I plan on doing a "ticketing" system, where a user would buy a "tour ticket" online. The part that I'm puzzled about is: After they buy, what mechanism to use to verify the ticket?
I've been looking at how platforms like EventBrite, TicketMaster, and they use either QR code or bar-code. But I think for something like my tours (where I don't expect more than 1000 people at a time), is an overkill. Why not just use a simple 5-letter combination, with 26^5 combinations, like GFTLH? Is there any disadvantage of doing this from a security perspective vs. a barcode?
The only reason I see these platforms using QR/barcodes is the sheer amount of ticket (millions they sell). Using a simple 5-character code provides some advantages like:
a) Bigger % of people will be able to verify the code. Even people with dumb phones, I could make a system where they just SMS the code and get an SMS in return if the code is valid.
b) Since the code is more "portable" (everyone with a piece of pen can write it), there are options like: Create printed cards with a placeholder for the code, and just have the buying/filling instructions on the card. This is impossible to do with a QR code (and is very cumbersome with a barcode). So basically, I could then distribute those cards to various venues. It's like "your placeholder ticket you can activate online whenever you want".
But my ques was, is there any disadvantage from a security perspective, considering these factors? It's a bit weird to me, I haven't seen any ticketing platform (even self-hosted ones) use this system, they use all use ticket/QR codes vs. convenient pass-phrases.