]> 2026-05-06T01:34:27+00:00 KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“ 0 de Q Misell steckt hinter zügli.app, das schon vielen insb. Studierenden geholfen hat, ihre Semestertickets aus den grausamen Apps der Verkehrsverbünde zu befreien. Auf der parallel zur KIF-KoMa/KoMa-KIF stattfindenden GPN gibt es diesen Talk, der live übertragen wird. --- Digital tickets from traffic associations are often stuck inside their proprietary walled garden apps. But the neat thing about digital tickets, is that the barcode can be shown anywhere, and still be valid. This talk documents my efforts to reverse engineer various traffic association's apps, and my work on Zügli to make tickets without tracking available to all. Semestertickets are great - travel throughout Germany included in your University fees. Unfortunately, many Universities have partnered with traffic associations that require you to use their app to access your ticket. These apps are full of tracking, advertising, and don't always have the best security practices. Not to mention that they only work inside Google or Apple's proprietary walled gardens - there's no way to get these apps to work on Huawei phones, or without handing over your data to Google through their Play Services. The neat thing about digital tickets though, is that it doesn't matter how it's displayed. As long as the ticket controller can read the barcode on your ticket, you have a valid ticket. A ticket on a piece of paper would be equally valid, and secure - however these are forbidden for political reasons. Therefore, the ticket must be shown on a digital device of some kind, but it need not be the app of the company or association that issued it. There exist many free, open source, and privacy respecting apps that support displaying the de facto industry standard PKPass files for digital tickets. One merely has to get their ticket into such a format. The apps of the respective traffic associations, by their nature, must download the ticket to the device somehow. So, what's to stop us from doing the same, only outwith the app? Absolutely nothing! This talk documents the process of reverse engineering several traffic associations' apps, how some of them try to frustrate this, how some of them make careless security mistakes, and how you can free your transport tickets from proprietary apps with Zügli. Q is a researcher at the Max-Planck Institut für Informatik in Saarbrücken, focusing its work on Internet architecture and security. In its spare time, it runs Glauca Digital, a domain registrar and web host. It's also a massive train nerd. AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“ Austausch Input Spaß 16 1297 1.5 [https://chaos.social/@jm_rtr Marvin] (HTW Saar) KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“ 2025-06-19T05:14:34Z 2460845.7184491 KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“ 0 0 plainlist 1 [[:KoMa 92/AK GPN]] KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“# QUERY10ae797aabdb21a400b022c4e89fc7bb 0 0 plainlist 1 [[:KoMa 92/AK GPN/Semestertickets ohne Überwachung]] KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“# QUERYc0c8571d3caa5a01a91126fb39483358 0 0 plainlist 0 KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“# QUERYd3ba4bf168b886ae0d85c843614fc6cd 0 1 plainlist 2 [[Kategorie:Arbeitskreis Session]] [[KoMaNr::+]] KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“# QUERYabe942fde86ffbf8197b63e6ce91c977 0 0 plainlist 1 [[:KoMa 77/AK Abschlussarbeiten<span class="smw-highlighter" data-type="4" data-state="inline" data-title="Warnung" title="Das Stichwort hat die maximale Länge von 85 Zeichen überschritten. Ein Vorkommen von „“ in der Abfrage wurde nicht durch ein entsprechendes „“ abgeschlossen."><span class="smwtticon warning"></span><span class="smwttcontent"><ul><li>Das Stichwort hat die maximale Länge von 85 Zeichen überschritten.</li> <!--br--><li>Ein Vorkommen von „]] KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“# QUERYd54731d480808b726826ddb9ed87a7ef 0 [2,"smw_noclosingbrackets"] KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“# ERR1dd423a8697e32d6813ecd1a7aae482c 0 [2,"smw_misplacedsymbol","[["] KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“# ERR4d654bd0fc980a6b0597358ed2064db6 0 [2,"smw_unexpectedpart","\u201c abgeschlossen."] KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“# ERR11dd5acbd9063b4ff1f6be307c9ea611 0 [2,"smw_unexpectedpart","]]"] KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“# ERR12ba355d2c4533b701f6ee58f2eb66da 0 [2,"smw-query-condition-empty"] KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“# ERR1858fcd9ee1dd18869514c1e9169de76 0 [2,"smw-datavalue-keyword-maximum-length","85"] KoMa 92/AK GPN/AK Bahn Spezial: GPN-Public-Viewing „Semestertickets ohne Überwachung - how I reverse engineered your public transport app“# ERR2b8d058161b451ff98d6261ebbe746f6