weirder.

I've not tried to scan them with an app or anything, but does anyone know what information they might contain?

That's new.

I'd assume it's to prevent fraud

 

[Lockwood]

I'm sure I've seen ticket barriers with 2d readers on them (for e-tickets perhaps). Maybe it's to let you scan a ticket as well as insert them

Also, those aren't QR codes. I think that they are Aztec.

 

[poshfan]

The asterisks are obviously to make it more difficult to alter the number by adding another digit before or after. I have got quite a few old used tickets laying about, can't see any that don't have the asterisks around the numbers.

 

[cf111]

The asterisks are obviously to make it more difficult to alter the number by adding another digit before or after.

Yeah I assumed that, the same as with the asterisk after "Inverness".

 

[WillPS]

Staff have readers which can quickly validate tickets - I thought they were just for E-Tickets though.

I presume they can also prevent Anytime or Off-Peak Return tickets being used multiple times.

 

[Goatboy]

Hundred quid from Glasgow to Inverness and back in what passes as 'First' in a Scotrail DMU

:eek:

 

[cf111]

Hundred quid from Glasgow to Inverness and back in what passes as 'First' in a Scotrail DMU

:eek:

It's an expensive cup of tea but I'm not paying .

 

[Tiny Tim]

I've had a couple of tickets with QR (or similar) codes on, I can't remember where. All the tickets I'm presently using as bookmarks don't have them. How odd. I'm sure someone can explain.

 

[swt_passenger]

... they're on "old" stock as well, which is weirder.

I don't really see how the blank stock used makes any difference whatsoever. The lengthy thread about the change to the blanks was a bit of a diversion, everything in black is printed in the same places it always was...

 

[jon0844]

They're Aztec codes and because these were very clear, I was able to scan both of them. Something I couldn't when the last one was posted a month or two ago.

And I can confirm it's a sequence of characters that means it's obviously encrypted data - and totally useless to anyone that can't decode it and turn it into something useful.

This is the data:

 

[Trog]

Yeah I assumed that, the same as with the asterisk after "Inverness".

That's not an asterisk, it's a snow flake.

 

[b0b]

I cant believe they've managed to squeeze even more stuff on a ticket

 

[causton]

Presumably the same as the Aztec codes on print at home tickets, for the guard to scan to confirm validity (because, you know, reading them doesn't )

 

[Hyphen]

And I can confirm it's a sequence of characters that means it's obviously encrypted data - and totally useless to anyone that can't decode it and turn it into something useful.

Correct. From what I can glean from publicly available documents, the internal ATOC standard for the barcode is RSPS3001. It seems this standard sets out the general requirements for barcoding and the security layers it uses - and it seems it's using public/private key encryption, much like HTTPS does.

From what I gather, each TOC will have a private key with which it will generate and cryptographically sign unique barcodes for the tickets it sells, even for journeys not made on its services. Doing this will show that a TOC did genuinely create the ticket, and which one. The scanners will contain copies of all TOCs' public keys to decrypt the barcodes, so there's no 'online' requirement for establishing trust with the ticket.

If ATOC decide to do it properly the scanners should go online regularly to check for revocation information, so even if a TOC's private key (for encrypting the data) ends up in the wrong hands, the devices will be able to automatically reject any tickets signed with the bad key. How that would work with Advance tickets signed with an old key, printed before the key was changed, would be a challenge, but I hope they don't choose to overlook this important requirement of ensuring trust. If they don't, it would mean once a TOC's private key is leaked (or hacked), they would have no real method of stopping the holder of that key creating tickets that the system would inherently trust.

The barcode doesn't seem to store a massive amount of data, it's unlikely to be more than what's on the magstrip. At a guess (without knowing what's on the magstrip!) I'd say start/end points, ticket type, validity date(s), a serial number and a checksum.


EDIT: Sources:
[1] Marketing slideshow from Masabi, the company contracted by ATOC to work on its barcoding technology
http://www.slideshare.net/masabi/selfservice-eticketing-on-selfprint-and-mobile-given-at-travel2020 (slides 18-19)
[2] List of ATOC standards, found via Google
http://www.atoc.org/clientfiles/fil...Standards Web Pages Index 20120207 v02-00.pdf (page 2)
[3] I am an IT Systems Administrator and it's my job to understand how complex systems like this work

 

[jon0844]

Masabi? That name rings a bell. I think they came to our offices a few years back talking about mobile ticketing, when I was at What Mobile.

 

[Eagle]

Correct. From what I can glean from publicly available documents, the internal ATOC standard for the barcode is RSPS3001. It seems this standard sets out the general requirements for barcoding and the security layers it uses - and it seems it's using public/private key encryption, much like HTTPS does.

Actually technically it's reverse public-key encryption, which isn't really an encryption technique as much as it is an identity verification.

With public-key cryptography, anyone can encrypt a message but only one person can decrypt it.
With reverse public-key cryptography, only one person can encrypt a message but everyone can decrypt it—however you know for sure that it must have been written by that one person.

 

[thelongestroad]

Did you buy the tickets from East Coast? A memo went about saying all tickets sold by East Coast Websales would now have those QR codes.

 

[cf111]

Did you buy the tickets from East Coast? A memo went about saying all tickets sold by East Coast Websales would now have those QR codes.

I did indeed.

Thank you all for your informative posts, very interesting.

 

[DaveNewcastle]

Did you buy the tickets from East Coast? A memo went about saying all tickets sold by East Coast Websales would now have those QR codes.

Yes, tickets I have received by post from EastCoast central ticketing since 5th October have featured those codes. They only appear on the ticket portion, not the reservation coupons.

Unhelpfully for those checking tickets using the paired eyball method, the discount code which has been printed in the top left in double width bold print under the class of travel, is now in standard sized print just to the right of centre.

 

[CyrusWuff]

Unhelpfully for those checking tickets using the paired eyball method, the discount code which has been printed in the top left in double width bold print under the class of travel, is now in standard sized print just to the right of centre.

Also unhelpfully for those checking tickets, the standards have been moved from their previous location so you can't "self brief" on updates to layouts and the like...

 

[Tetchytyke]

Did you buy the tickets from East Coast? A memo went about saying all tickets sold by East Coast Websales would now have those QR codes.

Only those posted out, though. My most recent advance tickets had them, but the tickets I've collected from a TVM for Christmas do not.

 

[jon0844]

I guess TVM software will need updating. I wonder if the code is sent to them (and ignored)?

 

[wyvfe1]

At Kings Cross the ticket barriers (Next to platform 8) have barcode type scanners. They look the same as the airport boarding pass scanners.

 

[jon0844]

I wonder if they are though? They do look the same.

I say this because some scanners can read a barcode on paper, but not a phone display.

I'm in Starbucks at the moment and their scanners also look like the ones on a gate at King's Cross, and people are presenting codes on their iPhones etc without problem.

I do think that if/when people start trying to show their iPhone/iPad screens to the readers on the gatelines, it's going to seriously annoy people who are already used to people tapping in/out with a smartcard and therefore find paper tickets too slow!!

I haven't been over to Eurostar for ages, but they also had barcode readers (or did when St Pancras opened in 2007). Are they used much?

 

[island]

I haven't been over to Eurostar for ages, but they also had barcode readers (or did when St Pancras opened in 2007). Are they used much?

Yes, almost exclusively. Print at home tickets use 2D barcodes and as far as I know the ATB tickets have them too.

 

[wyvfe1]

a photo of the gateline and readers here http://cdn.londonreconnections.com/assets/gateline.jpg

 

[island]

Yes those are primarily for print at home tickets, although there is every chance they work with these new ones too.

 

[dysonsphere]

which companys do print at home tickets (sorry for thread drift)