[TobyTheDog123]

This reminds me of the time when I was a college student in Massachusetts and would always try to reverse-engineer the Massachusetts Bay Transportation Authority tickets, powered by JustRide (oh! Just noticed it's the same company as in the article)

Unfortunately, my skills weren't quite there at that point in my life, and I no longer live in Massachusetts, but this was an incredible read regardless and I feel at least a bit of closure now :)

The MBTA tickets had an option of color bars (so the conductors could just visually check if all of them match throughout all the passengers) and a QR option, so I would always try to figure out how it generates those colors, as the tickets had to be able to function offline, and as the tickets all showed the same colors regardless of passenger, they certainly weren't unique per-purchase nor used any user-unique info (though they may have been unique per-train-route).

I should take another look at it with this article as a resource.

[jasonjayr]

I think the tickets had to be activated 'online', and iirc they are good for 60 minutes.

Additionally the color bar screen has an animated timestamp too, presumably to prevent a (basic) screenshot attack.

And; although I've never had it scanned, I think if the ticket checker suspects something is up, they scan the qrcode for an online verification.

I took a large family group with me on one ride, and they did consistently check that I activated the right number of tickets.