3 ms·

There's a term I saw all over someone's Google calendar schedule, pre-pandemic "DNS without asking". Now I realize it means "Do not schedule without asking" but

by 0xWTF 1y ago

There's a term I saw all over someone's Google calendar schedule, pre-pandemic "DNS without asking". Now I realize it means "Do not schedule without asking" but my mind thought "Domain Name Service without asking" ... how in the hell would you do that? I guess this is similar: how do you make trustworthy decisions that seem to inherently depend on the network, in the absence of a network? Before the internet, we had phonebooks instead of DNS, and we had cash instead of cards. Did the phonebook have every number? No. Was every piece of cash not counterfeit? No. But it's "good enough". Portable reference sources and tokens. The references are issued periodically and the tokens have evidence of exhaustion, their decay over time. A dog-eared dollar with a bunch of phone numbers on it, half-torn ... the merchant doesn't have to accept it. How do you do these things digitally? Periodic issue seems pretty straightforward ... if you have a network. Token issuance, similarly, needs at least occasional communication with other nodes in the network. So there's a local dwell capability. Is this part of the same reaction we saw with Denmark starting to have emergency stores within 50 km of every Dane? Is this motivated by a need to prepare for war?

darig 1y ago
[dead]
pizzalife 1y ago
>Is this motivated by a need to prepare for war? In short, yes. >The possibility to pay by card when the internet is not working – ‘so-called offline payments’ – is an area that ‘the Riksbank believes needs to be improved considerably, particularly in light of the geopolitical unease in the world,’ according to the announcement https://www.riksbank.se/en-gb/press-and-published/notices-and-press-releases/press-releases/2025/global-environment-puts-pressure-on-payments-system-resilience/ https://www.riksbank.se/en-gb/press-and-published/notices-an...
lxgr 1y ago
We know exactly how to do these things digitally. Many European countries have had stored-value payment schemes in the 90s. Japan still does today. It's a completely solved problem, but it's a more complex (and as such more expensive) solution than just assuming ubiquitous connectivity and a backend that never goes down, which is how we got to where we are. > Is this motivated by a need to prepare for war? Preparing for cyberattacks seems like a prudent move, no matter the adversaries' motivation. But yes, the context here is pretty obvious in Europe.
- silverliver 1y ago
  > We know exactly how to do these things digitally. Many European countries have had stored-value payment schemes in the 90s. Japan still does today. But how do they prevent people double spending the same amount? Say someone has 100$ and boards on a plane. During the trip, this person buys a bag of potato chips sold for 90$. At the same time, his bank account is automatically charged 90$ for a bill. With credit cards, handling this case is baked into the system. As far as I am aware, direct debt has no equivalent.
  - pas 1y ago
    ... information theoretically... you can't it's okay there's already some fraud, waste, loss, inefficiencies, accidents (packages lost, chargebacks by mistake, package arrives weeks later) .... that said the chips have some physical protection, it's not trivial to clone them and the chip has a variable where it stores how much more you can use without online confirmation of course, these are cheap protective measures, but to crack it you would need more effort probably than the total credit that's assigned for offline spending
    - lxgr 1y ago
      What's the information theory connection in your view? > these are cheap protective measures, They're holding up extremely well. I'm not aware of any cryptographic or physical key extraction compromise in EMV, for example. All known bugs are protocol design oopsies, as far as I'm aware.
      - pas 1y ago
        since the key is there it's not impossible to extract it in theory
  - lxgr 1y ago
    > But how do they prevent people double spending the same amount? Both payment cards and merchant terminals (essentially also using embedded or removable smartcards) are tamper-resistant and hold symmetric keys only known to the payment scheme or issuer. The terminal essentially creates a cryptographic secure channel between two smartcards, and they transactionally agree to decrement the balance on one, and increment the one on the other correspondingly. The really neat thing is that this theoretically even works without the need for central accounts, and is as such very privacy friendly. (Practically, even just one key leaking would have catastrophic consequences though, and to detect whether that has happened, systems usually aggregate all transactions asynchronously and check money movements for plausibility.)

by 0xWTF 1y ago

darig 1y ago

[dead]

pizzalife 1y ago

>Is this motivated by a need to prepare for war? In short, yes. >The possibility to pay by card when the internet is not working – ‘so-called offline payments’ – is an area that ‘the Riksbank believes needs to be improved considerably, particularly in light of the geopolitical unease in the world,’ according to the announcement https://www.riksbank.se/en-gb/press-and-published/notices-and-press-releases/press-releases/2025/global-environment-puts-pressure-on-payments-system-resilience/ https://www.riksbank.se/en-gb/press-and-published/notices-an...

lxgr 1y ago

We know exactly how to do these things digitally. Many European countries have had stored-value payment schemes in the 90s. Japan still does today. It's a completely solved problem, but it's a more complex (and as such more expensive) solution than just assuming ubiquitous connectivity and a backend that never goes down, which is how we got to where we are. > Is this motivated by a need to prepare for war? Preparing for cyberattacks seems like a prudent move, no matter the adversaries' motivation. But yes, the context here is pretty obvious in Europe.

silverliver 1y ago
> We know exactly how to do these things digitally. Many European countries have had stored-value payment schemes in the 90s. Japan still does today. But how do they prevent people double spending the same amount? Say someone has 100$ and boards on a plane. During the trip, this person buys a bag of potato chips sold for 90$. At the same time, his bank account is automatically charged 90$ for a bill. With credit cards, handling this case is baked into the system. As far as I am aware, direct debt has no equivalent.
- pas 1y ago
  ... information theoretically... you can't it's okay there's already some fraud, waste, loss, inefficiencies, accidents (packages lost, chargebacks by mistake, package arrives weeks later) .... that said the chips have some physical protection, it's not trivial to clone them and the chip has a variable where it stores how much more you can use without online confirmation of course, these are cheap protective measures, but to crack it you would need more effort probably than the total credit that's assigned for offline spending
  - lxgr 1y ago
    What's the information theory connection in your view? > these are cheap protective measures, They're holding up extremely well. I'm not aware of any cryptographic or physical key extraction compromise in EMV, for example. All known bugs are protocol design oopsies, as far as I'm aware.
    - pas 1y ago
      since the key is there it's not impossible to extract it in theory
- lxgr 1y ago
  > But how do they prevent people double spending the same amount? Both payment cards and merchant terminals (essentially also using embedded or removable smartcards) are tamper-resistant and hold symmetric keys only known to the payment scheme or issuer. The terminal essentially creates a cryptographic secure channel between two smartcards, and they transactionally agree to decrement the balance on one, and increment the one on the other correspondingly. The really neat thing is that this theoretically even works without the need for central accounts, and is as such very privacy friendly. (Practically, even just one key leaking would have catastrophic consequences though, and to detect whether that has happened, systems usually aggregate all transactions asynchronously and check money movements for plausibility.)