10 ms·

Flipper Zero banned by Amazon for being a ‘card skimming device’

149 points by nazgulsenpai 4y ago

Woeps 4y ago
Now watch Amazon bring out their own knock-off, just like they do with other products
- qbasic_forever 4y ago
  It would not shock me to see some Amazon IoT gadgets have a TI CC1101 chip inside them (what powers the flipper). It's a very common line of chips for wireless comms on sub-ghz bands.
  - myself248 4y ago
    What would be hilarious is a firmware mod for an Echo or something that turns it into a Flipper...
- theshrike79 4y ago
  The Flipper Zero is not about the hardware, all of it is literally off-the-shelf stuff. It's about the software inside + the community around it. A random Amazon Choice Bezos Zero won't work.
heyflyguy 4y ago
That's interesting. I have a site I visit about once every three months that requires a mag key and three different keyfobs. I had been looking at this as a fun way to declutter my access into this facility.
qbasic_forever 4y ago
That's wild, isn't the flipper basically just a TI CC1101 wireless dev board? Is Amazon going to ban every TI wireless board next?
- deleted 4y ago
  [deleted]
- weego 4y ago
  This line of logic just results in the 'guns don't kill, people do' argument.
  - mkmk3 4y ago
    For sure, but its more like knives instead of guns it seems
  - qbasic_forever 4y ago
    What? That is a legitimately insane leap of logic to infer from what I said. The TI CC series of wireless chips are _decades_ old and in use with thousand and thousands of devices. You almost certainly are surrounded by multiple CCxxxx chips _right now_ in any little wireless remote control or iot gadget. These are extremely common chips and banning the flipper because it's a hacking device or whatever is just silly since it's not any more problematic than the TI CC wireless dev boards and devices.
  - jstanley 4y ago
    Even if that were true, the fact that an argument leads to a conclusion you don't like is not sufficient to invalidate the argument.
- Cthulhu_ 4y ago
  I mean theoretically you can make a card skimmer with pretty much any programmable interface, just like how you can make a gun out of anything that can hold gunpowder, or kill someone with anything pointy. I'm no policy maker, but I'm sure the convenience is the deciding factor. This device allows amateurs to perform a wide range of sophisticated security breaching tasks, for example.
- Closi 4y ago
  I think the fact flipper is designed to do things such as read/emulate NFC cards may make it different to selling the raw dev-board. i.e. Selling air-duster to dust things is different to selling air-duster to get high, even if it's the same product you are selling.
mikro2nd 4y ago
"funds may be permanently held" How is this at all legal? eta: As a non-US person, I honestly find this incomprehensible. If you've taken the customers' money and the goods have been supplied, then the middleman hanging on to that money is called theft in most parts of the world.
- doikor 4y ago
  By having more lawyers/money and thus being able to drag it in courts until the other side is bankrupt.
  - mikro2nd 4y ago
    Agreed that that's the tactic, it still doesn't make it legal.
    - deleted 4y ago
      [deleted]
    - anon_fren 4y ago
      [dead]
    - ilyt 4y ago
      So the question should be "how they can get away with it"
      - pjc50 4y ago
        By having more lawyers/money and thus being able to drag it in courts until the other side is bankrupt. (well, the underlying problem is that the US takes an extremely caveat emptor attitude to consumer protection and almost everyone in politics would rather play high stakes culture war issues than deal with boring stuff like making sure that corps can't rip people off)
- Woeps 4y ago
  Wait, did I get it correctly that they're holding the money of customers? Wonder if the customer can then just challenge this in a small claims court as a European (if your country has something like this.)
Bluecobra 4y ago
This ban makes no sense when at the same time Amazon sells USB magnetic stripe card readers: https://www.amazon.com/MSR90-Magnetic-Credit-Reader-Deftun/dp/B01DUB4GVO https://www.amazon.com/MSR90-Magnetic-Credit-Reader-Deftun/d... Owning one of these or a Flipper Zero doesn’t make you a criminal.
- Cthulhu_ 4y ago
  Amazon isn't saying that either, it just doesn't want to be associated with it, just like how you can't buy guns at Amazon... I... assume... wait, can you buy guns via Amazon in the US?
  - anon_fren 4y ago
    Legally they could, but that be too American for a chinese BLM company to do.
  - bombcar 4y ago
    Interstate firearm sales have billions of laws that Amazon doesn't want to get involved in. You can't buy guns from Amazon. You can buy gun-related items like magazines and such, and there are some things like knives that say "cannot be shipped to New York" and similar. There are some air rifles that could incapacitate small animals: https://www.amazon.com/Benjamin-Bulldog-Sportsmans-Pack-Rifle/dp/B0196RQ1B4 https://www.amazon.com/Benjamin-Bulldog-Sportsmans-Pack-Rifl... (3000 psi!)
    - stametseater 4y ago
      > You can buy gun-related items like magazines and such Magazines are banned. Some other accessories are permitted, like holsters, night vision scopes, devices to reload magazines except for those designed to reload magazines for these specific rifle cartriges: .223/5.56, 7.62x51, 308, 7.62x39, 5.45x39. Ejection port covers are banned, but butt plates are not. You can read these arcane rules here: https://sellercentral.amazon.com/help/hub/reference/external/G200164950 https://sellercentral.amazon.com/help/hub/reference/external... Incidentally this is the rule set under which flipper was apparently banned: https://sellercentral.amazon.com/help/hub/reference/external/G200164850 https://sellercentral.amazon.com/help/hub/reference/external... Bans: Lockpicking devices, Devices designed to duplicate a key, Shoplifting devices, Card skimming devices, Code grabbing devices, Master keys or skeleton keys.
lolinder 4y ago
> However, not all Flipper Zero potential buyers will be upset by the Amazon ban since those selling it on Amazon were doing it at a markup. If you want to buy a Flipper Zero, you can still get one from the maker's official store, which gets restocked regularly. In other words, all the listings were unofficial resellers, none belonged to the people behind the hardware. Also, I can kind of see Amazon's point. Not that hardware like this shouldn't exist—I've been sorely tempted to buy one myself, because it looks like a lot of fun!—but if Amazon doesn't want to sell pentesting tools (just like they don't want to sell lock picks), that seems reasonable to me.
- wkat4242 4y ago
  They sell a lot of lockpicks here in Spain actually
  - meepmorp 4y ago
    I'm in the US and I've bought lockpicks at Amazon
    - stametseater 4y ago
      Lockpicks are officially banned on amazon, but as you can expect Amazon is pretty bad at enforcing their own rules consistently and in a timely manner: https://sellercentral.amazon.com/help/hub/reference/external/G200164850 https://sellercentral.amazon.com/help/hub/reference/external...
      - mmh0000 4y ago
        I mean... "officially banned", but here's literally thousands of kits to buy: https://www.amazon.com/s?k=lock+pick+set&crid=28MGQBDLXRA2J&sprefix=lock+pick+se%2Caps%2C131&ref=nb_sb_noss_2 https://www.amazon.com/s?k=lock+pick+set&crid=28MGQBDLXRA2J&... One a side note; banning tools that reveal weak security is the stupidest security-through-obscurity ever.
        4y ago
colordrops 4y ago
Good thing I let my Amazon Prime subscription expire. I've found that life hasn't really been any more difficult without them. The main thing they did was reduce friction and make shipping more predictable and quick. But with password managers automating account creation and login, the friction isn't that bad anymore. And do I really need things in a day or two? Also, I found that getting products directly from manufacturers has ensured better quality. I've also been spending a lot less money.
xnx 4y ago
Amazon can sell/not-sell whatever it wants, but I'm not sure what internal policy allows for selling lock-pick kits (solely intended for opening locks without a key), but not small handheld computers (multiple functions).
- lolinder 4y ago
  https://sellercentral.amazon.com/help/hub/reference/external/G200164850 https://sellercentral.amazon.com/help/hub/reference/external... Do you have an example of products they allow that violate this rule? Flipper Zero isn't just a small handheld computer. How it's marketed makes a big difference in how it will be used, and it's explicitly intended for pentesters. That's great, and I'm glad it exists, but it's perfectly consistent for Amazon to decide they don't want to sell it.
  - xnx 4y ago
    Thanks for sharing. It looks like Amazon's policy only allows for blank keys, but many of the prohibited devices are available for sale? https://www.amazon.com/lock-picks/s?k=lock+picks https://www.amazon.com/lock-picks/s?k=lock+picks
  - ilyt 4y ago
    https://www.amazon.com/Household-Maintenance-Accessory-Precision-Combination/dp/B0BZQ1XQ83/ref=sr_1_2?crid=1DZAYSLIB1E4Y&keywords=lockpick&qid=1680879024&sprefix=lockp%2Caps%2C652&sr=8-2 https://www.amazon.com/Household-Maintenance-Accessory-Preci... https://www.amazon.com/Relnemul-Outdoor-School-Locker-Brass/dp/B0C1GS8ZXY/ref=sr_1_3?crid=1DZAYSLIB1E4Y&keywords=lockpick&qid=1680879134&sprefix=lockp%2Caps%2C652&sr=8-3 https://www.amazon.com/Relnemul-Outdoor-School-Locker-Brass/... https://www.amazon.com/Performance-Tool-5Pc-Hook-Pick/dp/B0B831J7JZ/ref=sr_1_9?crid=1DZAYSLIB1E4Y&keywords=lockpick&qid=1680879134&sprefix=lockp%2Caps%2C652&sr=8-9&th=1 https://www.amazon.com/Performance-Tool-5Pc-Hook-Pick/dp/B0B... Search for lockpick shows this: https://imgur.com/a/Qgg73av https://imgur.com/a/Qgg73av Might be US thing tho
- Cthulhu_ 4y ago
  I wonder if the recent spat of car thefts is related to this; I'm sure the Flipper could be used to perform some attacks on cars. I mean so can a lockpick, but just a lockpick won't start a car these days and if you just want to get into a car, a brick also works.
excalibur 4y ago
Weird, I thought they were cool but never seriously considered purchasing one before, and now I suddenly have to have one.
nfriedly 4y ago
Oh wow, it's actually in stock on the official website! https://shop.flipperzero.one/ https://shop.flipperzero.one/ I've kinda wanted one for a while, but the 3-4 times I've looked in the past, it was always sold out. And it was always listed at scalper-level prices on Amazon and ebay. I thought maybe they had stopped making the device.
- deleted 4y ago
  [deleted]
- whalesalad 4y ago
  I ordered one the last time they came in stock just for a rainy day. It's still in the box, untouched aside from opening to take a look. Real nice packaging. Haven't found a direct need for it yet but I am sure the time will come.
  - birdyrooster 4y ago
    lol same I was just happy to get it at msrp
  - eddieroger 4y ago
    I'm like you, but mine has come out of the box. I've turned my TV on and off a few times, and test scanned a handful of my Amiibo. A fun toy, but still waiting for the use case that has me playing with it more often.
    - deleted 4y ago
      [deleted]
  - csdvrx 4y ago
    Killer usecase for me: it replaced all my remotes - including for AC, windows shades and garage doors.
  - seaners 4y ago
    Kinda the same. I opened it and loaded one of the jailbroken OSs but haven't had much use for it.
Rebelgecko 4y ago
Can I clone my credit cards onto my flipper zero? Or is Amazon hallucinating features that don't exist?
- lolinder 4y ago
  They're probably using a generous interpretation of card skimmer to ban a device that is in a category they didn't think to explicitly ban before.
- kweks 4y ago
  The Flipper can read the PAN (card digits + expiry) that are exposed by cards that have "tap to pay". This is an unencrypted interface supplied by the cards, which means it is readable by any NFC-enabled device (including any android device...) This interface is different from the EMV (payment) interface, which is encrypted. The Flipper cannot clone EMV cards. The problem here is that cards transmit their card info to anyone who asks, not that Flipper is a malicious device.
  - xur17 4y ago
    I thought tap to pay used a one time code? Or are you saying tap to pay uses the PAN + a one time code?
    - kweks 4y ago
      There are two different interfaces. One exposes the number + name + expiry over unencrypted ISO 14443 interface. Readable by any compatible reader (IE, every NFC enabled téléphone - https://www.apkmonk.com/app/com.github.devnied.emvnfccard/ https://www.apkmonk.com/app/com.github.devnied.emvnfccard/) The EMV / payment interface is a different interface and fully encrypted.
      - xur17 4y ago
        And all cards support both??
  - 4y ago
annoyingnoob 4y ago
I thought that the Flipper team was in Russia. Aren't they kind of under sanctions right now? Web site shows a Delaware address but all job ads are in Cyrillic.
- bombcar 4y ago
  If the actual pipeline for sales goes China -> US affiliate, they avoid sanctions. Now all the money they get from selling in the USA may be stuck in the USA until such time as the sanctions end, but there are methods more or less legal to route around that.
zxcvbn4038 4y ago
Arguably Amazon has done more damage to my wallet then Flipper Zero.
PM_me_your_math 4y ago
A buddy has one. He said it a ton of fun to mess with. We both agreed that it is a liability.
fortran77 4y ago
I recommend only buying Flipper Zero from the official source. There are too many scams out there for this device. In many cases--like the vendors in Instagram--you don't get a device at all! You'll get a fake letter saying that your device was "seized by customs." (I imagine people who order from Amazon will receive some sort of actual device.) https://www.reddit.com/r/flipperzero/comments/y27qi4/important_beware_of_the_scams/ https://www.reddit.com/r/flipperzero/comments/y27qi4/importa...
- jstarfish 4y ago
  You sure the Customs letters are scams? Customs does seize stuff, and I've gotten those letters when buying drugs from abroad with no reason to question the seller's integrity-- they usually reshipped without incident, marking the package as something less honest the second time. The "scam" is run by Customs themselves in that they want you to admit on record that you're importing something illegal before they release it ;)
  - fortran77 4y ago
    > You sure the Customs letters are scams? Yes, I'm sure. People were getting letters on badly reproduced letterhead with mispellings
whoisburbansky 4y ago
This post kind of worked out great for me, since they've been out of stock on their main website every time I've tried to get one, but it looks like they're back now and I was able to make an order. Wouldn't have realized without this post reminding me to go check, so talk about silver linings, haha!
- bhhaskin 4y ago
  Same for me! I likely wouldn't have ordered one if it wasn't for this post.
mmh0000 4y ago
Damnit Hacker News! I'm trying to save money, now I'm out $170. Why would you do this to me!?
- livinglist 4y ago
  lol same, I have always wanted one but for the past couple of months, every time I checked they were out of stock, so I kinda just gave up until this post showed up.
Sparkyte 4y ago
Shit boys what are they going to do about those NFC phones with type-c adapters modders can just discretely turn those into skimming devices and often for less than a Flipper Zero.
neilv 4y ago
eBay has also banned Flipper Zero in recent months. I tried to sell a Flipper Zero on eBay twice. The second time that they canceled my sale, they explained it was banned because the Flipper Zero can be used to clone RFID tags. I wonder whether someone in govt/business spoke to eBay and Amazon specifically about the Flipper Zero, or staff was proactively looking for SKUs to ban, or someone is reporting listings and then staff decides it's banned.
- squarefoot 4y ago
  > they explained it was banned because the Flipper Zero can be used to clone RFID tags. Meanwhile... https://www.ebay.com/itm/185771423356 https://www.ebay.com/itm/185771423356 https://www.ebay.com/itm/403393330921 https://www.ebay.com/itm/403393330921 And there are others, including multiple ways to build one using generic hardware that they have no way to block without harming their own business.
- TMWNN 4y ago
  >eBay has also banned Flipper Zero in recent months. I see many Flipper Zero listings, both current and sold. <https://www.ebay.com/sch/i.html?_from=R40&_nkw=flipper+zero&_sacat=0&_sop=12 https://www.ebay.com/sch/i.html?_from=R40&_nkw=flipper+zero&...> Maybe the ban has been lifted?
  - neilv 4y ago
    This has been going on for months. eBay doesn't block it from being listed, but often removes it within hours. Some of those listings will get canceled before purchase. Some listings might sell before whatever eBay mechanism cancels listings, at least initially. But I've heard of eBay canceling sales that have already happened, regardless of whether payment happened or shipment happened. (I bet eBay would refund the buyer's money, but it could be at least a small headache for the buyer, and a bigger problem for the seller. The buyer headache could also get bigger, if the buyer is honest, and especially if there are bureaucratic mess-ups by others who are confused by the unusual situation and suspect that the honest buyer was defrauding. Never underestimate the power of incompetence/indifference to make a shocking amount of trouble for others.) (Side note, as someone from a startup that intentionally used unclonable/cloning-resistant tags, because we knew we needed to defend against cloning, and which is why I bought a Flipper Zero multi-tool in the first place... I suppose that eBay trying to ban electronics that can, among other abilities, clone RFID tags, is a response to legacy systems that didn't have cloning in their threat model. And/or a response to various half-baked new projects that totally ignore threats that they should know about (which is almost the norm lately). Maybe banning tools in this case is a responsible mitigation for legacy systems that can't handle current threats, and I can't fault eBay for not wanting to get involved in that mess. But it's unfortunate for people who are trying to design and build systems responsibly, yet have trouble getting the tools they need for their work.)
mikece 4y ago
Does that mean the resale value of the Flipper Zero just went way up??
s09dfhks 4y ago
How soon till amazon sells the "Amazon basics pen testing device"
- javajosh 4y ago
  With the little "Amazon's Choice" label on it, too.
dogma1138 4y ago
Flipper Zero cannot be used to skim credit cards…
- _8j50 4y ago
  It can, it just can't get cvv code, zip code,etc... emv chip on cards is readable nfc
  - dogma1138 4y ago
    The EMV chip is readable but it would only provide you with the information needed to start an authenticated transaction with the card - basically the type and issuer of the card. No cardholder data nor anything else that is sensitive will be presented over NFC without authentication.
    - _8j50 4y ago
      Wth? I use the flipper to read my cards info all the time. Get it and find out for yourself. The scripts to do this are also open source.
- jeffalyanak 4y ago
  The official firmware prevents some readable data from being displayed, but it's true that people can read some additional CC data with alternative firmware.
  - dogma1138 4y ago
    None of the CHD data or anything of value can be read, to get access to anything of value other than the type and issuer of the card you need to authenticate which means that you need a set of keys which so far have been pretty difficult to get…
    - jeffalyanak 4y ago
      There are a lot of different standards out there and the security differs widely between them, in some cases a name, number, and expiry are all you need to make a purchase. When testing with my own cards, I was able to read card number, expiry, and currency which is enough in many countries for it to be considered a card skimmer.
FounderBurr 4y ago
These devices violate the master merchant agreement terms of service for all the card networks. Amazon has long turned a blind eye being such a huge processor. Interesting to see even they may have to finally cowtow to the card brands.
TrapLord_Rhodo 4y ago
well... They did let it sale through the hype. Now that the hype train has departed, Amazon wants some plausable deniability in a future where some teenager uses a flipper to hack a sensitive system. The flipper is honestly amazing. I consistently use it to get into my friends apartment, he keeps changing the code and he thinks i'm a wizard. Maybe one day i'll show him flipper, but the running joke is too good.

149 points by nazgulsenpai 4y ago

Woeps 4y ago

Now watch Amazon bring out their own knock-off, just like they do with other products

qbasic_forever 4y ago
It would not shock me to see some Amazon IoT gadgets have a TI CC1101 chip inside them (what powers the flipper). It's a very common line of chips for wireless comms on sub-ghz bands.
- myself248 4y ago
  What would be hilarious is a firmware mod for an Echo or something that turns it into a Flipper...
theshrike79 4y ago
The Flipper Zero is not about the hardware, all of it is literally off-the-shelf stuff. It's about the software inside + the community around it. A random Amazon Choice Bezos Zero won't work.

heyflyguy 4y ago

That's interesting. I have a site I visit about once every three months that requires a mag key and three different keyfobs. I had been looking at this as a fun way to declutter my access into this facility.

qbasic_forever 4y ago

That's wild, isn't the flipper basically just a TI CC1101 wireless dev board? Is Amazon going to ban every TI wireless board next?

deleted 4y ago
[deleted]
weego 4y ago
This line of logic just results in the 'guns don't kill, people do' argument.
- mkmk3 4y ago
  For sure, but its more like knives instead of guns it seems
- qbasic_forever 4y ago
  What? That is a legitimately insane leap of logic to infer from what I said. The TI CC series of wireless chips are _decades_ old and in use with thousand and thousands of devices. You almost certainly are surrounded by multiple CCxxxx chips _right now_ in any little wireless remote control or iot gadget. These are extremely common chips and banning the flipper because it's a hacking device or whatever is just silly since it's not any more problematic than the TI CC wireless dev boards and devices.
- jstanley 4y ago
  Even if that were true, the fact that an argument leads to a conclusion you don't like is not sufficient to invalidate the argument.
Cthulhu_ 4y ago
I mean theoretically you can make a card skimmer with pretty much any programmable interface, just like how you can make a gun out of anything that can hold gunpowder, or kill someone with anything pointy. I'm no policy maker, but I'm sure the convenience is the deciding factor. This device allows amateurs to perform a wide range of sophisticated security breaching tasks, for example.
Closi 4y ago
I think the fact flipper is designed to do things such as read/emulate NFC cards may make it different to selling the raw dev-board. i.e. Selling air-duster to dust things is different to selling air-duster to get high, even if it's the same product you are selling.

mikro2nd 4y ago

"funds may be permanently held" How is this at all legal? eta: As a non-US person, I honestly find this incomprehensible. If you've taken the customers' money and the goods have been supplied, then the middleman hanging on to that money is called theft in most parts of the world.

doikor 4y ago
By having more lawyers/money and thus being able to drag it in courts until the other side is bankrupt.
- mikro2nd 4y ago
  Agreed that that's the tactic, it still doesn't make it legal.
  - deleted 4y ago
    [deleted]
  - anon_fren 4y ago
    [dead]
  - ilyt 4y ago
    So the question should be "how they can get away with it"
    - pjc50 4y ago
      By having more lawyers/money and thus being able to drag it in courts until the other side is bankrupt. (well, the underlying problem is that the US takes an extremely caveat emptor attitude to consumer protection and almost everyone in politics would rather play high stakes culture war issues than deal with boring stuff like making sure that corps can't rip people off)
Woeps 4y ago
Wait, did I get it correctly that they're holding the money of customers? Wonder if the customer can then just challenge this in a small claims court as a European (if your country has something like this.)

Bluecobra 4y ago

This ban makes no sense when at the same time Amazon sells USB magnetic stripe card readers: https://www.amazon.com/MSR90-Magnetic-Credit-Reader-Deftun/dp/B01DUB4GVO https://www.amazon.com/MSR90-Magnetic-Credit-Reader-Deftun/d... Owning one of these or a Flipper Zero doesn’t make you a criminal.

Cthulhu_ 4y ago
Amazon isn't saying that either, it just doesn't want to be associated with it, just like how you can't buy guns at Amazon... I... assume... wait, can you buy guns via Amazon in the US?
- anon_fren 4y ago
  Legally they could, but that be too American for a chinese BLM company to do.
- bombcar 4y ago
  Interstate firearm sales have billions of laws that Amazon doesn't want to get involved in. You can't buy guns from Amazon. You can buy gun-related items like magazines and such, and there are some things like knives that say "cannot be shipped to New York" and similar. There are some air rifles that could incapacitate small animals: https://www.amazon.com/Benjamin-Bulldog-Sportsmans-Pack-Rifle/dp/B0196RQ1B4 https://www.amazon.com/Benjamin-Bulldog-Sportsmans-Pack-Rifl... (3000 psi!)
  - stametseater 4y ago
    > You can buy gun-related items like magazines and such Magazines are banned. Some other accessories are permitted, like holsters, night vision scopes, devices to reload magazines except for those designed to reload magazines for these specific rifle cartriges: .223/5.56, 7.62x51, 308, 7.62x39, 5.45x39. Ejection port covers are banned, but butt plates are not. You can read these arcane rules here: https://sellercentral.amazon.com/help/hub/reference/external/G200164950 https://sellercentral.amazon.com/help/hub/reference/external... Incidentally this is the rule set under which flipper was apparently banned: https://sellercentral.amazon.com/help/hub/reference/external/G200164850 https://sellercentral.amazon.com/help/hub/reference/external... Bans: Lockpicking devices, Devices designed to duplicate a key, Shoplifting devices, Card skimming devices, Code grabbing devices, Master keys or skeleton keys.

lolinder 4y ago

> However, not all Flipper Zero potential buyers will be upset by the Amazon ban since those selling it on Amazon were doing it at a markup. If you want to buy a Flipper Zero, you can still get one from the maker's official store, which gets restocked regularly. In other words, all the listings were unofficial resellers, none belonged to the people behind the hardware. Also, I can kind of see Amazon's point. Not that hardware like this shouldn't exist—I've been sorely tempted to buy one myself, because it looks like a lot of fun!—but if Amazon doesn't want to sell pentesting tools (just like they don't want to sell lock picks), that seems reasonable to me.

wkat4242 4y ago
They sell a lot of lockpicks here in Spain actually
- meepmorp 4y ago
  I'm in the US and I've bought lockpicks at Amazon
  - stametseater 4y ago
    Lockpicks are officially banned on amazon, but as you can expect Amazon is pretty bad at enforcing their own rules consistently and in a timely manner: https://sellercentral.amazon.com/help/hub/reference/external/G200164850 https://sellercentral.amazon.com/help/hub/reference/external...
    - mmh0000 4y ago
      I mean... "officially banned", but here's literally thousands of kits to buy: https://www.amazon.com/s?k=lock+pick+set&crid=28MGQBDLXRA2J&sprefix=lock+pick+se%2Caps%2C131&ref=nb_sb_noss_2 https://www.amazon.com/s?k=lock+pick+set&crid=28MGQBDLXRA2J&... One a side note; banning tools that reveal weak security is the stupidest security-through-obscurity ever.
      - 4y ago

colordrops 4y ago

Good thing I let my Amazon Prime subscription expire. I've found that life hasn't really been any more difficult without them. The main thing they did was reduce friction and make shipping more predictable and quick. But with password managers automating account creation and login, the friction isn't that bad anymore. And do I really need things in a day or two? Also, I found that getting products directly from manufacturers has ensured better quality. I've also been spending a lot less money.

xnx 4y ago

Amazon can sell/not-sell whatever it wants, but I'm not sure what internal policy allows for selling lock-pick kits (solely intended for opening locks without a key), but not small handheld computers (multiple functions).

lolinder 4y ago
https://sellercentral.amazon.com/help/hub/reference/external/G200164850 https://sellercentral.amazon.com/help/hub/reference/external... Do you have an example of products they allow that violate this rule? Flipper Zero isn't just a small handheld computer. How it's marketed makes a big difference in how it will be used, and it's explicitly intended for pentesters. That's great, and I'm glad it exists, but it's perfectly consistent for Amazon to decide they don't want to sell it.
- xnx 4y ago
  Thanks for sharing. It looks like Amazon's policy only allows for blank keys, but many of the prohibited devices are available for sale? https://www.amazon.com/lock-picks/s?k=lock+picks https://www.amazon.com/lock-picks/s?k=lock+picks
- ilyt 4y ago
  https://www.amazon.com/Household-Maintenance-Accessory-Precision-Combination/dp/B0BZQ1XQ83/ref=sr_1_2?crid=1DZAYSLIB1E4Y&keywords=lockpick&qid=1680879024&sprefix=lockp%2Caps%2C652&sr=8-2 https://www.amazon.com/Household-Maintenance-Accessory-Preci... https://www.amazon.com/Relnemul-Outdoor-School-Locker-Brass/dp/B0C1GS8ZXY/ref=sr_1_3?crid=1DZAYSLIB1E4Y&keywords=lockpick&qid=1680879134&sprefix=lockp%2Caps%2C652&sr=8-3 https://www.amazon.com/Relnemul-Outdoor-School-Locker-Brass/... https://www.amazon.com/Performance-Tool-5Pc-Hook-Pick/dp/B0B831J7JZ/ref=sr_1_9?crid=1DZAYSLIB1E4Y&keywords=lockpick&qid=1680879134&sprefix=lockp%2Caps%2C652&sr=8-9&th=1 https://www.amazon.com/Performance-Tool-5Pc-Hook-Pick/dp/B0B... Search for lockpick shows this: https://imgur.com/a/Qgg73av https://imgur.com/a/Qgg73av Might be US thing tho
Cthulhu_ 4y ago
I wonder if the recent spat of car thefts is related to this; I'm sure the Flipper could be used to perform some attacks on cars. I mean so can a lockpick, but just a lockpick won't start a car these days and if you just want to get into a car, a brick also works.

excalibur 4y ago

Weird, I thought they were cool but never seriously considered purchasing one before, and now I suddenly have to have one.

nfriedly 4y ago

Oh wow, it's actually in stock on the official website! https://shop.flipperzero.one/ https://shop.flipperzero.one/ I've kinda wanted one for a while, but the 3-4 times I've looked in the past, it was always sold out. And it was always listed at scalper-level prices on Amazon and ebay. I thought maybe they had stopped making the device.

deleted 4y ago
[deleted]
whalesalad 4y ago
I ordered one the last time they came in stock just for a rainy day. It's still in the box, untouched aside from opening to take a look. Real nice packaging. Haven't found a direct need for it yet but I am sure the time will come.
- birdyrooster 4y ago
  lol same I was just happy to get it at msrp
- eddieroger 4y ago
  I'm like you, but mine has come out of the box. I've turned my TV on and off a few times, and test scanned a handful of my Amiibo. A fun toy, but still waiting for the use case that has me playing with it more often.
  - deleted 4y ago
    [deleted]
- csdvrx 4y ago
  Killer usecase for me: it replaced all my remotes - including for AC, windows shades and garage doors.
- seaners 4y ago
  Kinda the same. I opened it and loaded one of the jailbroken OSs but haven't had much use for it.

Rebelgecko 4y ago

Can I clone my credit cards onto my flipper zero? Or is Amazon hallucinating features that don't exist?

lolinder 4y ago
They're probably using a generous interpretation of card skimmer to ban a device that is in a category they didn't think to explicitly ban before.
kweks 4y ago
The Flipper can read the PAN (card digits + expiry) that are exposed by cards that have "tap to pay". This is an unencrypted interface supplied by the cards, which means it is readable by any NFC-enabled device (including any android device...) This interface is different from the EMV (payment) interface, which is encrypted. The Flipper cannot clone EMV cards. The problem here is that cards transmit their card info to anyone who asks, not that Flipper is a malicious device.
- xur17 4y ago
  I thought tap to pay used a one time code? Or are you saying tap to pay uses the PAN + a one time code?
  - kweks 4y ago
    There are two different interfaces. One exposes the number + name + expiry over unencrypted ISO 14443 interface. Readable by any compatible reader (IE, every NFC enabled téléphone - https://www.apkmonk.com/app/com.github.devnied.emvnfccard/ https://www.apkmonk.com/app/com.github.devnied.emvnfccard/) The EMV / payment interface is a different interface and fully encrypted.
    - xur17 4y ago
      And all cards support both??
- 4y ago

annoyingnoob 4y ago

I thought that the Flipper team was in Russia. Aren't they kind of under sanctions right now? Web site shows a Delaware address but all job ads are in Cyrillic.

bombcar 4y ago
If the actual pipeline for sales goes China -> US affiliate, they avoid sanctions. Now all the money they get from selling in the USA may be stuck in the USA until such time as the sanctions end, but there are methods more or less legal to route around that.

zxcvbn4038 4y ago

Arguably Amazon has done more damage to my wallet then Flipper Zero.

PM_me_your_math 4y ago

A buddy has one. He said it a ton of fun to mess with. We both agreed that it is a liability.

fortran77 4y ago

I recommend only buying Flipper Zero from the official source. There are too many scams out there for this device. In many cases--like the vendors in Instagram--you don't get a device at all! You'll get a fake letter saying that your device was "seized by customs." (I imagine people who order from Amazon will receive some sort of actual device.) https://www.reddit.com/r/flipperzero/comments/y27qi4/important_beware_of_the_scams/ https://www.reddit.com/r/flipperzero/comments/y27qi4/importa...

jstarfish 4y ago
You sure the Customs letters are scams? Customs does seize stuff, and I've gotten those letters when buying drugs from abroad with no reason to question the seller's integrity-- they usually reshipped without incident, marking the package as something less honest the second time. The "scam" is run by Customs themselves in that they want you to admit on record that you're importing something illegal before they release it ;)
- fortran77 4y ago
  > You sure the Customs letters are scams? Yes, I'm sure. People were getting letters on badly reproduced letterhead with mispellings

whoisburbansky 4y ago

This post kind of worked out great for me, since they've been out of stock on their main website every time I've tried to get one, but it looks like they're back now and I was able to make an order. Wouldn't have realized without this post reminding me to go check, so talk about silver linings, haha!

bhhaskin 4y ago
Same for me! I likely wouldn't have ordered one if it wasn't for this post.

mmh0000 4y ago

Damnit Hacker News! I'm trying to save money, now I'm out $170. Why would you do this to me!?

livinglist 4y ago
lol same, I have always wanted one but for the past couple of months, every time I checked they were out of stock, so I kinda just gave up until this post showed up.

Sparkyte 4y ago

Shit boys what are they going to do about those NFC phones with type-c adapters modders can just discretely turn those into skimming devices and often for less than a Flipper Zero.

neilv 4y ago

eBay has also banned Flipper Zero in recent months. I tried to sell a Flipper Zero on eBay twice. The second time that they canceled my sale, they explained it was banned because the Flipper Zero can be used to clone RFID tags. I wonder whether someone in govt/business spoke to eBay and Amazon specifically about the Flipper Zero, or staff was proactively looking for SKUs to ban, or someone is reporting listings and then staff decides it's banned.

squarefoot 4y ago
> they explained it was banned because the Flipper Zero can be used to clone RFID tags. Meanwhile... https://www.ebay.com/itm/185771423356 https://www.ebay.com/itm/185771423356 https://www.ebay.com/itm/403393330921 https://www.ebay.com/itm/403393330921 And there are others, including multiple ways to build one using generic hardware that they have no way to block without harming their own business.
TMWNN 4y ago
>eBay has also banned Flipper Zero in recent months. I see many Flipper Zero listings, both current and sold. <https://www.ebay.com/sch/i.html?_from=R40&_nkw=flipper+zero&_sacat=0&_sop=12 https://www.ebay.com/sch/i.html?_from=R40&_nkw=flipper+zero&...> Maybe the ban has been lifted?
- neilv 4y ago
  This has been going on for months. eBay doesn't block it from being listed, but often removes it within hours. Some of those listings will get canceled before purchase. Some listings might sell before whatever eBay mechanism cancels listings, at least initially. But I've heard of eBay canceling sales that have already happened, regardless of whether payment happened or shipment happened. (I bet eBay would refund the buyer's money, but it could be at least a small headache for the buyer, and a bigger problem for the seller. The buyer headache could also get bigger, if the buyer is honest, and especially if there are bureaucratic mess-ups by others who are confused by the unusual situation and suspect that the honest buyer was defrauding. Never underestimate the power of incompetence/indifference to make a shocking amount of trouble for others.) (Side note, as someone from a startup that intentionally used unclonable/cloning-resistant tags, because we knew we needed to defend against cloning, and which is why I bought a Flipper Zero multi-tool in the first place... I suppose that eBay trying to ban electronics that can, among other abilities, clone RFID tags, is a response to legacy systems that didn't have cloning in their threat model. And/or a response to various half-baked new projects that totally ignore threats that they should know about (which is almost the norm lately). Maybe banning tools in this case is a responsible mitigation for legacy systems that can't handle current threats, and I can't fault eBay for not wanting to get involved in that mess. But it's unfortunate for people who are trying to design and build systems responsibly, yet have trouble getting the tools they need for their work.)

mikece 4y ago

Does that mean the resale value of the Flipper Zero just went way up??

s09dfhks 4y ago

How soon till amazon sells the "Amazon basics pen testing device"

javajosh 4y ago
With the little "Amazon's Choice" label on it, too.

dogma1138 4y ago

Flipper Zero cannot be used to skim credit cards…

_8j50 4y ago
It can, it just can't get cvv code, zip code,etc... emv chip on cards is readable nfc
- dogma1138 4y ago
  The EMV chip is readable but it would only provide you with the information needed to start an authenticated transaction with the card - basically the type and issuer of the card. No cardholder data nor anything else that is sensitive will be presented over NFC without authentication.
  - _8j50 4y ago
    Wth? I use the flipper to read my cards info all the time. Get it and find out for yourself. The scripts to do this are also open source.
jeffalyanak 4y ago
The official firmware prevents some readable data from being displayed, but it's true that people can read some additional CC data with alternative firmware.
- dogma1138 4y ago
  None of the CHD data or anything of value can be read, to get access to anything of value other than the type and issuer of the card you need to authenticate which means that you need a set of keys which so far have been pretty difficult to get…
  - jeffalyanak 4y ago
    There are a lot of different standards out there and the security differs widely between them, in some cases a name, number, and expiry are all you need to make a purchase. When testing with my own cards, I was able to read card number, expiry, and currency which is enough in many countries for it to be considered a card skimmer.

FounderBurr 4y ago

These devices violate the master merchant agreement terms of service for all the card networks. Amazon has long turned a blind eye being such a huge processor. Interesting to see even they may have to finally cowtow to the card brands.

TrapLord_Rhodo 4y ago

well... They did let it sale through the hype. Now that the hype train has departed, Amazon wants some plausable deniability in a future where some teenager uses a flipper to hack a sensitive system. The flipper is honestly amazing. I consistently use it to get into my friends apartment, he keeps changing the code and he thinks i'm a wizard. Maybe one day i'll show him flipper, but the running joke is too good.