30 articles with this tag
Payment Fraud Detection with ML: What Actually Works
Payment fraud is the original imbalanced, adversarial, delayed-label ML problem — and most of what makes a fraud model work is not the model. A practical look at the features that matter, why chargebacks are terrible labels, how the precision/recall trade-off becomes a business decision, and why rules and ML have to coexist.
PCI-DSS 4.0 for Engineers: Security Beyond Compliance
PCI-DSS reads like a compliance document, but underneath it is a small set of engineering decisions that determine whether you spend your life in audit scope or out of it. The requirements that actually change your architecture — don't store what you don't need, tokenize, segment, encrypt in transit — and the scope-reduction moves that make the rest someone else's problem.
Certifying a Terminal: L1, L2, L3 and the Brand Test Tools
Shipping a payment terminal means passing three distinct certifications that most engineers conflate. A map of EMVCo Level 1 (hardware), Level 2 (kernel), and the brand-run Level 3 (end-to-end), what each actually tests, the order they happen in, and why the Brand Test Tools are where projects quietly lose months.
The ABECS Pinpad Protocol: Brazil's POS Command Language
Every card payment in Brazil passes through a pinpad speaking the ABECS protocol — a command/response state machine with its own open, get-card, go-on-chip, get-PIN, and close commands. A structural guide to how the automation talks to the secure device, why the Input/Output split exists, and where the EMV flow you know lives inside it.
Field 55: The EMV Bridge Inside ISO 8583
DE 55 is where two worlds meet: the chip's BER-TLV data objects packed inside a 1980s ISO 8583 message. A guide to what actually goes in Field 55 — the cryptogram, the TVR, the ATC, the unpredictable number — why each scheme mandates a different tag set, and how to debug the field where authorization declines are really decided.
The CVM List (8E): How a Card Chooses PIN vs Signature vs Nothing
The Cardholder Verification Method List is the card's ranked ballot of how it is willing to prove you are you — offline PIN, online PIN, signature, on-device biometric, or nothing at all — each gated by a condition. A byte-by-byte decode of tag 8E, the amount thresholds X and Y, and the 'try the next rule' bit that trips people up.
SDA, DDA, CDA: How a Terminal Trusts a Card Offline
Before a chip transaction ever reaches the issuer, the terminal can verify the card is genuine using a chain of RSA keys it carries. A walk through Offline Data Authentication — the CA-to-issuer-to-card certificate chain, why SDA is cloneable, how DDA proves the card holds a private key, and how CDA welds authentication to the cryptogram.
DUKPT from Scratch: Derived Unique Keys per Transaction (TDES and AES)
DUKPT solves a brutal problem: a million field terminals that must each encrypt PINs, none of which can ever share a key, and none of which can phone home for a new one. A walk through the Base Derivation Key, the IPEK, the Key Serial Number counter, and the non-reversible derivation that gives every transaction a unique, forward-secure key.
ISO 8583 Is Still Everywhere: Parsing the Message That Runs the Rails
Every card authorization that goes online becomes an ISO 8583 message — a four-digit MTI, one or two bitmaps, and a sparse set of data elements. A structural walk through the MTI, the bitmap that tells you which fields are present, the fixed-vs-variable length rule, and the DEs a Staff+ engineer actually meets.
PIN Blocks Explained: ISO 9564 Formats 0 to 4
A PIN never travels as four plain digits. It is packed into a PIN block — bound to the PAN, padded, and encrypted — and the exact packing is one of five ISO 9564 formats. A byte-by-byte walk through Format 0, why it XORs the PAN, what Formats 1 to 3 fix, and why Format 4 exists for AES.
Track 2 and the Service Code: What the Magstripe Still Tells the Chip
Track 2 Equivalent Data (tag 57) is the magnetic stripe living inside the chip — PAN, expiry, service code, and discretionary data in one compact field. A field-by-field decode, the three-digit service code that quietly routes and restricts every transaction, and why Luhn is the cheapest validation you are probably skipping.
Contactless in 300ms: Kernels, the TTQ, and the Tap
A tap has a latency budget a chip dip never had, and EMV contactless spends it differently: a PPSE combination-selection step, six scheme kernels (and the new unified C-8), and the Terminal Transaction Qualifiers (tag 9F66) that tell the card how this reader wants to be paid. A byte-by-byte guide to the fast path.
PIX, BR Code, and the EMVCo MPM: The QR All of Brazil Uses
The QR code that moved a country onto instant payments is EMV wearing a disguise. A field-by-field decode of a real PIX BR Code — the EMVCo Merchant-Presented Mode structure, the CRC16, static versus dynamic — and why the same TLV discipline from chip cards prints on a napkin.
ARQC from Scratch: Application Cryptograms Without the Black Box
The Application Cryptogram is the anti-fraud keystone of EMV. This is a meticulous walk through how one is built — master key derivation from the PAN, session key derivation from the ATC, the ISO 9797-1 MAC, and the ARPC response — with the hard rule that key-bearing crypto runs client-side and never touches a production key on someone else's server.
The TVR, the TSI, and How a Terminal Decides to Decline You
The Terminal Verification Results (tag 95) and Transaction Status Information (tag 9B) are the two bit fields that decide whether your card is approved offline, sent online, or declined. A byte-by-byte decode plus the exact AND logic — IAC and TAC against the TVR — that produces the verdict.
Agentic Commerce and the Return of HTTP 402: How AI Agents Will Pay
HTTP 402 Payment Required sat reserved for thirty years. Agentic commerce just woke it up. A pragmatic look at the x402 protocol, Cloudflare's edge monetization, and how the card networks' agent-payment rails converge on the same hard problem: verifiable, scoped, auditable authority for a payer that isn't human.
Reading BER-TLV by Hand — and Why You Shouldn't
BER-TLV is the grammar of EMV. This is a meticulous, byte-by-byte guide to decoding a real chip-card response — tag classes, the 0x1F continuation rule, short vs long length, nested templates — and an honest argument for handing it to a deterministic decoder in production.
What Actually Happens When You Dip a Chip: The EMV Transaction Flow End-to-End
A Staff+ walkthrough of a single contact EMV transaction — SELECT, GPO, READ RECORD, offline data authentication, cardholder verification, risk management, and the cryptogram — with the real APDUs and the tags that carry the state.
Agentic Postgres: Why Agents Need Fast Forking Databases
Why traditional databases are dead for AI Agents. Understanding 'Fast Forking', Copy-on-Write (CoW), and why your database needs to be as ephemeral as a...
Git hardcore: hooks, submodules, monorepos and surviving huge codebases
Advanced Git techniques for large codebases: hooks, submodules, monorepos, performance and disaster plans.
Modern Android Development Philosophy: Beyond the Code
An epilogue that transcends the technical. Understand the philosophical principles that underpin modern Android architecture: declarative vs imperative,...
Capstone Project: Architecting a Real App from Scratch
Practical blueprint for building a complete Android app from scratch: GitHub Repository Finder. Integrates idiomatic Kotlin, Android engine, MVVM,...
Modern Architecture (MVVM): Building Robust and Testable Android Apps
Understand the MVVM pattern and how ViewModel, LiveData/StateFlow, and Repository pattern solve the fundamental problems of Android's lifecycle. Practical...
Worktrees: Multiple Workspaces, One Repository
Discover how git worktrees allow you to have multiple working directories (branches) active simultaneously, sharing a single .git repository to save space...
Undoing the Impossible: Reset, Revert, and Advanced Recovery
A deep analysis of how `reset`, `revert`, and `reflog` work, transforming catastrophic Git errors into simple inconveniences.
HTMX: The Future of the Web or Nostalgic Regression?
A technical analysis of HTMX, the library that proposes simplifying the modern web by trading JavaScript complexity for HTML attributes. Is it evolution...
Implementing EMV from Scratch: Complete Guide for Payment Terminals
How to implement EMV (chip) from scratch in payment terminals. Complete technical guide with real production code, based on 20 years developing critical...
Mastering Git Submodules: A Definitive Guide to Complex Repository Architecture
A complete guide that dissects the anatomy, workflow, and strategies behind using Git submodules, transforming a complex tool into a powerful ally for...
Distributed Philosophy: How Git Revolutionized Development
Git wasn't just a technical improvement - it was a philosophical revolution. By making each clone a complete repository, it eliminated single points of...
Strategic Analysis of the eSIM Ecosystem for POS Terminals in Brazil
A detailed roadmap for POS product development, analyzing eSIM technology, GSMA standards (SGP.32), hardware, management platforms, and the Brazilian...
Receive new articles
Subscribe to receive notifications about new articles directly to your email
We won't send spam. You can unsubscribe at any time.