“What it doesn’t tell you, though, is that the app will also give you this information unauthenticated, with nothing more than a ticket’s ID (!).”
UK mobile rail tickets are RSA-signed blobs in an RSP6 format the Rail Delivery Group won’t document. The public keys sat in a 2016 inspector APK and behind an open Ticket Keeper endpoint. Worse, the same server hands out a ticket’s full scan history by ID: inspector username, GPS coordinates, the exact train. The vendor called that “intended behaviour,” and the ID is often printed in plain text right under the barcode.