5 ms·

> PayPal has restricted our business account because we have invoiced a license key containing the random letter sequence “ALEP”. This makes me wonder: what's

by float4 4y ago

> PayPal has restricted our business account because we have invoiced a license key containing the random letter sequence “ALEP”. This makes me wonder: what's the best way to generate "safe" license keys? Binary feels like an obvious solution (binary keys surely get through virtually all blacklists?) but at the same time: binary license keys would be very long and very atypical, so maybe fraud detection systems mark them as suspicious anyway. Maybe just generate random alphanum license keys and run them through some open source blacklists yourself? I doubt "ALEP" is in those lists though.

blueflow 4y ago
You cant. Insane people will always find hidden codes and dog-whistles in your messages.
jrochkind1 4y ago
> what's the best way to generate "safe" license keys? In the library (like the kind with books) field where I work, one identifier standard was devised that intentionally has alternating letters and digits, with never more than two letters in a row. Explicitly for the intention of avoiding the possibility of any meaningful words (that might end up being offensive or just off-putting in an undesirable way.) It does make the identifiers longer for the same entropy/byte width, compared to a more normal BASE-X with an alphabet. Which mattered to me when they were going to be used in a URL, although probably doesn't for a license key. I personally in my projects stopped using this system for a more straightforward "Ascii-85" like encoding (which can contain coincidental meaningful words), because it was more convenient. The particular system the library community was using [https://n2t.net/e/noid.html https://n2t.net/e/noid.html] was, I still think, over-complicated for at least my needs, but the alternating letter/number schema seems attractive to me now and perhaps worth slightly more characters in identifiers and slightly more complex algorithm for creation than a simple base-x encoding.
- cromulent 4y ago
  It sounds good, but of course for "security" it might not be enough. 626f6d62 is alternating letters and digits, with never more than two letters in a row. And it spells "bomb" when converted from hex to ascii. Some security scanners do check for this kind of thing.
  - jrochkind1 4y ago
    Why would you convert an identifier to ascii as if it were hex? And it seems unlikely that (eg) paypal would do so? But, sure, it's just one idea. You can add more layers to make it even less likely something will seem problematic to someone somewhere; a 100% guarantee seems impossible, especially if you are going to allow things like above "What if we brainstorm for a way this could be a puzzle where the answer is a problematic word to someone". No "scanner" will even possibly catch every possible thing in that domain, no matter how unlikely.
  - GoblinSlayer 4y ago
    Store it as a brainfuck program that generates the required string.
    - crazygringo 4y ago
      For the user to type in as a license key? That's a special kind of evil...
A4ET8a8uTh0 4y ago
edit: Tbh. The more I think about it, maybe it is not such a far fetched idea after all with the assumption that they keys are temporary. ** Eh. Coming from that environment, it would not be that easy for a reason that has nothing to do with technology. The lists that financial companies use are largely known ( some published by US Treasury for everyone to use ) and you can reasonably estimate a threshold most institutions will find acceptable. However, the issue is political and not technical. OFAC itself has grown its SDN list[1] to 6300 names and that is just one list and the tool has been already severely overutilized ( in my opinion anyway, so take that with a grain of salt ), but if the trend and current geopolitical situation is any guide, this number will only increase. What I am saying is that you have a big and very variable base to build a key from ( edit: come to think of it - not from:P ) and there is no guarantee and old key won't suddenly become 'hot'. Here, the answer is to the problem is actually political. Affected businesses have to start really complaining, if they are affected by the requirements. I have no evidence suggesting that is the case ( based on what I saw maybe 20% of transactions face that kind of scrutiny and even smaller percentage is questioned the way the OP is ). Naturally, it does not help that this process is not standardized so every single financial institution does their own thing.. [1]https://home.treasury.gov/policy-issues/financial-sanctions/faqs/topic/1501/print https://home.treasury.gov/policy-issues/financial-sanctions/...
deleted 4y ago
[deleted]
GoblinSlayer 4y ago
Windows keys use digits, consonants and Y, but then they have sequences like BKDR, F7CK, GYMP and 666.
fps_doug 4y ago
What a time to be alive where you have to worry about how you generate your license keys as to not be labeled a terrorist.
- mcv 4y ago
  Why is the license key in the payment description? The description should just be "update license key", and not contain the actual key.
  - rvba 4y ago
    If you buy multiple keys it makes life easier - you know which payment is for which key and for which invoice. This way you have an unique identifier to match them. Without unique identifiers you have big problems. The payment description should at least mention the invoice number or order number. Undescriptive descriptions are terrible when you need to check / match something. Even a human will have problems not to mention autimatic systems. And automationg is something one could expect from decent systems. No manual checks. No ambiguity.
- hnlmorg 4y ago
  It also begs the question: would actual terrorists put the name of their organisation in any of their financial transactions? I know you should never underestimate human stupidity but even taking that into account this still feels like security theatre on the part of PayPal.
  - epgui 4y ago
    I think they might. Maybe not all and always, but a thing about terrorists which can be quite mind boggling at times is that not everyone seems to agree who they are. Just look at how many countries are still doing business with Russia and other countries with less-than-stellar reputations. There may be plenty of parties who would actually not mind doing business with disreputable entities, for various reasons. I would assume they'd try to be a bit clever, but I wouldn't be surprised to see lax controls.
ht85 4y ago
Alternating digits and letters seems easy and robust. That is until you get unlucky entropy and send some 1337ed out curse words :p

by float4 4y ago

blueflow 4y ago

You cant. Insane people will always find hidden codes and dog-whistles in your messages.

jrochkind1 4y ago

> what's the best way to generate "safe" license keys? In the library (like the kind with books) field where I work, one identifier standard was devised that intentionally has alternating letters and digits, with never more than two letters in a row. Explicitly for the intention of avoiding the possibility of any meaningful words (that might end up being offensive or just off-putting in an undesirable way.) It does make the identifiers longer for the same entropy/byte width, compared to a more normal BASE-X with an alphabet. Which mattered to me when they were going to be used in a URL, although probably doesn't for a license key. I personally in my projects stopped using this system for a more straightforward "Ascii-85" like encoding (which can contain coincidental meaningful words), because it was more convenient. The particular system the library community was using [https://n2t.net/e/noid.html https://n2t.net/e/noid.html] was, I still think, over-complicated for at least my needs, but the alternating letter/number schema seems attractive to me now and perhaps worth slightly more characters in identifiers and slightly more complex algorithm for creation than a simple base-x encoding.

cromulent 4y ago
It sounds good, but of course for "security" it might not be enough. 626f6d62 is alternating letters and digits, with never more than two letters in a row. And it spells "bomb" when converted from hex to ascii. Some security scanners do check for this kind of thing.
- jrochkind1 4y ago
  Why would you convert an identifier to ascii as if it were hex? And it seems unlikely that (eg) paypal would do so? But, sure, it's just one idea. You can add more layers to make it even less likely something will seem problematic to someone somewhere; a 100% guarantee seems impossible, especially if you are going to allow things like above "What if we brainstorm for a way this could be a puzzle where the answer is a problematic word to someone". No "scanner" will even possibly catch every possible thing in that domain, no matter how unlikely.
- GoblinSlayer 4y ago
  Store it as a brainfuck program that generates the required string.
  - crazygringo 4y ago
    For the user to type in as a license key? That's a special kind of evil...

A4ET8a8uTh0 4y ago

edit: Tbh. The more I think about it, maybe it is not such a far fetched idea after all with the assumption that they keys are temporary. ** Eh. Coming from that environment, it would not be that easy for a reason that has nothing to do with technology. The lists that financial companies use are largely known ( some published by US Treasury for everyone to use ) and you can reasonably estimate a threshold most institutions will find acceptable. However, the issue is political and not technical. OFAC itself has grown its SDN list[1] to 6300 names and that is just one list and the tool has been already severely overutilized ( in my opinion anyway, so take that with a grain of salt ), but if the trend and current geopolitical situation is any guide, this number will only increase. What I am saying is that you have a big and very variable base to build a key from ( edit: come to think of it - not from:P ) and there is no guarantee and old key won't suddenly become 'hot'. Here, the answer is to the problem is actually political. Affected businesses have to start really complaining, if they are affected by the requirements. I have no evidence suggesting that is the case ( based on what I saw maybe 20% of transactions face that kind of scrutiny and even smaller percentage is questioned the way the OP is ). Naturally, it does not help that this process is not standardized so every single financial institution does their own thing.. [1]https://home.treasury.gov/policy-issues/financial-sanctions/faqs/topic/1501/print https://home.treasury.gov/policy-issues/financial-sanctions/...

deleted 4y ago

[deleted]

GoblinSlayer 4y ago

Windows keys use digits, consonants and Y, but then they have sequences like BKDR, F7CK, GYMP and 666.

fps_doug 4y ago

What a time to be alive where you have to worry about how you generate your license keys as to not be labeled a terrorist.

mcv 4y ago
Why is the license key in the payment description? The description should just be "update license key", and not contain the actual key.
- rvba 4y ago
  If you buy multiple keys it makes life easier - you know which payment is for which key and for which invoice. This way you have an unique identifier to match them. Without unique identifiers you have big problems. The payment description should at least mention the invoice number or order number. Undescriptive descriptions are terrible when you need to check / match something. Even a human will have problems not to mention autimatic systems. And automationg is something one could expect from decent systems. No manual checks. No ambiguity.
hnlmorg 4y ago
It also begs the question: would actual terrorists put the name of their organisation in any of their financial transactions? I know you should never underestimate human stupidity but even taking that into account this still feels like security theatre on the part of PayPal.
- epgui 4y ago
  I think they might. Maybe not all and always, but a thing about terrorists which can be quite mind boggling at times is that not everyone seems to agree who they are. Just look at how many countries are still doing business with Russia and other countries with less-than-stellar reputations. There may be plenty of parties who would actually not mind doing business with disreputable entities, for various reasons. I would assume they'd try to be a bit clever, but I wouldn't be surprised to see lax controls.

ht85 4y ago

Alternating digits and letters seems easy and robust. That is until you get unlucky entropy and send some 1337ed out curse words :p