3,730 karma · joined June 5, 2013
This is an unencrypted interface supplied by the cards, which means it is readable by any NFC-enabled device (including any android device...)
This interface is different from the EMV (payment) interface, which is encrypted. The Flipper cannot clone EMV cards.
The problem here is that cards transmit their card info to anyone who asks, not that Flipper is a malicious device.
http://travel.ninjito.com/images/2018-03-15-Siberia/qx-baika...
Inspired by the sheer beauty, I went back next year, found another abandoned fisherman's cabin and spent 2 weeks .. existing.
What is definitely true is that your days are very quickly filled with important tasks: skate 5km every other day to get water, trek across the forest to get wood, cut wood, maintain your fire, etc.
Completely astounding experience to be so isolated and independent in nature.
Essentially, they screen transactions; if any approved transactions are chargebacked, they refund you.
A good start point is https://signifyd.com
We dropped in this solution on our e-commerce about 5 years ago; fraud has been a non existent problem.
A few examples of these clauses being exercised were on HN (both cases pending) - https://news.ycombinator.com/item?id=29935515
- https://news.ycombinator.com/item?id=32739950
If it wasn't obvious, cherry-picking bits and pieces from various jurisdictions isn't legal; PayPal deftly deflects any legal challenges to their various dispersed entities making them essentially untouchable if you don't have unlimited resources.
If anyone is interested, in the EU, this is their playbook:
- Ignore all communications unless it's a C&D from lawyers
- Deflect responsibility to PayPal Luxembourg.
- They have, or have had literally 90% of LU lawyers retained, meaning your case will not / cannot be accepted by the majority of LU law-firms due to conflict of interest
- Deflect onto the CSSF (Luxembourg Monetary Watchdog)
- Respond to the CSSF that the complaining company is not based in Luxembourg, which results in the CSSF concluding that they are not the competent structure to rule.
- Case closed, your funds have been stolen, and PayPal has artfully dodged the relevant regulatory bodies.
It falls under the CSSF's jurisdiction:
"PayPal has the status of a Luxembourg credit institution and is under the prudential supervision of the Luxembourg supervisory authority, the Commission de Surveillance du Secteur Financier (the "CSSF"). The registered office of the CSSF is located at L-1150 Luxembourg (Luxembourg)."
In this instance the CSSF is rigorous, but ultimately rigid. They have clearly defined boundaries and protocols. The problem is that companies such as PayPal exploit this to their benefit - which means that they ultimately use the watchdog entities as peons to execute their illegal practices.
It took us literally a month of calling LU law firms until we finally found one that didn't have ties to / being the tentacles of PayPal.
- https://news.ycombinator.com/item?id=29935515
- https://news.ycombinator.com/item?id=32739950
If it wasn't obvious, cherry-picking bits and pieces from various jurisdictions isn't legal; PayPal deftly deflects any legal challenges to their various dispersed entities making them essentially untouchable if you don't have unlimited resources.
If anyone is interested, in the EU, this is their playbook:
- Ignore all communications unless it's a C&D from lawyers
- Deflect responsibility to PayPal Luxembourg.
- They have, or have had literally 90% of LU lawyers retained, meaning your case will not / cannot be accepted by the majority of LU law-firms due to conflict of interest
- Deflect onto the CSSF (Luxembourg Monetary Watchdog)
- Respond to the CSSF that the complaining company is not based in Luxembourg, which results in the CSSF concluding that they are not the competent structure to rule.
- Case closed, your funds have been stolen, and PayPal has artfully dodged the relevant regulatory bodies.
During this time, you can still receive funds, and you're promised quick resolution. You provide the documentation. They drag their feet. They request more information. They drag their feet. All the while, your account has accumulated more funds that you can't access.
Then, they'll request something impossible, ie: give us proof of delivery (not shipment) of these 500 orders. Inevitably, there'll be one order that was returned / was delivered without signature / etc.
You'll try to reship the customer, but you've got a 3 day deadline. You miss the deadline, and the account gets perma-frozen for 180 days, but you still believe you'll get your funds back.
180 days later, you'll be notified that your funds aren't eligible for return, because you cost them the equivalent of what was in your account due to the time invested by their legal and risk teams - because buried in their T&C they evoke Common Law allowing for punitive damages for T&C transgressions.
It's calculated extortion to seize as much money as possible.
No information was given. After the 180 days "freeze" period, they announced that the funds would not be returned, ie: they stole the money.
We lawyered up. Their legal team refused to acknowledge official communications from our lawyers, citing "Customer Privacy Protection".
When we turned up the heat, we were told that our French lawyers (for a French company, and a French account) had no jurisdiction - the account was managed by PayPal Luxembourg.
We retained Luxembourg-based lawyers. PayPal Luxembourg refused to communicate with the lawyers, regurgitating "Customer Privacy Protection".
We lodged a complaint with the CSSF, the Luxembourg monetary watchdog. PayPal finally replied via the CSSF, citing that our account was selling illegal products, ergo the proceeds were illegal, ergo PayPal deserved to keep them.
None of the products they cited were ever featured on our site. They included screenshots of other sites. When this was transmitted to the CSSF, PayPal silently released all funds owed, but continued to defend their position.
We are now pursuing damages; PayPal Luxembourg is now claiming that the CSSF has no jurisdiction over them, because the accounts are French / HK / Australia.
PayPal has an active policy of abuse and racketeering. They know the legal system. They use multiple jurisdictions in their T&Cs to maximise and legalise their theft (IE, PayPal Luxembourg cites UK law in the T&Cs to allow punitive damages for perceived breaches of their illegal contracts).
They know the legal system, and use their multi-national entities to avoid oversight from watchdogs. They know customers don't have the resources to pursue them. We've spent well over 100k to recover 50k, but someone has to stand up to these thugs.
If you're in a similar situation: Don't be intimidated. Get lawyers, and pursue them via the monetary authorities in your country. They have made theft a business model; apply pressure on the entities that can apply pressure on them, and you'll have a good chance to get your money back.
Stripe's Radar is all well and good, but they have no skin in the game. If they're right or wrong, you're on the hook.
Services like SIGNIFYD apply their own fraud logic. If a transaction is approved and is later disputed, you are refunded the value of the order and the chargeback costs.
Not associated with them, but have been using them for several years and hundreds of thousands of transactions; our fraud problems are non existent.
A well placed, polite email to C-level staff often fixes the problem, but can draw attention to flaws in the support flow - or validate a customer-hostile standpoint, at which point you can make an informed decision about where to place your business.
If keys aren't found, you can perform a "Reader Attack" - take the nonces from the log during a sniffed authenticated exchange, place them in a MF32Key tool (there are online versions as well) - and this will calculate the key.
The device doesn't have enough computational power to crack on board (for that you need a Proxmark / iCopy-X) - but the team has roadmapped a tethered mode for performing these cracks.
"Read RAW" does exactly what it says on the label: Captures a raw stream, based on the specified frequency and demodulation.
"Read" captures, decodes and attempts to interpret the signal capture. The FlipperZero has a large built in database of brands + models of RF devices, and a database of KeeLoq master keys.
For rolling remotes that are KeeLoq based, with known keys, the Flipper can most definitely decode / decrypt rolling codes, and generate the next in the sequence.
TL;DR: Handles fixed + Rolling codes, via built in database of keys + models.
The northern terminus of the Ligne de Sceaux opened at Luxembourg in 1895. Between 1973 and 1977 it was converted into RER B.
( https://en.m.wikipedia.org/wiki/Luxembourg_station_(Paris) )
It was kept in operation until 2004 for government services!
Dragged it literally around the world, but stopped using it because it was starting to show the wear, and I was scared of ruining it.
I've shot a lot of digital and film since then, but nothing has ever come close to capturing the sheer beauty that drops out of this camera.
Shooting on slide film and then diving in with a loupe abd a lightbox is like reliving the moment.
If anyone is interested, this is my first roll of film from the camera (on the legendary Fuji Velvia 50 no less)
I couldn't see any backend option to select the preferred Shopify Payments backend processor, but would be interested if you have insight into how to achieve this.
In what gives weight to the GP, we enabled Shopify Payments, confirmed it went through PayPal and switched back to Stripe to avoid the "process with PP for a week and then have them freeze your funds for 6 months" grind.
We've been running e-commerce for the last six years, and have tried everything (woocommerce, open commerce, bigcommerce, magento, prestashop).
They are all light-years behind Shopify.
We've had bumps along the way with Shopify as well (similar problems to yours).
A few thoughts:
- Know who you are in bed with : Shopify Payments is actually Stripe Platform in most locations, and PayPal in Europe. We refuse to work with PayPal because of their predatory behaviour, so we choose not to use Shopify Payments in the EU.
- The Shopify Payments platform is for better or for worse a "start without friction, KYC later" experience. Be aware of what this entails.
- Get on RocketReach, find key people in Shopify relevant to your problem and send a succinct email asking for assistance. It's unblocked every problem we ever had
- Do the same with your merchant processors : Edwin from stripe actively reads HN, and can often provide assistance on Stripe related issues.
- Get lawyers. Not the Go-Sue-the-Pants-off-everyone lawyers, but business / commercial lawyers. Not only can they provide excellent advice for your business, they often spécialise in these types of situations to have conversations and results that you can't access individually.
At the end of the day, know your business partners and establish a relationship with them.
Using a combination of the above, we've survived competitors using fake C&Ds against our processors and platforms, amongst other things.
I'd personally found that picking never stuck: Something between understanding the fundamentals and individual pin picking that my brain refuses to handle.
With that said, I discovered impressioning, which I find infinitely more tactile, interesting and exciting.
As you say, there's almost infinite space for evolution.
For next steps, I'd highly recommend this book: https://www.amazon.com/Little-Black-Book-Lockpicking-Profess...
It's written by a friend who teaches picking to hobbyists, locksmiths and LEA.
If you're in Europe, we also just launched https://lock401.com - highly curated collections of lockpicking tools.