5 ms·

PayPal bans Linux users with a GPU name containing the string "Apple M1"

123 points by robin_reala 1y ago

leothetechguy 1y ago
Why?
- netsharc 1y ago
  My guess would be they're using some 3rd party library of "fake user agent detection", and this library just has a whitelist of what's "acceptable".
  - rincebrain 1y ago
    Given that the "fix" involves making the string reported "Possibly Apple, Possibly M1", I am going to say it's a blacklist.
    - goku12 1y ago
      There are two ways in which that could happen. Someone entered that combination into the list without thinking it though. Or more likely, they use a self-learning or heuristic filter that finds the combination 'Linux' and 'Apple M1' unusual because of how rare it is. Either way, it's easier to assume a mistake here because such a dark pattern doesn't make any business sense - notwithstanding their ethical reputation.
      - rincebrain 11mo ago
        Sure, I doubt it's anything other than someone eagerly grabbing a list of long tail things and blacklisting them.
- ajb 1y ago
  This is just a guess, but maybe "inconsistent" identifiers are a good signal of being an attack bot instead of a user. Not defending that btw. Auto-generated signals are likely a problem for any desktop Linux user, not just Asahi, since most bots will run on Linux VPSs.
herbst 1y ago
PayPal is the only semi reliable payment method attached to my credit card that doesn't constantly fail payments on my desktop computer. Glad to hear that's going to change as well.
- hulitu 1y ago
  > Glad to hear that's going to change as well. It changed a long time ago.
tgma 1y ago
Probably tripping some client fingerprinting/fraud detection system because it thinks of it as an anomaly mistaking it for a bot or something. Unlikely to be intentional malice against Asahi users.
- Timshel 1y ago
  Yes but shit like this still means that if your hardware is in a minority category you will lose access to services. For a time I couldn't access a number of website because Linux+Firefox was apparently too rare, with Linux+Chrome at least I could pass a captcha (was Akamai I believe).
- chii 11mo ago
  so the question is should fraud protection err on the side of too lenient, allowing _some_ fraud to go thru to ensure zero innocent users get marked? Or should fraud protection err on the side of stringency, where all fraud gets caught, but at the cost of getting innocents blocked too (in some greater number)?
  - tgma 11mo ago
    This is very context-dependent. Since it's PayPal we are talking about, it seems reasonable they err on the side of stringent in some cases.
rnhmjoj 1y ago
I think the real problem is that any website can get a ton of information on your GPU, including vendor, model, supported extensions etc. via WebGL/WebGPU.
- fnands 1y ago
  Yeah, I understand it's probably part of their fraud protection, but feels weird that they get my GPU info when doing a payment. Seems very unrelated. Anyone who works on fraud protection who can explain how this info is used?
  - Tostino 1y ago
    Very likely looking for VMs or other weird signals. Doesn't make it right for a regular user doing nothing wrong.
  - coldtea 1y ago
    The problem is they have the ability to get it to begin with. The browser or OS should prevent this.
  - shelled 1y ago
    Not exactly on the backend, but I worked on the frontend (SDKs) at a previous employer whose product offering was fraud detection literally. Over the period of those years, I realised the team wanted "get whatever you can" and then just kept it and used it as needed. A few things I recall - heuristics, some matches with data sources they had of fraudulent actors, et cetera. I am talking about the time when "AI" as we know it was just picking up, and that company was actually calling these systems ML-backed. They pivoted to "AI" as soon as the term became more commonplace, and in the beginning it was just the name change, but I am sure they'd have changed the systems as well, or I hope so. I can tell you that any kind of "abnormal" combination of system metadata (basically sysinfo) was technically frowned upon by that team, and of course, the system was designed by that team. So, say you had a rooted Android (we had solutions for all devices out there; pretty much) - naughty boy, the system suspected you of spoofing GPS - instant reject, disabling GPS - it was not a mandatory permission in the app (and we asked for it only for some clients) – but it didn't like it, you had changed the default resolution of the system - suspicious, we also captured typing/tapping speed (not only for text entry but also for interacting with the interface) - too fast was considered weird because you were not supposed to have known our interface (because it was interact once or twice in a lifetime or years, kind of thing). I am speaking more from memory of new joinee intros and rare discussions with the team. The team was kinda "different," so other teams just wanted to avoid them and also wanted them to stay away from other teams. So a lot of things might not sound exciting, might not be accurate either and these are not technical observations anyway. Another aspect I just remembered. Say you had an app list (oh, we read that too) that matched with known fraudulent actors datasets, you had app(s) that showed you were not well off (we served a lot of instant loan givers around the world), you had an old phone, your OS was very old – all these things were taken into account, along with your PII (which were of course mandatory), when their backend received the data and we gave the final reco/score to the client's system in the API response.
general1465 1y ago
Why would anyone use PayPal at the first place? I have only negative experiences with them. Constant blocking, freezing account and then unfreezing it with no explanation why it was frozen in the first place just panacea "fraud detection", chargebacks months after the purchase.
- dontlaugh 1y ago
  If you need to split a bill across people from many different countries, there aren’t other options.
  - Vasbarlog 1y ago
    Revolut! There are also pretty high referral bonus (around 80 dollars per referral where I come from). You can ”charge” it using Apple Pay or Google Pay, and it’s very convenient.
    - dontlaugh 1y ago
      Doesn’t work in South Africa, India or Singapore. When you meet up with from people from enough places, there really aren’t many options.
      - general1465 1y ago
        Good news, PayPal works once from these places. then you will get 180 days lock on your account for suspicious transfers.
    - robin_reala 1y ago
      I’ve never been able to consider Revolut since I read Wired’s article on their work practices: https://www.wired.com/story/revolut-trade-unions-labour-fintech-politics-storonsky/ https://www.wired.com/story/revolut-trade-unions-labour-fint...
  - baobun 1y ago
    Cash. Monero.
j-bos 1y ago
That's disastrous, imagine getting cut off from financial services because of being an early adopter.
- em-bee 1y ago
  or using an old device, like one that is, you know, not supported by win 11...
- mid-kid 1y ago
  As a rooted android user, I don't really have to imagine. It's been a constant fight for the last decade...
- general1465 1y ago
  With PayPal you don't need to imagine, you will get cut off randomly just by using it. Oh you have triggered fraud detection, let's waste a week of your time talking to customer support.
  - protimewaster 1y ago
    I finally gave up on PayPal. Years ago, some hardware vendor had a discount for paying via PayPal. I made an account using my real personal info and personal payment cards, and they immediately flagged the account as fraudulent. I put in a support request and, after some back and forth with support, they eventually, what I think was weeks later, marked the account as legitimate. At least, that's what they said they did. That promo was still going, so I tried it again. PayPal still wouldn't let me pay due to being flagged as fraud. In a follow-up with PayPal, they claimed it would take a few days before I could actually use the account. The promo expired at the end of that day, so I just deleted the account and decided PayPal is a waste of time.
ndiddy 1y ago
I'd guess this is due to some Paypal fraud protection thing thinking that Linux on M1 is an "impossible" configuration to have and that anyone with that configuration must be spoofing their hardware. If you click onto the bug she filed, it's also kind of sad/funny that the Mozilla employee responding to it ALSO assumes that nobody can actually run Linux on M1 and renames the bug to "paypal.com - Spoofing as Apple M GPU breaks the login process by triggering a block to the security challenge". It's a shame because Asahi runs really well on M1 & M2. I hope that they're able to get this resolved and that other issues like this don't pop up in the future.
- salawat 11mo ago
  Wouldn't be a problem if everyone wasn't probing every bit of the User's system for their own ends, but given the incentives we've put in place, that ship has sailed.

123 points by robin_reala 1y ago

leothetechguy 1y ago

Why?

netsharc 1y ago
My guess would be they're using some 3rd party library of "fake user agent detection", and this library just has a whitelist of what's "acceptable".
- rincebrain 1y ago
  Given that the "fix" involves making the string reported "Possibly Apple, Possibly M1", I am going to say it's a blacklist.
  - goku12 1y ago
    There are two ways in which that could happen. Someone entered that combination into the list without thinking it though. Or more likely, they use a self-learning or heuristic filter that finds the combination 'Linux' and 'Apple M1' unusual because of how rare it is. Either way, it's easier to assume a mistake here because such a dark pattern doesn't make any business sense - notwithstanding their ethical reputation.
    - rincebrain 11mo ago
      Sure, I doubt it's anything other than someone eagerly grabbing a list of long tail things and blacklisting them.
ajb 1y ago
This is just a guess, but maybe "inconsistent" identifiers are a good signal of being an attack bot instead of a user. Not defending that btw. Auto-generated signals are likely a problem for any desktop Linux user, not just Asahi, since most bots will run on Linux VPSs.

herbst 1y ago

PayPal is the only semi reliable payment method attached to my credit card that doesn't constantly fail payments on my desktop computer. Glad to hear that's going to change as well.

hulitu 1y ago
> Glad to hear that's going to change as well. It changed a long time ago.

tgma 1y ago

Probably tripping some client fingerprinting/fraud detection system because it thinks of it as an anomaly mistaking it for a bot or something. Unlikely to be intentional malice against Asahi users.

Timshel 1y ago
Yes but shit like this still means that if your hardware is in a minority category you will lose access to services. For a time I couldn't access a number of website because Linux+Firefox was apparently too rare, with Linux+Chrome at least I could pass a captcha (was Akamai I believe).
chii 11mo ago
so the question is should fraud protection err on the side of too lenient, allowing _some_ fraud to go thru to ensure zero innocent users get marked? Or should fraud protection err on the side of stringency, where all fraud gets caught, but at the cost of getting innocents blocked too (in some greater number)?
- tgma 11mo ago
  This is very context-dependent. Since it's PayPal we are talking about, it seems reasonable they err on the side of stringent in some cases.

rnhmjoj 1y ago

I think the real problem is that any website can get a ton of information on your GPU, including vendor, model, supported extensions etc. via WebGL/WebGPU.

fnands 1y ago
Yeah, I understand it's probably part of their fraud protection, but feels weird that they get my GPU info when doing a payment. Seems very unrelated. Anyone who works on fraud protection who can explain how this info is used?
- Tostino 1y ago
  Very likely looking for VMs or other weird signals. Doesn't make it right for a regular user doing nothing wrong.
- coldtea 1y ago
  The problem is they have the ability to get it to begin with. The browser or OS should prevent this.
- shelled 1y ago
  Not exactly on the backend, but I worked on the frontend (SDKs) at a previous employer whose product offering was fraud detection literally. Over the period of those years, I realised the team wanted "get whatever you can" and then just kept it and used it as needed. A few things I recall - heuristics, some matches with data sources they had of fraudulent actors, et cetera. I am talking about the time when "AI" as we know it was just picking up, and that company was actually calling these systems ML-backed. They pivoted to "AI" as soon as the term became more commonplace, and in the beginning it was just the name change, but I am sure they'd have changed the systems as well, or I hope so. I can tell you that any kind of "abnormal" combination of system metadata (basically sysinfo) was technically frowned upon by that team, and of course, the system was designed by that team. So, say you had a rooted Android (we had solutions for all devices out there; pretty much) - naughty boy, the system suspected you of spoofing GPS - instant reject, disabling GPS - it was not a mandatory permission in the app (and we asked for it only for some clients) – but it didn't like it, you had changed the default resolution of the system - suspicious, we also captured typing/tapping speed (not only for text entry but also for interacting with the interface) - too fast was considered weird because you were not supposed to have known our interface (because it was interact once or twice in a lifetime or years, kind of thing). I am speaking more from memory of new joinee intros and rare discussions with the team. The team was kinda "different," so other teams just wanted to avoid them and also wanted them to stay away from other teams. So a lot of things might not sound exciting, might not be accurate either and these are not technical observations anyway. Another aspect I just remembered. Say you had an app list (oh, we read that too) that matched with known fraudulent actors datasets, you had app(s) that showed you were not well off (we served a lot of instant loan givers around the world), you had an old phone, your OS was very old – all these things were taken into account, along with your PII (which were of course mandatory), when their backend received the data and we gave the final reco/score to the client's system in the API response.

general1465 1y ago

Why would anyone use PayPal at the first place? I have only negative experiences with them. Constant blocking, freezing account and then unfreezing it with no explanation why it was frozen in the first place just panacea "fraud detection", chargebacks months after the purchase.

dontlaugh 1y ago
If you need to split a bill across people from many different countries, there aren’t other options.
- Vasbarlog 1y ago
  Revolut! There are also pretty high referral bonus (around 80 dollars per referral where I come from). You can ”charge” it using Apple Pay or Google Pay, and it’s very convenient.
  - dontlaugh 1y ago
    Doesn’t work in South Africa, India or Singapore. When you meet up with from people from enough places, there really aren’t many options.
    - general1465 1y ago
      Good news, PayPal works once from these places. then you will get 180 days lock on your account for suspicious transfers.
  - robin_reala 1y ago
    I’ve never been able to consider Revolut since I read Wired’s article on their work practices: https://www.wired.com/story/revolut-trade-unions-labour-fintech-politics-storonsky/ https://www.wired.com/story/revolut-trade-unions-labour-fint...
- baobun 1y ago
  Cash. Monero.

j-bos 1y ago

That's disastrous, imagine getting cut off from financial services because of being an early adopter.

em-bee 1y ago
or using an old device, like one that is, you know, not supported by win 11...
mid-kid 1y ago
As a rooted android user, I don't really have to imagine. It's been a constant fight for the last decade...
general1465 1y ago
With PayPal you don't need to imagine, you will get cut off randomly just by using it. Oh you have triggered fraud detection, let's waste a week of your time talking to customer support.
- protimewaster 1y ago
  I finally gave up on PayPal. Years ago, some hardware vendor had a discount for paying via PayPal. I made an account using my real personal info and personal payment cards, and they immediately flagged the account as fraudulent. I put in a support request and, after some back and forth with support, they eventually, what I think was weeks later, marked the account as legitimate. At least, that's what they said they did. That promo was still going, so I tried it again. PayPal still wouldn't let me pay due to being flagged as fraud. In a follow-up with PayPal, they claimed it would take a few days before I could actually use the account. The promo expired at the end of that day, so I just deleted the account and decided PayPal is a waste of time.

ndiddy 1y ago

I'd guess this is due to some Paypal fraud protection thing thinking that Linux on M1 is an "impossible" configuration to have and that anyone with that configuration must be spoofing their hardware. If you click onto the bug she filed, it's also kind of sad/funny that the Mozilla employee responding to it ALSO assumes that nobody can actually run Linux on M1 and renames the bug to "paypal.com - Spoofing as Apple M GPU breaks the login process by triggering a block to the security challenge". It's a shame because Asahi runs really well on M1 & M2. I hope that they're able to get this resolved and that other issues like this don't pop up in the future.

salawat 11mo ago
Wouldn't be a problem if everyone wasn't probing every bit of the User's system for their own ends, but given the incentives we've put in place, that ship has sailed.