I accidentally became PureGym’s unofficial Apple Wallet developer

https://drobinin.com/posts/how-i-accidentally-became-puregyms-unofficial-apple-wallet-developer/

by valzevul • 11 months ago

649 176 11 months ago

drobinin.com

sb8244• 11 months ago

"if we build that feature, we'd have to own it."

"You're right, keep it on the 2028 roadmap"

That would be my experience in tech at least.

subscribed• 11 months ago

I mean, the experience from my department meetings where we discuss the roadmap and plans.

"Does it earns us money? Because doing it does _cost_ us"

It's really that simple (and the to do/wishlist is actually long).

The best thing PureGym could do now? Pay the guy couple of grands for the app AND give him lifetime membership.

frankus• 11 months ago

"and very good reasons for not implementing Apple Wallet"

Judging by the screenshots, it looks like a thin wrapper around a mobile-optimized web site, or at best something like Flutter, so the likelihood that they have in-house developers that are sufficiently versed in the dustier corners of Apple's APIs is slim.

pastorhudson• 11 months ago

Ya and if they add apple wallet they have to do android wallet and then that’s more code to maintain. But they could make the in house app always show the QR code on launch.

cedws3• 11 months ago

So why can’t they learn? We have Google, we have Stack Overflow, we have LLMs. My cynical take is that there’s just nobody there who gives a shit about the UX, most likely the team that built all of their backend stuff is long gone (quit or laid off) and now there’s a skeleton team of the cheapest possible engineers just keeping it running.

extraisland3• 11 months ago

It is a gym app. Realistically as the article says it really doesn't have to change much.

The UX of that app is actually "ok". While it is a wrapper around their mobile site it works well enough.

sammy2255• 11 months ago

They are likely using cheap labour from India or something.. the deal went to the lowest bidder.

troupo2• 11 months ago

So why can’t they learn?

Who "they"? The vast majority of companies don't have a staff of programmers. These apps are outsourced to cheap consultancies.

withinboredom2• 11 months ago

I used to work in the fitness industry, and we built apps for some big players (not PureGym, though they were a customer for other parts of our stuff). Anyway, we'd often sit in meetings with them to discuss new features. One time, we discussed adding notifications. They got hung up on this -- there were about 8 different departments -- and they decided to add a notification to ask how clean the gym was... because it was "safe". These people, in general, are terrified of scaring away members by bothering them about anything.

But yeah, we cared deeply about the UX/UI, but these things are built by committee and the committee is pretty dumb, very political, and non-technical.

spcebar• 11 months ago

Having engineers specialized in a specific stack learn on the job for the sake of/while working on a project is a great way to end up with really funky code and poor user experiences. I speak as a developer tasked with doing exactly that several times at a previous job, and the long-term is never pretty. The first code you write is immediately legacy code, but if you're learning as you write for a project that is already in motion, you're usually stuck with that legacy code until someone goes out of business or the rapture comes and they have to do a reorg because half the team was hauled to the kingdom of heaven, and now there's an MBA running the department who doesn't like you and wants to leverage AI to do the block chain.

extraisland3• 11 months ago

I have the app on my phone (I just used to use the pin key pad). It looks like a wrapper around their website.

toyg• 11 months ago

This is it. It's a well-established gym chain, their core business is getting subscriptions and making it hard to unsubscribe - not development. If you're lucky, they have a couple of in-house web developers working on website and database maintenance, who then ask a contractor to just "make it run like an app". If you're unlucky, they outsource all their web operations to a contractor that milks them every time they want to change a title from H2 to H3.

aembleton2• 11 months ago

How could Puregym make it easier to unsubscribe? I'm sure I managed to do it in the app just a few months ago.

bapak3• 11 months ago

Isn't that the whole problem?

The core business of automobile companies is not software, but they're being kicked down by software companies.

You're not a software company until a software company shuts you down.

poisonwomb• 11 months ago

I’ve always used the physical PIN code to get in because I just instinctively don’t trust the app to load reliably; never felt so validated

DaiPlusPlus2• 11 months ago

I've never been to a PureGym; if you guys use a PIN-pad to enter does that mean they're like those unattended 24/7 gyms?

...or if they do have an attendant there, why can't they let you in with a friendly greeting like they used to in some imagined past?

chilmers• 11 months ago

They're 24/7. There are usually some staff onsite during the day, but all the entry/exit stuff is always through the automated gates.

grishka2• 11 months ago

Both the PIN and the app feel like terrible ideas. The gym I go to uses NFC wristbands, for the turnstiles but also for the lockers.

rafram2• 11 months ago

That’s also really bad. Who wants to carry a wristband around everywhere? Keychain barcode tag works fine.

account-52• 11 months ago

You can actually do this, as a fob, but you have to buy one from a vending machine in the gym. Remembering the pin is easier.

wrs3• 11 months ago

Did I interpret correctly that this sends a push notification every minute telling your phone to download a new code? If so, that seems like a battery problem…

dom96• 11 months ago

The article mentions they need to be refreshed every week, so I'd guess at most once a week.

wrs3• 11 months ago

The RefreshAt is a week, but if the code is actually valid for a week, it's not clear why a simple screenshot of the code didn't work.

ItsHarper• 11 months ago

I think ideally you'd do it maybe every day or so, so that if the user goes offline for a while, or the server you're running goes down or something, the pass will continue to work for at least 6 days. It buys you a lot of time to fix things.

withzombies• 11 months ago

You can send background push notifications which are delivered when the phone is ready for them. They don't deliver when the phone is low battery or in low battery mode. It's specifically made to reduce battery consumption.

Higher priority push notifications require a user visible UI element and ca be delivered regardless of certain low power situations.

wrs3• 11 months ago

It sounds like this only helps power consumption after you've already run low on power. Seems like processing frequent notifications would accelerate your progress toward that low power state.

refulgentis• 11 months ago

Higher priority push notifications require a user visible UI element

The QR code for a pass sure sounds like a priority user visible UI element.

x0x0• 11 months ago

on security theater: the morons running my garbage company demand not just a email + pass but also security questions in order to login and... pay your bill. That's the functionality available.

Example security question: favorite book. Which is, naturally, case sensitive.

Someone wrote this to prevent people from stealing my password and paying my bill.

jerlam• 11 months ago

In the past, every company thought they were the next Facebook and needed to build complex super-scalable architecture because tomorrow a million users would appear out of nowhere and try to log in at the same time.

Now everyone thinks they are the next Experian and tomorrow a million hackers are going to attack and steal everyone's private info.

DaiPlusPlus2• 11 months ago

Now everyone thinks they are the next Experian and tomorrow a million hackers are going to attack and steal everyone's private info.

But this is demonstrably the case today... I don't think I've gone a week without hearing about some major data-breach.

...my own org got h4x0red a few months ago: our CEO didn't have 2FA enabled on his God-tier global-admin-rights OIDC/SSO login and somehow, someone found our internal login page, had a snoop around, found our Twilio account keys and sold them off to some spammer who then sent spam texts to our customers (fortunately our (immutable) access logs showed there was no further intrusion, but it was still an incredibly unsettling experience considering how uninteresting and un-sexy my SaaS day-job is).

...so if it can happen to me, a random fellow HN troglodyte, then it can happen to you; or the hospital down the street from my old office[1].

In conclusion: we're doomed.

[1] https://therecord.media/seattle-fred-hutch-cancer-center-ran...

throw10920• 11 months ago

...and, of course, all of these companies are just as bad at security as they are at scaling - they don't even have the capacity to understand (organizationally - I'm not anthropomorphizing them) that Experian happened because their servers were breached, not because users' accounts got stolen.

It's pathetic. There should be regulation that prevents overly onerous "security" controls on users accounts.

m463• 11 months ago

garbage company demand not just a email + pass but also security questions

thank goodness they do this, because I use the same email + password with my garbage as with my bitcoin wallet, my brokerage account and my online mistress finder app.;

noisy_boy• 11 months ago

My utility company used to include the bill amount in their email which I used to pay using my banking app. But no, where is the fun in that! So they built an app, because what is the utility of a utility company without an app, removed the amount from the email so that I can give my fingertips some much needed workout and open the cursed app just to see the amount. I think the app has a feature to pay as well but being the minor lord of pettiness that I am, I refuse to use that and still pay using my trusty banking app.

t0mas88• 11 months ago

They do that to match your device ID or cookies with their customer records. Since cookies don't last long they prefer to have you do that every month.

More details here: https://hightouch.com/blog/what-is-identity-resolution

stavros• 11 months ago

There has been a spate of Russian hackers recently paying other people's garbage bills, it's becoming an epidemic. The company is right to want to curtail it by asking you for your favourite books, which is the hobbit, not the Hobbit

maccard2• 11 months ago

My supermarket requires email 2Fa for grocery delivery and enforces it on basically every login. It means whenever my wife or I are doing the shopping we have to have the account owner there to get the secondary code.

I keep meaning to auto forward all emails from then to me….

bapak3• 11 months ago

I bet the password expires every 6 months too

bbno4• 11 months ago

this reads like chatgpt dribble

dangus• 11 months ago

The word you’re looking for is “drivel.”

DrawTR• 11 months ago

I don't like the baseless LLM accusations, but the code comment

// Device wants updates! Store that push token like it's bitcoin in 2010

...really had me raising my eyebrows. Along with the mixed em-dash and hyphens and the AI generated images on the page.

jon-wood2• 11 months ago

I would absolutely write a comment like that in code I was writing for a personal project. I’ve written way worse as well.

Starlevel004• 11 months ago

The AI dashes mixed with the manual double hyphen AI dashes makes it likely

latexr8• 11 months ago

There’s no such thing as “AI dashes”. Em-dashes are valid typographical marks which have been employed for literal centuries. The only reason LLMs even used them is because humans do too, as they were trained on that input. It’s your prerogative to not care about proper punctuation, but that in no way indicates that those who do are machines.

tremarley• 11 months ago

There was a few spelling mistakes

danpalmer3• 11 months ago

It doesn't to me. I can tell AI writing because it has irrelevant details that don't add facts or colour to the story, but this doesn't have any of that really. The tangents come across as human, not AI doing a bad impression of human.

Things like em-dashes are a really bad way to detect AI because they can be good grammar and improve text readability, same with curly quotes. I use them all the time in my writing, and I wouldn't be surprised if this iOS dev feels similarly as Apple platforms have emphasised this stuff for years.

nneonneo• 11 months ago

Humorously, after re-learning about em-dashes due to their use by AI (an otherwise forgotten part of high-school English), I started using them more often in my writing. They really do look nicer!

As an academic I’ve always used “delve”, too, so at this point I guess my writing is going to be flagged as AI a lot…

I do note that some of the AI slop I’ve received from students include other fancy Unicode characters (superscript numerals, variant Greek letters, blackboard bold R, etc.) that are difficult to type, and which especially would not be used in e.g. code comments. em-dashes at least can be produced by certain word processors or text IMEs automatically, whereas many of these others require specifically looking for the character.

slacktivism123• 11 months ago

    No secret. Just vibes.

Since you know the tells of LLM generated text, you'll know that this is a classic: No X. Just Y.

    Proxyman -- pick your poison.

    And if you're from PureGym reading this—let's talk.

There's a mixture of em dashes joining words and double hyphens spaced between words, suggesting the former were missed in a find and replace job.

"And if you're from [COMPANY] reading this[EM DASH]let's talk" is a classic GPT-ism.

    It's like the API is saying "Hey buddy, I know this is odd, but can you poll me every minute? Thanks, love you too."

    Shame Notifications: "You were literally 100 meters from the gym and walked past it"

    It's just a ZIP archive with delusions of grandeur

Clear examples of fluff. Not only do these fail to "add facts or colour to the story", they actually detract from it.

I agree with you that em dashes in isolation are not indicative, but the prose here is dripping with GPT-speak.

wyes• 11 months ago

100%

"The crown jewel? Your 8-digit gym door PIN is your API password and you most likely didn't set it yourself. The same PIN that hasn't changed since the iPhone 8 was cutting-edge technology."

Reads directly from ChatGPT

troupo2• 11 months ago

Ah yes, because we all know that ChatGPT is capable of writing coherent texts with consistent humour and details on a technical topic.

jackdecker• 11 months ago

I was thinking the same thing - Went back and re-read it though, and I think it’s more that the author wrote a first draft and then had AI to help spice some stuff up. He either:

1. Used AI to help and doesn’t care if it sounds a little AI generated / actually likes it 2. Didn’t use AI but reads enough AI slop that his writing style is directly influenced by it (scary) 3. Used AI but doesn’t use AI enough to immediately recognize when language sounds like it was generated by ChatGPT and didn’t bother correcting (this is my guess)

There’s a few times I got tripped up because it went from pretty human writing to “holy shit shit that’s ChatGPT I’m going to stop reading,” yet the author would save it with human writing right after.

This is kind of a ramble, but it actually was one of those pieces of writing that I felt was genuine and improved by some of the ChatGPT language rather than just clickbait garbage - I could tell the author was just trying to make it worthwhile and interesting to read, and I honestly really enjoyed it.

pyman4• 11 months ago

This is a great post, it captures the true essence of an engineer. It is funny, intriguing, and inspirational. Congrats! You are a hacker at heart.

When I went to the US for 3 months I joined PureGym and they gave me a PIN number. I cancelled my membership after that, and one day Chrome told me my PureGym PIN had been compromised. 2 years later, I went to the US again, rejoined, and received the same PIN. Massive red flag.

I was also intrigued by the app, the token and PIN, and remember finding a security flaw in the system that activates the hydro massage chairs. It accepts your PIN or any PIN, with no security at all.

eterm4• 11 months ago

Chrome told me my PureGym PIN had been compromised

This is likely a false positive, if chrome is using haveibeenpwned API.

e.g. A pin of 87623103

Hashes to 558B4C37F6E3FF9A5E1115C66CEF0703E3F2ADEE

We get the range from HaveIBeenPwned:

https://api.pwnedpasswords.com/range/558B4

And search for C37F6E3FF9A5E1115C66CEF0703E3F2ADEE

And see it's "Compromised" and seen 3 times before.

eterm4• 11 months ago

In case anyone else was wondering, not all 8 digit pins are "compromised", although many are, and of course an 8 digit pin has limited security in any automatable scenario.

To get an example that was already in the haveibeenpwned dataset, I wrote a quick script:

  var httpClient = new System.Net.Http.HttpClient();
  httpClient.BaseAddress = new Uri("https://api.pwnedpasswords.com/");

  while (true)
  {
   var password = string.Join("", Enumerable.Range(0, 8).Select(e => Random.Shared.Next(0, 10)));

   var hash = Convert.ToHexString(System.Security.Cryptography.SHA1.HashData(Encoding.UTF8.GetBytes(password)));

   var passwordRange = await httpClient.GetAsync($"range/{hash.Substring(0, 5)}");

   passwordRange.EnsureSuccessStatusCode();

   var allhashes = await passwordRange.Content.ReadAsStringAsync();

   var splitHashes = allhashes.Split(Environment.NewLine);
   
   var compromised = splitHashes.SingleOrDefault(h => h.StartsWith(hash.Substring(5)));
   
   if (compromised != null)
   {
    Console.WriteLine($"Password {password} Compromised! Found {compromised.Split(':')[1]} time(s)");
    Console.WriteLine($"Hash: {hash}");
    return;
   }
   await System.Threading.Tasks.Task.Delay(1_000);
  }

The "most compromised" I've seen so far is "17385382", in the DB an astonishing 119 times. It would only take a few hours to iterate through all pins and collect stats for all pins.

qingcharles3• 11 months ago

I had this constantly the last couple of days. I've been doing some UI mockups in Claude and it includes a password field, and either it puts in a placeholder of like 1234 or I type asdf to test the field. Then as soon as I do anything else Chrome has a fit because "my" password has (obviously) been "pwned."

yodelshady• 11 months ago

I've received the same PIN from an entirely different gym chain, albeit one using the same door system.

As you say, a massive red flag indicating it's not using a lot of sources of entropy.

thefreeman• 11 months ago

Or they just reactivated his previously canceled account and it still had a pin associated

pyman4• 11 months ago

What worries me the most is that if the ACS can't issue new PINs, there's no way to replace them. If a single PIN is shared or compromised, anyone with it can walk in undetected until the whole system is replaced. And if the entire PIN list is exposed, all hell breaks loose.

firesteelrain2• 11 months ago

PureGym is located where in the US? I can’t find any locations just in the UK

pyman4• 11 months ago

https://www.purefitness.com/

pmonalm• 11 months ago

    POST https://auth.puregym.com/connect/token
    grant_type=password&username={EMAIL}&password={PIN}&scope=pgcapi offline_access
    Authorization: Basic cm8uY2xpZW50Og==

Looks like it could be feasible to brute force some PINs using this API. Assuming it's not rate-limited, an average of 50,000,000 API calls isn't that many.

eterm4• 11 months ago

    > The crown jewel? Your 8-digit gym door PIN is your API password and you most likely didn't set it yourself.

I hope there's a rate-limit on failed attempts.

Because if you know someone's email address, it sounds like you get API access fairly quickly after that?

Also I trust that the scopes that you can ask for are limited appropriately?

valzevul4• 11 months ago

OP here!

it sounds like you get API access fairly quickly after that?

Yes, that's correct; I am yet to hit the rate-limit but from my experience with the official app/website, it's quite forgiving to failed attempts.

The scope in the post is the one used by the app and other unofficial clients on GitHub [1][2], so I doubt there are more options beyond that.

-- [1] https://github.com/0wain/puregym-api-php-wrapper/blob/main/s... [2] https://github.com/2t6h/puregym-attendance/blob/main/puregym...

OtherShrezzing2• 11 months ago

I think the even better crown jewel here is that the code is predictable, with no lock-out facility at the gym door for wrong attempts. The format is (or was when I signed up) something in the format

[minute of the hour you created the account][random number, 2 digit][day (or maybe month) of birth][year of birth]

So <59341295> is the code for a user who signed up at :59 past the hour, and their birthday is December 1995.

If you know someone’s birth month, you can just scan through ~6000 possible codes in a for loop to get their access code. At my gym, the PT coaches would celebrate their clients birthdays loudly,

I’d not be surprised if the random number component was just an integer that increases with each sign up at a gym.

arjvik• 11 months ago

A Pass Type ID certificate from Apple Developer Portal

How much does this cost? I'd love to create Apple Wallet passes for things, but I'm weary of setting up a Apple Developer account and paying even more fees for just this.

bc569a80a344f9c• 11 months ago

As far as I can tell, it’s included with the base product. But to keep it active you’d have to renew the developer subscription every year.

ethan_smith• 11 months ago

The Pass Type ID certificate requires an Apple Developer Program membership which costs $99/year, but there are no additional fees specifically for Wallet pass functionality.

Zak• 11 months ago

This is obnoxious given PKPass is an open standard. Third party apps can use them without any requirement to be verified by some authority, but Apple just has to maintain some sort of control.

monksy• 11 months ago

I can't believe this criminal that is writing this. Won't people think of the poor data brokers that are sucking down data from this forced app about who he is, what his device profile is, where is location is etc?

Jbird2k• 11 months ago

Wallet is spelled incorrectly under subheading “The Swift backend nobody asked for”

JSR_FDED• 11 months ago

Think about this for a second. The physical keypad -- exposed to British weather, coated in a mysterious film of protein shake and regret, probably being livestreamed to TikTok by someone's ring doorbell -- accepts my ancient PIN without question. But the digital QR code needs cryptographic rotation that would make the NSA jealous.

Great writing!

isubkhankulov• 11 months ago

Does this post read like an LLM wrote it to anyone else? Not a big deal if it does but it feels like it’s trying too hard.

pyman4• 11 months ago

It took years for people to accept that some photos had filters applied, enhancing them to look as good as professional shots. The same will happen with text.

This is a great blog post, whether it's editorialised or not.

dmcc7897• 11 months ago

I have no idea if this was written by AI, and frankly I don't care. I really enjoyed reading and appreciated the humour.

I'm curious to see how easy this would be on Android and to have an auto updating QR code widget on my home screen.

p0seidon• 11 months ago

Enjoyed reading it

CraigJPerry• 11 months ago

Love the writing style, good fun but full of interesting technical detail too

account-52• 11 months ago

I love reading about this sort of thing. My personal solution to the issues with the app and the wait for it to work (if it worked) was to memorize the pin. I believe I'm still quicker getting in than even the OPs solution, and with less hassle too since I don't need a device or any services.

Roonerelli• 11 months ago

My favourite inexplicable feature of the PureGym app on iOS is that when you open it, it stops any audio you are listening to. In the same way as if you have opened another audio app. Yet it isn’t playing any sound. Crazy

burnerthrow008• 11 months ago

Audio apps have greater permissions to run the background, right? Wonder if it’s related to that.

urbandw311er• 11 months ago

Two possibilities spring to mind:

1. They will have added code that declares the app requires an exclusive audio context. So iOS pauses all other audio when the app is foregrounded.

2. It’s possible that they use anti screenshot technology which sometimes involves embedding a secure video in place of an image. The video playback might be grabbing the audio context.

figgyc• 11 months ago

I've had this a few times on Android (eg the new Subway app). I'm 99% sure it's the latter but not for security, just a fancy splash screen animation that was implemented as a video without thinking about setting it as "no audio".

bapak3• 11 months ago

Tell me a bigger red flag to identify junk apps. Every "homemade" low cost app has similar inexplicable bugs that they don't care to fix.

My bank app forwards me to the settings every time I try to send a bank wire because I never allowed access to contacts.

hombre_fatal• 11 months ago

Apple doesn’t care to fix it either. Why can an app repeatedly turn off the podcast I’m listening to yet I have no recourse to stop it?

I have to keep pressing Play on my airpods. If I’m not using airpods it can be impossible to resume my own audio with the app open.

mattuk89• 11 months ago

Same with the Technogym app on Android. Every time I connect to a new piece of equipment my audio pauses. Infuriating!

deivid• 11 months ago

Great article, I went through something similar with TrainMore in The Netherlands, where they replaced an NFC key fob with a similarly refreshing QR code (but this one rotates every 30 seconds)

In my case, I didn't make a native app because I don't use the wallet integration.

I wrote about it here: https://blog.davidv.dev/posts/trainmore-re/

yapyap• 11 months ago

lol counting the amount of “time saved” to justify the amount of time u spent building the thing is relatable but also slightly cancerous if it takes over your mindset in the building or brainstorming process. (which unless it’s a jokey bit that has no core of truth it might very well do.)

I used to do it too and in my mind I still do out of habit but I try not to let it influence projects anymore, what else will I do with my time + doing stuff like this keeps ur skills up to date.

latexr8• 11 months ago

I would say that for something like this, it’s still worth it even if you spent more time on it than you’ll ever save.

Not only have you learned new skills and got better at the craft, but you also removed a frequent source of frustration and get satisfaction every time your system works and you remember “heck yeah, I did this”. It increases your happiness and well-being overall into the future and keeps on giving.

john-h-k• 11 months ago

This would be true iff you couldn’t just do it in ~5s using the PIN number

latexr8• 11 months ago

My first approach was embarrassingly naive. "I'll just screenshot the QR code and add it to Apple Wallet as a static image!"
Reader, I actually did this.

How? I’m very interested in that part.

I remember wanting it because (despite it being possible) services don’t usually allow you to add Wallet passes when you buy from the web, instead requiring you to install their app (which I do not want). But I can already see myself using this for services which don’t even provide Wallet passes.

From the author’s wording, it seems there’s a way to add such screenshots without using a third-party app.

the_mitsuhiko2• 11 months ago

You can create wallet files yourself.

latexr8• 11 months ago

I mean, clearly, that’s the whole point of the article. What I’m asking is how do you make a wallet pass from a static image. Is is difficult? Is it simple? What are the steps?

This is like if I asked “how do I boil an egg” and you had answered “you can boil an egg yourself”. Yes, I know that. That’s obvious but also unhelpful. The correct (short) answer would’ve been “bring water to a boil on the stove, lower an egg into it, wait around 10 minutes, turn it off and place the egg in cold water for an easier peel”. Or “here’s a link with instructions: <URL>”.

ceejayoz3• 11 months ago

I use an app called Pass2Wallet that lets me turn any barcode (loyalty cards etc.) into a Wallet pass, with location based invocation etc.

latexr8• 11 months ago

Thank you for the recommendation, but I don’t want to pay a subscription for something I use sporadically, especially (according to the App Store page) an AI-generated app which tracks you. I want to do what the author mentioned: take a static image and add it to Wallet. I don’t mind some legwork.

maccard2• 11 months ago

Wasn't expecting to see someone posting about my gym on HN this morning!

hyperbolablabla• 11 months ago

Great article. Me personally, I just learned my PIN...

chtitux• 11 months ago

It could be interesting to understand the actual content of the qrcode. part1 is a static id, so likely linked to the membership.

part2 seems to be a timestamp. Maybe we can try to forge the value to "now - 10 seconds".

And if the implementation has been done right, the "part3" should be a signature of part1 and part2, not a "salt" (so forging part2 should be detected and code rejected).

NoahZuniga3• 11 months ago

Judging by the size of the qr code, part 3 is too short to be a signature. Probably the token is just registered in a centralized system that the qr code scanner checks with to see if the code is valid.

ezfe• 11 months ago

The real travesty here is how bad the official app is. For example, the Planet Fitness app takes 7 seconds to go from closed to showing a QR code.

jt21904• 11 months ago

I question these imagined barriers:

Should I package this up properly? Probably not: it's a proof of concept that solves my specific problem. Plus, PureGym would probably just hire me to shut it down, and I'm not ready for that level of corporate responsibility.

Don’t take a job if they offer one to you then?

SaaS Dreams: Package this properly, get sued immediately, become a cautionary tale at product management conferences.

I genuinely don’t think that this is how it would go down, unless you’re marketing it as an official product. As a consumer I’m allowed to buy things that I find useful, and if this was packaged as a third-party convenience for personal use I don’t see the issue.

I suppose that if the company even noticed (very unlikely) they could get pissy but then I’d expect a c&d to arrive not some multi-million dollar lawsuit. Caving in at this point is an option.

Honestly I think getting past app review and into the App Store would be the hard part.

OrvalWintermute• 11 months ago

I love this kind of story:

Developer frustrated with missing functionality / UI problems / etc / and solves it. So awesome!

NoahZuniga3• 11 months ago

Number of times they've asked me to make them one: 23 Number of times I've had to explain copyright law: 23

It's not clear to me why sharing an app that puts the qr code in Apple wallet would violate copyright law. This wouldn't require redistributing the app or any of its copyrighted contents. Maybe "unauthorized" use of the API is against TOS, but that's not illegal.

jt21904• 11 months ago

I made a similar comment below, but I’ll add to this one too: If I, as a gym member, use their api when I run their app and that’s ok, why can I not run the same api from a third-party app for the exact same use-case? If his app asked me to punch in my eight-digit pin and then just kept that stored locally for convenience, what is the issue?

valzevul4• 11 months ago

OP here. Yeah, "copyright law" was a lazy shorthand, but it reads better than "tortious interference."

PureGym's T&Cs [1] have a ridiculously long "PIN abuse policy" (probably meant to stop people sharing with mates). They can cancel memberships or even retroactively charge for gym use if you "knowingly provided your PIN to another individual."

I'm not a lawyer and don't fancy being the test case for whether entering your PIN on a third-party website/app counts as "knowingly providing" it. Given how their app works, I suspect they might just ban a bunch of accounts instead.

Though now that I think about it, the squat racks are always packed, so maybe I should just distribute the app to people who go at the same time as me.

[1] https://www.puregym.com/membership-terms-conditions/

AlienRobot• 11 months ago

Look at it this way. If I buy something from a store and pay in cash, and then the cashier takes some money from the register and hands me the change, that's okay. But if I open the register myself and take the money, they call the police.

i.e. just because it's POSSIBLE to do something doesn't mean it's okay to do it.

cxr• 11 months ago

In the US, it wouldn't be, but this is the UK, which doesn't have the same views about what is and isn't copyrightable that the US has. (Despite vague sentiments to the contrary, the US is a lot better at saying, "No, you can't stop people from doing that" than the UK or the EU when it comes to overbroad attempts by creators/rightholders to exert control.)

wat10000• 11 months ago

In the US, the Computer Fraud and Abuse Act outlaws unauthorized access to computer systems. “Unauthorized” has sometimes been interpreted to include terms of service violations. So if their click-through agreement nobody reads says you’re only allowed to use their official app to access the service, using a third party app to access it may be criminal.

jt21904• 11 months ago

This is in the U.K.

a3w• 11 months ago

That should be an Appclip by PureGym. Or of course, a single-time wallet export. Or a physical one euro dongle, so you can leave your phone at home.

GolDDranks3• 11 months ago

Nice solution!

Out of curiosity to the OP, did you use an AI to tweak/refine the text? It contains a lot of similar writing patterns as some read-aloud 4chan greentext/copypaste YouTube channels, especially liberal use of whimsical similes: "like it's 2000 and I'm downloading a JPEG on dial-up" "starting to feel like cosmic punishment" "like it's protecting nuclear launch codes", and jocular asides: " -- exposed to British weather, coated in a mysterious film of protein shake and regret, probably being livestreamed to TikTok by someone's ring doorbell -- ".

So I started to wonder if my AI-radar was spot on, or is that style of writing something people naturally do – because I wouldn't bother, but then again, I don't run a blog that people actually read.

CrispinS• 11 months ago

Did you use an AI to tweak/refine your comment? It's:

* Written more formally than the typical HN comment

* Uses uncommon language like "jocular asides" and "whimsical similes"

* Fails to recognize that those mentioned phrases are cliches that people have been using for ages, long before LLMs

In short, recalibrate your AI radar, it's malfunctioning.

GolDDranks3• 11 months ago

Heh, I guess so. It's just an uneasy feeling I can't get rid of. Maybe I'm just being paranoid. Then again, I wonder if the said greentexts are AI-generated still. At least the contents are likely to be fakes.

bstsb2• 11 months ago

was looking for this comment. excellent writeup nevertheless :)

qingcharles3• 11 months ago

I got the exact same uncanny valley feel from the text. Great article, though. Some people just don't have great writing skills and need a leg up, so I think it's totally excusable to use AI to help you write something. Writing up a little pet project like this is super valuable and I'd hate it to only exist on the author's system because they didn't enjoy writing or didn't feel good at it.

GolDDranks3• 11 months ago

Glad to know that I wasn't alone with my feeling!

throwaway31131• 11 months ago

Great post.

What’s Next: Shame Notifications: "You were literally 100 meters from the gym and walked past it"

As much as I hate to admit it, that would probably work on me and I’d probably turn it on.

stefs2• 11 months ago

wouldn't work for me because i usually don't have my gym bag with me when i don't plan going. have a regular schedule and a program with a progression scheme.

sbaildon• 11 months ago

Similar story with Better’s leisure centres. A frustrating app that only needs to display a barcode, and it doesn’t even rotate.

dado3212• 11 months ago

I did something very similar for Fitness SF in the Bay Area!

https://blog.alexbeals.com/posts/custom-apple-wallet-passes

rekabis• 11 months ago

I heartily approve of this kind of guerrilla development.

The only downside is that they hold all the keys to the kingdom, so either they (or someone inside the org with political weight) will be pissed off straight out of the gate, or you’ll always be walking on eggshells trying your best to not piss them off.

CraigRood• 11 months ago

Awesome post and fun read given I'm a PureGym member myself.

I 'got around' the PIN/QR Madness after 1 week by getting key fob. Now I don't have to ever open the app...

Attendance API looks to be worth playing with! Nice Bonus.

kentbrew• 11 months ago

Truth: "PureGym probably has a roadmap, sprint planning, and very good reasons for not implementing Apple Wallet. Maybe it's not a priority. Maybe they have data showing only 0.3% of users would use it. Maybe their KPIs are based on the number of online classes previewed in the app, and forcing users to see them every time the app loads secures someone's annual bonus."

rblatz• 11 months ago

The service itself is a several week endeavor to do properly, you have to understand the impact of all the pushed passes on the QR code generator, put together telemetry, dashboards, and alerting for the new service. Depending on their infrastructure that could be difficult to spin up. You have to do a design and review with the team so this isn’t just understood by one person and can be supported by a team. Documentation, ADRs, etc. setting up processes for managing the cert chain over the long term. And you probably want to keep parity between the iOS and android apps, so you need to understand that work.

Then yeah, it lowers engagement with the app, which is probably tied to someone’s bonus.

crote• 11 months ago

A lot of those pain points are involved by virtue of being the original developer. Generating a QR code every single minute for every single user can indeed easily lead to issues, but that's much less of an issue when you're able to change the QR code validity to, say, a week.

If you use online validation you can even dynamically rotate them whenever it suits you - either to adjust server load, or as some kind of "every Nth check-in" scheme. Heck, with online validation it doesn't even matter if the rotation service goes offline for a while!

Or just generate a fixed QR code which never changes. You know, like the 8-digit pin the QR code is the alternative for.

snalty• 11 months ago

Great work! I did something similar before with supermarket loyalty cards before Wallet support was widespread, even had the. Co-op loyalty balance on the card which updated.

HK-NC• 11 months ago

You can get 3 second gym entry by typing in that fixed PIN.

I accidentally became PureGym’s unofficial Apple Wallet developer

Related Stories