Semestertickets ohne Überwachung (gpn23)

Digital tickets from traffic associations are often stuck inside their proprietary walled garden apps. But the neat thing about digital tickets, is that the barcode can be shown anywhere, and still be valid. This talk documents my efforts to reverse engineer various traffic association's apps, and my work on [Zügli](https://zügli.app) to make tickets without tracking available to all. Semestertickets are great - travel throughout Germany included in your University fees. Unfortunately, many Universities have partnered with traffic associations that require you to use their app to access your ticket. These apps are full of tracking, advertising, and don't always have the best security practices. Not to mention that they only work inside Google or Apple's proprietary walled gardens - there's no way to get these apps to work on Huawei phones, or without handing over your data to Google through their Play Services. The neat thing about digital tickets though, is that it doesn't matter how it's displayed. As long as the ticket controller can read the barcode on your ticket, you have a valid ticket. A ticket on a piece of paper would be equally valid, and secure - however these are forbidden for political reasons. Therefore, the ticket must be shown on a digital device of some kind, but it need not be the app of the company or association that issued it. There exist many free, open source, and privacy respecting apps that support displaying the de facto industry standard PKPass files for digital tickets. One merely has to get their ticket into such a format. The apps of the respective traffic associations, by their nature, must download the ticket to the device somehow. So, what's to stop us from doing the same, only outwith the app? Absolutely nothing! This talk documents the process of reverse engineering several traffic associations' apps, how some of them try to frustrate this, how some of them make careless security mistakes, and how you can free your transport tickets from proprietary apps with [Zügli](https://zügli.app). Licensed to the public under https://creativecommons.org/licenses/by/4.0/ about this event: https://cfp.gulas.ch/gpn23/talk/PDX8ZZ/