Hacker News Reader

Comment by float4 | Hacker News Reader

> PayPal has restricted our business account because we have invoiced a license key containing the random letter sequence “ALEP”.

This makes me wonder: what's the best way to generate "safe" license keys? Binary feels like an obvious solution (binary keys surely get through virtually all blacklists?) but at the same time: binary license keys would be very long and very atypical, so maybe fraud detection systems mark them as suspicious anyway.

Maybe just generate random alphanum license keys and run them through some open source blacklists yourself? I doubt "ALEP" is in those lists though.

View on HN

> what's the best way to generate "safe" license keys?

In the library (like the kind with books) field where I work, one identifier standard was devised that intentionally has alternating letters and digits, with never more than two letters in a row. Explicitly for the intention of avoiding the possibility of any meaningful words (that might end up being offensive or just off-putting in an undesirable way.)

It does make the identifiers longer for the same entropy/byte width, compared to a more normal BASE-X with an alphabet. Which mattered to me when they were going to be used in a URL, although probably doesn't for a license key. I personally in my projects stopped using this system for a more straightforward "Ascii-85" like encoding (which can contain coincidental meaningful words), because it was more convenient.

The particular system the library community was using [https://n2t.net/e/noid.html] was, I still think, over-complicated for at least my needs, but the alternating letter/number schema seems attractive to me now and perhaps worth slightly more characters in identifiers and slightly more complex algorithm for creation than a simple base-x encoding.

It sounds good, but of course for "security" it might not be enough. 626f6d62 is alternating letters and digits, with never more than two letters in a row. And it spells "bomb" when converted from hex to ascii.

Some security scanners do check for this kind of thing.

Why would you convert an identifier to ascii as if it were hex? And it seems unlikely that (eg) paypal would do so?

But, sure, it's just one idea. You can add more layers to make it even less likely something will seem problematic to someone somewhere; a 100% guarantee seems impossible, especially if you are going to allow things like above "What if we brainstorm for a way this could be a puzzle where the answer is a problematic word to someone". No "scanner" will even possibly catch every possible thing in that domain, no matter how unlikely.

Store it as a brainfuck program that generates the required string.

For the user to type in as a license key?

That's a special kind of evil...

What a time to be alive where you have to worry about how you generate your license keys as to not be labeled a terrorist.

It also begs the question: would actual terrorists put the name of their organisation in any of their financial transactions?

I know you should never underestimate human stupidity but even taking that into account this still feels like security theatre on the part of PayPal.

I think they might. Maybe not all and always, but a thing about terrorists which can be quite mind boggling at times is that not everyone seems to agree who they are. Just look at how many countries are still doing business with Russia and other countries with less-than-stellar reputations. There may be plenty of parties who would actually not mind doing business with disreputable entities, for various reasons. I would assume they'd try to be a bit clever, but I wouldn't be surprised to see lax controls.

"terrorist" is an opinion or a judgment, not an objective fact. A better term in a KYC context "sanctioned entity" or somesuch.

If someone X is comfortable doing business with/as entity Y but a bank Z is not, it's totally sensible that X would say Y to the bank Z and bank Z would block them.

> "terrorist" is an opinion or a judgment

More importantly, "terrorists" is often used by some governments in reference to protesters or any group that they see as unfriendly to them.

It is highly unlikely, but not impossible. Anecdotally, I did see a case of a business that put a real location of the business they are working with, which happened to be in a sanctioned country. Needless to say, it generated all sorts of questions and eventual OFAC contact.

Bottom line is: it happens, but I agree with you that people that know what they are doing are not putting "Pay for assasination by Osama Bin Laden on 03/28/23" in reference field.

> I know you should never underestimate human stupidity

Those of us “of a certain age,” will remember the old adage ”To err is human, but it takes a computer to really f*** things up.”

That's hilarious. "Payment of vest and explosives for ISIS attack"

https://www.google.com/search?q=begs+the+question

Not really responding to your question, but one of my friend jokingly returned money to another friend with a bank transfer titled "for jihad". Needless to say, both banks were not amused. They both were "verified" on the phone and confirmed they are not, in fact, actually terrorists. I wonder how many people-years banks waste on pranks like this.

How could you verify someone was not a terrorist on the phone?

Well, he sounded kinda like a nice guy.

Many such organizations are legitimate legal entities in some country and handle purchases; and of course there are sanctioned people as well, and a payment from or to them does include their name.

Why is the license key in the payment description? The description should just be "update license key", and not contain the actual key.

edit: Tbh. The more I think about it, maybe it is not such a far fetched idea after all with the assumption that they keys are temporary.

Eh. Coming from that environment, it would not be that easy for a reason that has nothing to do with technology. The lists that financial companies use are largely known ( some published by US Treasury for everyone to use ) and you can reasonably estimate a threshold most institutions will find acceptable.

However, the issue is political and not technical. OFAC itself has grown its SDN list[1] to 6300 names and that is just one list and the tool has been already severely overutilized ( in my opinion anyway, so take that with a grain of salt ), but if the trend and current geopolitical situation is any guide, this number will only increase.

What I am saying is that you have a big and very variable base to build a key from ( edit: come to think of it - not from:P ) and there is no guarantee and old key won't suddenly become 'hot'.

Here, the answer is to the problem is actually political. Affected businesses have to start really complaining, if they are affected by the requirements. I have no evidence suggesting that is the case ( based on what I saw maybe 20% of transactions face that kind of scrutiny and even smaller percentage is questioned the way the OP is ). Naturally, it does not help that this process is not standardized so every single financial institution does their own thing..

[1]https://home.treasury.gov/policy-issues/financial-sanctions/...

Alternating digits and letters seems easy and robust. That is until you get unlucky entropy and send some 1337ed out curse words :p

You cant. Insane people will always find hidden codes and dog-whistles in your messages.

Windows keys use digits, consonants and Y, but then they have sequences like BKDR, F7CK, GYMP and 666.

Reply on news.ycombinator.com