5 ms·

> PayPal has restricted our business account because we have invoiced a license key containing the random letter sequence “ALEP”. This makes me wonder: what's

by float4 3y ago

> PayPal has restricted our business account because we have invoiced a license key containing the random letter sequence “ALEP”. This makes me wonder: what's the best way to generate "safe" license keys? Binary feels like an obvious solution (binary keys surely get through virtually all blacklists?) but at the same time: binary license keys would be very long and very atypical, so maybe fraud detection systems mark them as suspicious anyway. Maybe just generate random alphanum license keys and run them through some open source blacklists yourself? I doubt "ALEP" is in those lists though.

fps_doug 3y ago
What a time to be alive where you have to worry about how you generate your license keys as to not be labeled a terrorist.
- hnlmorg 3y ago
  It also begs the question: would actual terrorists put the name of their organisation in any of their financial transactions? I know you should never underestimate human stupidity but even taking that into account this still feels like security theatre on the part of PayPal.
  - ChrisMarshallNY 3y ago
    > I know you should never underestimate human stupidity Those of us “of a certain age,” will remember the old adage ”To err is human, but it takes a computer to really f*** things up.”
  - B1FF_PSUVM 3y ago
    https://www.google.com/search?q=begs+the+question https://www.google.com/search?q=begs+the+question
  - TheNorthman 3y ago
    That's hilarious. "Payment of vest and explosives for ISIS attack"
  - epgui 3y ago
    I think they might. Maybe not all and always, but a thing about terrorists which can be quite mind boggling at times is that not everyone seems to agree who they are. Just look at how many countries are still doing business with Russia and other countries with less-than-stellar reputations. There may be plenty of parties who would actually not mind doing business with disreputable entities, for various reasons. I would assume they'd try to be a bit clever, but I wouldn't be surprised to see lax controls.
    - hgsgm 3y ago
      "terrorist" is an opinion or a judgment, not an objective fact. A better term in a KYC context "sanctioned entity" or somesuch. If someone X is comfortable doing business with/as entity Y but a bank Z is not, it's totally sensible that X would say Y to the bank Z and bank Z would block them.
      - Koshkin 3y ago
        > "terrorist" is an opinion or a judgment More importantly, "terrorists" is often used by some governments in reference to protesters or any group that they see as unfriendly to them.
    - A4ET8a8uTh0 3y ago
      It is highly unlikely, but not impossible. Anecdotally, I did see a case of a business that put a real location of the business they are working with, which happened to be in a sanctioned country. Needless to say, it generated all sorts of questions and eventual OFAC contact. Bottom line is: it happens, but I agree with you that people that know what they are doing are not putting "Pay for assasination by Osama Bin Laden on 03/28/23" in reference field.
  - msm_ 3y ago
    Not really responding to your question, but one of my friend jokingly returned money to another friend with a bank transfer titled "for jihad". Needless to say, both banks were not amused. They both were "verified" on the phone and confirmed they are not, in fact, actually terrorists. I wonder how many people-years banks waste on pranks like this.
    - lazide 3y ago
      How could you verify someone was not a terrorist on the phone?
      - iforgotpassword 3y ago
        Well, he sounded kinda like a nice guy.
  - PeterisP 3y ago
    Many such organizations are legitimate legal entities in some country and handle purchases; and of course there are sanctioned people as well, and a payment from or to them does include their name.
- mcv 3y ago
  Why is the license key in the payment description? The description should just be "update license key", and not contain the actual key.
  - rvba 3y ago
    If you buy multiple keys it makes life easier - you know which payment is for which key and for which invoice. This way you have an unique identifier to match them. Without unique identifiers you have big problems. The payment description should at least mention the invoice number or order number. Undescriptive descriptions are terrible when you need to check / match something. Even a human will have problems not to mention autimatic systems. And automationg is something one could expect from decent systems. No manual checks. No ambiguity.
ht85 3y ago
Alternating digits and letters seems easy and robust. That is until you get unlucky entropy and send some 1337ed out curse words :p
blueflow 3y ago
You cant. Insane people will always find hidden codes and dog-whistles in your messages.
jrochkind1 3y ago
> what's the best way to generate "safe" license keys? In the library (like the kind with books) field where I work, one identifier standard was devised that intentionally has alternating letters and digits, with never more than two letters in a row. Explicitly for the intention of avoiding the possibility of any meaningful words (that might end up being offensive or just off-putting in an undesirable way.) It does make the identifiers longer for the same entropy/byte width, compared to a more normal BASE-X with an alphabet. Which mattered to me when they were going to be used in a URL, although probably doesn't for a license key. I personally in my projects stopped using this system for a more straightforward "Ascii-85" like encoding (which can contain coincidental meaningful words), because it was more convenient. The particular system the library community was using [https://n2t.net/e/noid.html https://n2t.net/e/noid.html] was, I still think, over-complicated for at least my needs, but the alternating letter/number schema seems attractive to me now and perhaps worth slightly more characters in identifiers and slightly more complex algorithm for creation than a simple base-x encoding.
- cromulent 3y ago
  It sounds good, but of course for "security" it might not be enough. 626f6d62 is alternating letters and digits, with never more than two letters in a row. And it spells "bomb" when converted from hex to ascii. Some security scanners do check for this kind of thing.
  - jrochkind1 3y ago
    Why would you convert an identifier to ascii as if it were hex? And it seems unlikely that (eg) paypal would do so? But, sure, it's just one idea. You can add more layers to make it even less likely something will seem problematic to someone somewhere; a 100% guarantee seems impossible, especially if you are going to allow things like above "What if we brainstorm for a way this could be a puzzle where the answer is a problematic word to someone". No "scanner" will even possibly catch every possible thing in that domain, no matter how unlikely.
  - GoblinSlayer 3y ago
    Store it as a brainfuck program that generates the required string.
A4ET8a8uTh0 3y ago
edit: Tbh. The more I think about it, maybe it is not such a far fetched idea after all with the assumption that they keys are temporary. ** Eh. Coming from that environment, it would not be that easy for a reason that has nothing to do with technology. The lists that financial companies use are largely known ( some published by US Treasury for everyone to use ) and you can reasonably estimate a threshold most institutions will find acceptable. However, the issue is political and not technical. OFAC itself has grown its SDN list[1] to 6300 names and that is just one list and the tool has been already severely overutilized ( in my opinion anyway, so take that with a grain of salt ), but if the trend and current geopolitical situation is any guide, this number will only increase. What I am saying is that you have a big and very variable base to build a key from ( edit: come to think of it - not from:P ) and there is no guarantee and old key won't suddenly become 'hot'. Here, the answer is to the problem is actually political. Affected businesses have to start really complaining, if they are affected by the requirements. I have no evidence suggesting that is the case ( based on what I saw maybe 20% of transactions face that kind of scrutiny and even smaller percentage is questioned the way the OP is ). Naturally, it does not help that this process is not standardized so every single financial institution does their own thing.. [1]https://home.treasury.gov/policy-issues/financial-sanctions/faqs/topic/1501/print https://home.treasury.gov/policy-issues/financial-sanctions/...
deleted 3y ago
[deleted]
GoblinSlayer 3y ago
Windows keys use digits, consonants and Y, but then they have sequences like BKDR, F7CK, GYMP and 666.

by float4 3y ago

fps_doug 3y ago

What a time to be alive where you have to worry about how you generate your license keys as to not be labeled a terrorist.

hnlmorg 3y ago
It also begs the question: would actual terrorists put the name of their organisation in any of their financial transactions? I know you should never underestimate human stupidity but even taking that into account this still feels like security theatre on the part of PayPal.
- ChrisMarshallNY 3y ago
  > I know you should never underestimate human stupidity Those of us “of a certain age,” will remember the old adage ”To err is human, but it takes a computer to really f*** things up.”
- B1FF_PSUVM 3y ago
  https://www.google.com/search?q=begs+the+question https://www.google.com/search?q=begs+the+question
- TheNorthman 3y ago
  That's hilarious. "Payment of vest and explosives for ISIS attack"
- epgui 3y ago
  I think they might. Maybe not all and always, but a thing about terrorists which can be quite mind boggling at times is that not everyone seems to agree who they are. Just look at how many countries are still doing business with Russia and other countries with less-than-stellar reputations. There may be plenty of parties who would actually not mind doing business with disreputable entities, for various reasons. I would assume they'd try to be a bit clever, but I wouldn't be surprised to see lax controls.
  - hgsgm 3y ago
    "terrorist" is an opinion or a judgment, not an objective fact. A better term in a KYC context "sanctioned entity" or somesuch. If someone X is comfortable doing business with/as entity Y but a bank Z is not, it's totally sensible that X would say Y to the bank Z and bank Z would block them.
    - Koshkin 3y ago
      > "terrorist" is an opinion or a judgment More importantly, "terrorists" is often used by some governments in reference to protesters or any group that they see as unfriendly to them.
  - A4ET8a8uTh0 3y ago
    It is highly unlikely, but not impossible. Anecdotally, I did see a case of a business that put a real location of the business they are working with, which happened to be in a sanctioned country. Needless to say, it generated all sorts of questions and eventual OFAC contact. Bottom line is: it happens, but I agree with you that people that know what they are doing are not putting "Pay for assasination by Osama Bin Laden on 03/28/23" in reference field.
- msm_ 3y ago
  Not really responding to your question, but one of my friend jokingly returned money to another friend with a bank transfer titled "for jihad". Needless to say, both banks were not amused. They both were "verified" on the phone and confirmed they are not, in fact, actually terrorists. I wonder how many people-years banks waste on pranks like this.
  - lazide 3y ago
    How could you verify someone was not a terrorist on the phone?
    - iforgotpassword 3y ago
      Well, he sounded kinda like a nice guy.
- PeterisP 3y ago
  Many such organizations are legitimate legal entities in some country and handle purchases; and of course there are sanctioned people as well, and a payment from or to them does include their name.
mcv 3y ago
Why is the license key in the payment description? The description should just be "update license key", and not contain the actual key.
- rvba 3y ago
  If you buy multiple keys it makes life easier - you know which payment is for which key and for which invoice. This way you have an unique identifier to match them. Without unique identifiers you have big problems. The payment description should at least mention the invoice number or order number. Undescriptive descriptions are terrible when you need to check / match something. Even a human will have problems not to mention autimatic systems. And automationg is something one could expect from decent systems. No manual checks. No ambiguity.

ht85 3y ago

Alternating digits and letters seems easy and robust. That is until you get unlucky entropy and send some 1337ed out curse words :p

blueflow 3y ago

You cant. Insane people will always find hidden codes and dog-whistles in your messages.

jrochkind1 3y ago

> what's the best way to generate "safe" license keys? In the library (like the kind with books) field where I work, one identifier standard was devised that intentionally has alternating letters and digits, with never more than two letters in a row. Explicitly for the intention of avoiding the possibility of any meaningful words (that might end up being offensive or just off-putting in an undesirable way.) It does make the identifiers longer for the same entropy/byte width, compared to a more normal BASE-X with an alphabet. Which mattered to me when they were going to be used in a URL, although probably doesn't for a license key. I personally in my projects stopped using this system for a more straightforward "Ascii-85" like encoding (which can contain coincidental meaningful words), because it was more convenient. The particular system the library community was using [https://n2t.net/e/noid.html https://n2t.net/e/noid.html] was, I still think, over-complicated for at least my needs, but the alternating letter/number schema seems attractive to me now and perhaps worth slightly more characters in identifiers and slightly more complex algorithm for creation than a simple base-x encoding.

cromulent 3y ago
It sounds good, but of course for "security" it might not be enough. 626f6d62 is alternating letters and digits, with never more than two letters in a row. And it spells "bomb" when converted from hex to ascii. Some security scanners do check for this kind of thing.
- jrochkind1 3y ago
  Why would you convert an identifier to ascii as if it were hex? And it seems unlikely that (eg) paypal would do so? But, sure, it's just one idea. You can add more layers to make it even less likely something will seem problematic to someone somewhere; a 100% guarantee seems impossible, especially if you are going to allow things like above "What if we brainstorm for a way this could be a puzzle where the answer is a problematic word to someone". No "scanner" will even possibly catch every possible thing in that domain, no matter how unlikely.
- GoblinSlayer 3y ago
  Store it as a brainfuck program that generates the required string.

A4ET8a8uTh0 3y ago

edit: Tbh. The more I think about it, maybe it is not such a far fetched idea after all with the assumption that they keys are temporary. ** Eh. Coming from that environment, it would not be that easy for a reason that has nothing to do with technology. The lists that financial companies use are largely known ( some published by US Treasury for everyone to use ) and you can reasonably estimate a threshold most institutions will find acceptable. However, the issue is political and not technical. OFAC itself has grown its SDN list[1] to 6300 names and that is just one list and the tool has been already severely overutilized ( in my opinion anyway, so take that with a grain of salt ), but if the trend and current geopolitical situation is any guide, this number will only increase. What I am saying is that you have a big and very variable base to build a key from ( edit: come to think of it - not from:P ) and there is no guarantee and old key won't suddenly become 'hot'. Here, the answer is to the problem is actually political. Affected businesses have to start really complaining, if they are affected by the requirements. I have no evidence suggesting that is the case ( based on what I saw maybe 20% of transactions face that kind of scrutiny and even smaller percentage is questioned the way the OP is ). Naturally, it does not help that this process is not standardized so every single financial institution does their own thing.. [1]https://home.treasury.gov/policy-issues/financial-sanctions/faqs/topic/1501/print https://home.treasury.gov/policy-issues/financial-sanctions/...

deleted 3y ago

[deleted]

GoblinSlayer 3y ago

Windows keys use digits, consonants and Y, but then they have sequences like BKDR, F7CK, GYMP and 666.