DEV Community: MKaandorp

Tap to Pay on any device by using an NFC tag

MKaandorp — Tue, 14 Nov 2023 08:05:19 +0000

A web app implementing the ideas described in this post can be found at Tappie.money.

A while ago, Apple released Tap to Pay on iPhone, which allows an iPhone to act as a payment terminal (also known as SoftPOS). There are several third parties offering similar functionality for Android.

The major selling point is that it allows the user to accept payments without the need for additional hardware. However, there are some downsides to the current offerings:

Requires the user to sign an agreement with a third party payment provider
Often high transaction costs
Only available in a few regions
Only available for a few specific devices

In this post, we will attempt to create similar functionality, without the downsides listed above.

Building our own Tap to Pay solution

When we break it down, Tap to Pay consists of two functionalities:

Create a payment request on a phone
Allow request to be paid by tapping the phone

Creating a payment request

Fortunately, it’s already possible to create payment requests on your phone, either through most banking apps, or through third party services like Tikkie.

https://mybank.com/paymentrequest/1234

All we need now, is a way to offer these payment requests to a customer device by tapping the phone.

Delivering a payment request

Tap to Pay on iPhone uses the NFC chip in the phone, as does the Android version. Unfortunately, using the NFC chip for payment is restricted to participating payment providers.

We can work around this issue by using a standard NFC tag, instead of the NFC chip in the phone. These tags are very cheap, as they usually cost less than $0.20, or one could use an old hotel room key or public transport ticket.

An advantage of this approach is that it allows us to physically separate the payment terminal from the phone, and get creative with the placement of the tappable surface. Instead of sticking the NFC tag to a phone, we could also stick the tag to the counter in a store, or on a product.

Fig.1 - NFC tags

NFC tags can store URLs, which, when tapped by a device with NFC reading capabilities, usually redirect the user to the read link. Payment requests, as created in banking apps, often come in the form of a URL. This means we can store a payment request on an NFC chip, which, when tapped, sends the customer to the payment page.

Fig.2 - NFC tag with URL, read by phone

Reduce write actions to improve UX

Writing a new payment request to the NFC tag for each payment seems like a hassle. Fortunately, we can work around this issue by using a redirect URL. The URL we store on the tag points to a page we control. This page retrieves the URL of the current payment request from our database, and redirects the user to this URL.

With a simple CRUD application, we can update the payment request the tag points to, without having to write anything to the tag. We can password protect this operation, so only the owner of the tag can update the current payment request.

Fig.3 - NFC tag with redirect URL, payment request URL retrieved from DB

Now that we store the redirect URL on the tag, we don’t have to write to the tag for each new payment. However, we still need to do an initial write operation to store the redirect URL on the tag. We can use the Web NFC API for this. We simply generate a unique redirect URL, and write this to the tag with the press of a button. In this process, we also allow the user to password protect their tag.

Fig.4 - Writing redirect URL to tag

Streamline process of updating payment request to improve UX

Although this works, updating a payment request is quite a lot of work, as it requires us to copy-paste the payment request URL from the banking app to our solution. We can make this easier by creating separate PWAs for separate tags, and register these PWAs as share targets. Now, if our banking app offers a Share button after creating a payment request, we can simply send the request to our app through the system share dialog.

Fig.5 - Send payment request to tag through system share dialog

Conclusion

We now have a solution which is similar to Apple’s Tap to Pay functionality. Let’s list the pros and cons of this solution:

Pros:

Does not require a third party payment provider
Transaction costs your bank offers
Available in all regions
Available on all internet connected devices (although you do need a NFC supporting device for initial setup)
Surface to tap can be your phone, but can also be placed on the counter of your business, or on the product itself

Cons:

Requires additional hardware (the NFC tag)
Payment process is less streamlined, as setting up a payment request requires using multiple services

I built a simple application around this idea, called Tappie.money. It’s free to use, so, if you have an NFC tag, please give it a try :).

Make some noise for net-neutrality - Transfer data over Spotify

MKaandorp — Fri, 04 Jun 2021 10:16:32 +0000

Under current net-neutrality laws in the Netherlands, telecom providers are allowed to zero-rate music, which means streaming music does not count towards customers' data plans. Although there is much discussion about whether this violation of net-neutrality is desirable, there is a second question: is it possible to zero-rate music?
By streaming a website, a calculator, and a 3D game over Spotify (using this app), and by looking at the nature of both music and the process of transferring data, we can try to find an answer to this question.

Context

In 2017, the Dutch court ruled that, under the current European rules regarding net-neutrality, telecom providers are allowed to implement zero-rating for music services. This means that Dutch telecom providers can continue to offer services in which Internet traffic from music streaming services does not count against customer data-plans, thereby violating net neutrality.

At first glance, this might seem like it would be good for consumers. Who doesn’t like free stuff? In reality, abolishing net neutrality by letting providers prioritize Internet traffic based on its type or source, could lead us down a slippery slope towards tiered services, formation of cartels, and even censorship. Advocates for net neutrality warn of a future where you have to pay additional fees to your provider for seperate game-, video- , or music packages. They warn of unfair competition, where the Spotify’s and Netflixes of the world pay providers for prioritized traffic, thereby making it difficult for new and smaller services to compete. And, they warn of a future where providers can block access to websites which promote views which they themselves do not agree with, or are harmful to their shareholders.

The Dutch court interprets the European law as follows: as long as the offer of zero-rating is extended to all music-streaming services, the consumer’s choice is not limited, and zero-rating is allowed. In reality, this provider only offers zero-rating for a small number of streaming services. Before a music streaming service is included in the offer, they need to sign an agreement with the provider. The provider imposes a number of conditions on streaming services that want to be included in this list, which results in some streaming services not being included due to “technical reasons”. If a streaming service does not respond to the provider's offer, or refuses to sign an agreement with the provider, they are also excluded from the offer. Whatever the reason may be for a service to end up on the “excluded” list, the consumer's choice is still limited by these practices.

This decision of the Dutch court allows providers to abolish net-neutrality by giving special treatment to data of a specific type, based on conditions specified by the provider. Although much of the debate around this decision, and net-neutrality in general, has been focussed on whether this is desirable, there is also a second question that can be asked: is it possible? It requires the provider, in its role as gatekeeper, to answer two difficult questions: 1) What is music?, and 2) Is this music?

What is music?

In order to zero-rate music, one has to know what music is. A definition is required, based on which something can be zero-rated. However, Internet providers are not the first ones to pose this question. Many people have tried to answer this question, but there is as of yet no generally accepted answer, and there is an ongoing debate.

Many definitions of music include the terms “organized sound”. This answer creates new questions, such as “When is sound organized?”. It seems to imply the existence of intention, some organizer who organized these sounds. This would exclude sounds like the wind blowing through some trees, or the babbling of a brook, which some people might still experience as being musical.

An interesting example, which lives on the edge of many definitions of music, is the work 4’33 by American composer John Cage. In this piece the performers are instructed not to make any sounds, but are to perform three movements. As the performers are silent, the audience is able to listen to the sounds of their environments.

A definition of music which possibly includes these examples is the definition from Italian composer Luciano Berio, which says “Music is everything that one listens to with the intention of listening to music”. This definition lacks some organizer, or some kind of intent from a creator, and leaves the classification solely to the listener. This would mean that there is no objective way to classify sound as music. Something that’s music to you, might not be music to me. Anyone can classify anything as music.

We end up with a rather vague definition. It seems sound has something to do with it, both the inclusion and exclusion of it. Other than that, it seems subjective to the listener, and it seems difficult to do this classification for someone else. Who is to tell me this white noise is not music, if I enjoy listening to it?

Is this music?

If a provider has answered the question “What is music?”, it can try to answer the question “Is this music?”. Wielding their definition of music, they can try to classify the ones and zeroes streaming through their wires. To find out how this classification can be done, we need to take a look at the nature of transferring information.

One of the oldest ways of transferring data is via speech and language. An idea, thought, feeling, or notion about the world around us can be encoded into words and sentences, transferred via speech, and decoded again by the receiver. However, this does require an agreement between sender and receiver. Before they start transferring data, they have to agree on which encoding to use for their interaction. In this example, this encoding can be any language they both know, such as English or Dutch. However, if this agreement on encoding has not been made clear, problems can arise.

In Fig.1, an example can be found of problems that arise when the sender and receiver do not use the same encoding for their messages. Yvonne has a beautiful pet duck, which they are showing to their friend Xander. Xander absolutely adores ducks. Xander and Yvonne both speak Dutch, but only ever converse in English. Yvonne has asked their friend Xander “Are you a big fan of ducks? Would you like to pet him?”. Xander, dazed by the cuteness of the duck, forgets their usual way of talking, and replies in crude Dutch “Aai eend!”, which translates to English as “Pet duck!”, with which Xander means to say that he is a big fan of ducks, and would very much like to pet this duck. Unfortunately, Yvonne expects an English response, and “Aai eend!” sounds very much like “I ain’t”. Yvonne interprets this as Xander not being a big fan of ducks, and Xander not wanting to pet it. Yvonne picks up their pet duck, and walks away from the conversation feeling offended, contemplating the moral character of their friend, while Xander remains with tear filled eyes and a broken heart, and the duck remains unpetted.

Fig.1 - Xander answers “Are you a big fan of ducks? Would you like to pet him?”

This example shows that the content of the transferred data relies on the way it is interpreted. The words themselves mean nothing, and are only given meaning by the intention of the sender or the interpretation of the receiver. If Xander had answered in Klingon (Hab SoSlI’ Quch!), these would have been meaningless sounds to Yvonne. Furthermore, the example shows that the same piece of data can be interpreted in multiple ways, in this case as a positive or a negative answer.

Non-music is music?

Streaming music over Spotify can be viewed similar to the exchange between Xander and Yvonne, as can be seen in Fig.2. What is being transferred between sender and receiver is music, encoded into ones and zeroes. This all goes well because your Spotify app knows how to interpret the data sent by the Spotify server. However, without this interpretation, these ones and zeroes can mean anything. These are not some kind of special “music bits”, but just regular ones and zeroes. While they are intended as music, one might interpret them differently. They can be decoded into music, but also into an image or a text.

Fig.2 - Streaming music over Spotify.

Because the same piece of data can be interpreted in different ways, this raises an interesting question: Can we somehow disguise some non-music as music, and transfer it via Spotify? Would it be possible to easily transfer arbitrary data over Spotify, by just labeling a piece of data as music, uploading it to Spotify, and then stream and decode it? Unfortunately, this doesn’t work, as Spotify uses its own compression algorithms on the piece of data we uploaded, thereby not leaving our string of ones and zeroes intact. The goal of this compression algorithm is to change the data, but still letting the receiver interpret the data as intended by the uploader. It reduces the size of the data, but tries to maintain the integrity of the sounds the data represents.

The fact that the sounds a user streams from Spotify are almost identical to the sounds uploaded by the artist, provides an opportunity for transferring arbitrary data over Spotify. We can add a layer around Spotify’s data transfer process, thereby incorporating Spotify’s processes into the encoding of the data, as can be seen in Fig.3. A new sender and receiver appear at the head and tail end of the process. They can hijack the existing process, by adding a step to their encoding/decoding algorithm in which they turn their data into music, and turn the music back into data. This makes it possible to transfer arbitrary data over Spotify.

Fig.3 - Transferring arbitrary data over Spotify.

To demonstrate this, I have created an example app, which takes sound on Spotify, and interprets it as HTML. By first encoding HTML into sound, and publishing this on Spotify, thereafter decoding it into HTML, we can transfer text, web pages, and web applications over Spotify.

The app, which decodes the sound into data, is built around the Quiet library (https://github.com/quiet/org.quietmodem.Quiet). The JavaScript version of this library is used for encoding data to sound. This library works in a very similar way as old broadband modems. Such a modem converts (modulates) a digital signal into analog audio, and converts (demodulates) an analog signal into digital data. This way, computers were able to communicate over telephone lines using hisses and crackles.

Using the technology of ancient modems, we are able to transfer a famous poem, a wikipedia article, a working calculator, and a 3D game over Spotify. You can try it yourself, by downloading the app, and, with the app open, play one of the songs from this album. The easiest way to do this is to start playing the song in the Spotify app, immediately pause it, switch to the SoundToData app, and resume playing the song from your notifications. It works best in a quiet environment, and you might have to experiment a bit with the playback volume to get your phone’s microphone to pick up the sound from your phone’s speaker. When it works, you should see HTML appear on your screen, piece by piece. When the song is over, you can click on the three dots, and switch to HTML, to view the HTML rendered as a web page. Screenshots can be found in Fig.4.

Fig.4 - Screenshots of streaming a calculator via Spotify.

Although this is a very slow and impractical way of transferring data, it shows how difficult it is to give special treatment to data of a specific type. Even if the ones and zeroes are at first interpreted as sound, this sound can be interpreted as something else.

A more efficient way to transfer data as music, would be to set up a new service which serves any type of content, and just tell the users they should interpret the data as music, thereby skipping the step of encoding the data into sound. Any type of digital data that’s transferred can be broken down into a string of ones and zeroes. We can think of a simple algorithm which can turn any data string into music, by interpreting each zero as a C note, and each one as a D note. If we follow this thought, a news website like CNN.com could claim their website is a music streaming service. “Oh, you interpret the data we provide as news articles? You were actually supposed to interpret it as an experimental type of music.”

Conclusion

In conclusion, the current reading of the European laws regarding net neutrality allow providers to discriminate data based on its type, which, in the example case, is music. Because the data’s type is purely based on both the intention of the sender and the interpretation of the receiver, who can disagree, the provider, as man in the middle, has no way to accurately classify this data. Because of the vague definition of music, and the fact any data can be interpreted as sound, there can exist ambiguity between the sender, receiver, and provider. In short, music can be anything, and anything can be music. Therefore, zero-rating music, means zero-rating all Internet traffic.

The SoundToData app is built around the Quiet Modem Project. The JS version is used to convert the data to sound.
The 3D game which can be streamed over Spotify is HueJumper by KilledByAPixel.
The calculator which can be streamed over Spotify is based on this calculator by zxcodes.
The poem which can be streamed over Spotify is The Raven by Edgar Allen Poe.
The webpage which can be streamed over Spotify is the Wikipedia page on music.

This website contains pictures of your vacation next year, audio of your last words, and a description of the end of humankind

MKaandorp — Fri, 12 Mar 2021 09:53:09 +0000

I created a website, called the HDD of Babel, which contains pictures of your vacation next year, an audio recording of your last words, and a description of the end of humankind. It contains all data that ever was, is, or ever will be (as long as its below the size limit). You can submit some data, a file or some text, and it will return the webpage on which your data can be found. This page is not created when you submit the data, it's not like it's adding an entry to some database. Since the launch of this website, your data has existed on this page. Alternatively, you can go to a random page, and explore the secrets this library holds yourself.

Does this website really contain all data? In some ways, yes. In other, more sensible ways, not really.

Context

In 1941, Argentinian author and librarian Jorge Luis Borges published a short story called “The library of Babel”. This story features an immense library containing all possible 410-page books. Although most books will not make any sense, the library must also contain every piece of literature that has ever been written, and that will ever be written. The library contains all truths of the universe, as well as every lie. This leads to some cult-like behaviour, with characters searching through the library for answers, thruths and prophecies.

Although building Borges’ library in a physical form would be challenging, the digital age makes a virtual version possible. Jonathan Basile took up the challenge, and created a website which contains all possible pages of 3200 characters. A fascinating project, which has spawned communities, which, not unlike Borges' characters, try to find meaning in the virtual pages.

As a next evolution for this concept of a universal library, I have created a version which does not contain only text, but all possible data in general. This means that this website also contains every possible image, video, piece of audio, website, etc. There is a page on this website which contains a picture of your yet-to-be-born grandchildren, as well as one with a fragment of Charli XCX's upcoming hit single. There is even a page which contains the homepage of the website itself. However, there are also billions and billions of pages which contain total gibberish.

Questions raised

Can these libraries help us uncover the ancient mysteries of the universe? Can these libraries tell us anything about our future, by showing us pictures of life in the year 3021, by letting us listen to the sounds of the last of humankind? And, closer to home, do these libraries render our current copyright system completely obsolete, by containing every piece of media that will ever be created?

How it works

Although a universal library sounds like a magical place, and, like the characters from Borges' book and the Reddit communities, one might be tempted to search through it to find the hidden truths of the universe, a closer look reveals its simplicity and meaninglessness.

In both the Library of Babel and the HDD of Babel, each piece of data has a specific location. In the Library of Babel, like the story, this location is the hexagon name, wall number, shelf number, and book name. For the HDD of Babel, this location is the URL. By tying each piece of data to a specific location, it’s easy to share the found data, and to find it back after leaving the page. However, this also makes it possible to use the location of a page as a seed for generating its contents.

The homepage of the HDD of Babel contains a button to submit a file, which returns an URL to the page which contains this file. When you submit a file, it generates its URL. It does this in the following way:

First we take the data URL from the uploaded file, which looks likes data:[<mediatype>][;base64],<data>.

Although the actual data in the data URL is already base64 encoded, we encode this complete data URL in base64 as well. This way it looks a bit more random, and we preserve some of the magic. To make it more difficult for the user to recognize patterns in the URL, this base64 string is then reversed. These last two steps serve to make it more difficult to see the link between the location of the page and its contents.

When the user visits this generated URL, it returns a 404, as this page does not really exist. A custom 404 page takes the URL, and performs above steps in reverse to decode the data. If the script recognizes a MIME-type in the decoded data, it tries to display the data on the page. If it does not recognize the type of data, it only allows the user to download the data as a file.

This means that if you send someone a link to a page on the HDD of Babel, you’re not sending them a link to the data, you’re sending them the encoded data (in the URL) and a link to a decoder (found on the webpage).

The Library of Babel website works in a similar way. The text-to-be-found entered on the homepage is encoded into a location (hexagon name, wall number, shelf number, and book name). Upon visiting this location, the location is decoded into text. This means the location is the data.

The realization that the contents of the page are just a decoded version of the location of the page, and the library only serves as a decoder, makes these universal libraries a bit less magical. The illusion only works because it’s not easy to see the link between location and page contents. A similar, although simpler system can be found in Caesar's Cipher, in which each letter of a text is replaced by a letter found a fixed number of positions down the alphabet. For instance, if we use the number one, the text “ABC” becomes “BCD”, and the text “HELLO” becomes “IFMMP”. However, to say Caesar’s Cipher contains every piece of literature ever written, although in some way true, sounds absurd.

An even simpler example would be a library in which the encoded version of the data is equal to the decoded version of the data, in other words, in which the location of the page is exactly the same as the contents. One could think of a website which displays the last part of its URL. For instance, when browsing to universallibrary.com/the-answer-to-life-the-universe-and-everything, one would see a page containing the text “the-answer-to-life-the-universe-and-everything”. It will be no surprise that if one replaces this last part of the URL with the first chapter of the first Game of Thrones novel, it will display a page containing the first chapter of the first Game of Thrones novel.

Both Bastille’s website and the HDD of Babel contain functionality to visit a random page, which would be similar to picking a random book from Borge’s library. A random string is generated, and encoded into a location. Upon visiting this location, it is again decoded into the generated random string. One could skip the encoding and decoding steps, and still find the same result. This reduces the process to a practice already perfected by an infinite number of monkeys. By generating random data, one could find all the truths of the universe, but also everything that’s not true. All these possibilities already exist, describing or instantiating them does not provide any new information. A randomly generated answer to any question will have a high probability of being wrong.

Conclusion

Now that we know how these libraries work, we can answer the questions raised earlier.
These libraries do not provide any new information, nor do they provide any new insights. We can either find information we already have, by visiting the linked location, or we can generate meaningless random information.
The websites do not “contain” all information possible, they just provide a simple decoding algorithm for any encoded information, and are therefore not much different from any simple cipher.
It also does not make our copyright system obsolete, because a piece of media would have to exist, either created by the artist or generated randomly, before it could be found in the library.

Practical Usage

The fact that the library does not really contain the last Game of Thrones book, does not mean it serves no purpose whatsoever. For one thing, it helps us think about the nature of information, and its practical applications.
Also, it could serve as an easy way to “host” some kind of content, for example the terms and conditions for your mobile app, your resume, or your favorite meme. This works best when paired with some URL shortener service.
Thirdly, although we know it does not make any sense, it can still be fun to try to find some meaning in (seemingly) random patterns, or connections between unrelated systems. If we can find faces in toast, fortune in cookies, and our futures in the stars, we can certainly find something of value in these universal libraries.

The source code for the HDD of Babel can be found here.