Someone on the plane I was on kept triggering it to do bluetooth attacks ('not your airpods') while I was trying to read (and have my earphones on connected via bluetooth so fuck me right?).

There's hacked firmware's you can install [0]. I understand that there are probably tons of other devices like this out there but this one was SO fucking popular and easily accessible.

I've already seen this thing abused and used in a super obnoxious way. Frankly I think you should be arrested for having it on in the passenger cabin of an airplane.

[0] https://github.com/DarkFlippers/unleashed-firmware

Probably best not to have the tool in carry-on, even powered-off, and I'd understand if TSA didn't permit that (like they wouldn't let a chef carry-on their knives, another tool with very legitimate purposes).

The TSA also doesn't care, they don't look for, and don't remotely have the training to detect suspicious electronics. Even if they did the flipper looks very innocuous unless you know what it is. You can reliably get much more entertaining things onto airplanes without them batting an eye.

It’s like getting upset by a lock picking set except this isn’t even a lock picking set and more like a door knob diagnostic tool.

I am not excusing the behavior, but I also don't see arrest as an appropriate remedy.

This is in no way an endorsement of fucking around with one on an airplane, or even off an airplane when used without the consent of the target.

It's a dick move but banning the hardware doesn't do anything because you can port such simple hacks to any platform. It's the action that should be policed.

Sounds like running this is illegal and github hosting it, too

Because honestly there are lots of ways of gaining access to the inside of a vehicle, and if it can’t enroll a new key it’s neither necessary nor sufficient for stealing a vehicle.

An example: Contactless payments, I can pay up to €50 by just pressing my bank card against the receiver. Very convenient, but, anyone can hold a receiver up to where I have my card and steal money that way. There's insurances of course, in this case the bank is pretty clear in saying "we know this is a risk and you will be compensated", same as with their apps etc. But it is a tradeoff.

It's the same approach they used for their recent (last 5 years) firearm bans. Whether or not I agree with what they're trying to accomplish with the bans, the ability to arbitrarily ban specific items without meaningful oversight isn't great for democracy.

You're pulling a "Think of the children" here. Rest of your comment is fine, but this first statement doesn't hold water. Any incredibly small number of engineers and scientists would ever use this device. A Raspberry PI, Ardiuno, or other general purpose micro controllers and small form computing devices sure, I could believe that. But some niche device, no.

Edit: I wasn't aware of the popularity of the device, as suggested by comment below, when I wrote this

FWIW, I "funded" the Kickstarter for Flipper Zero because my startup was doing something a little innovative with various kinds of RF tags, to help solve a significant societal problem. (Which, besides what we could've contributed to a country in monetary value of our company, the application domain had significant implications for national economies, as well as for public safety. All things that lawmakers care about, in addition to reducing auto thefts.) We had Android diagnostic software, plus bespoke iOS apps with NFC that I wrote, but a Flipper Zero would've helped me work better and faster at some things.

I agree with OP, it's bad that its being used to try and take down phones on flights and also if it's being used to steal cars.

> Any(sic) incredibly small number of engineers and scientists would ever use this device.

I personally know over a dozen people who own them and have tinkered with them in various ways. I managed to "break" my air conditioner unit (permanently setting it to C, not that bad of a "break") with one. Definitely less popular than a Pi or Arduino, but growing in popularity very fast.

Numbers? I see in 2023 they did 80m rev which is what, half a million devices sold worldwide? That’s very niche. % wise close to 0; it’s a geek tool. Nice but not immensely popular.

500K is a _lot_.

Runaway success unless you're: A) Apple B) Samsung

The 350K product I'm referring to defined a whole category for years and is universally well-known in tech.

To be 100% clear, next time you see "500K sold", your decision tree is:

Is it Apple? If yes, can be disagreeable whether it is well-known / successful.

Is it Samsung? If yes, can be disagreeable about whether it is well-known / successful.

Still here? It's well-known and successful, you'll look silly if you choose to be disagreeable.

I couldn't possibly comment on the practical consequences to STEM of banning it. I wouldn't make that argument. But it's silly to claim that it's a "think of the children" argument and nothing more.

Look at the state of CB radio. Anybody can buy and use one. The airwaves are clogged with the trucker equivalent of YouTube Poop. It's like being in a fucking mental hospital.

Ham radio requires licensing. There are still cranks but now there's a barrier to entry for most of them. It's still usable.

Lockpicks are illegal to carry in parts of America, unless you're a licensed locksmith.

Look at the state of the internet, 1997 vs now. The difference is we onboarded everybody.

Broadly speaking, trolling/crime (and tools to perpetrate it) should not be frictionless. Attacks on infrastructure (malware, etc.) are getting too expensive and social attacks are basically free to execute and costly to respond to.

You can bring any western company to a grinding halt by getting a bunch of entry-level stooges to file false workplace violence and other complaints indiscriminately in bad faith. There's no cost or consequence for this, and the company will panic trying to accommodate in good faith, but do the same with police reports and everyone gets charged with misdemeanors for abusing the system.

Unearned privileges are always abused.

A lot of vehicles - my wife’s 2015 Kia included - have a very flawed implementation of rolling key encryption. Basically, you need to capture three consecutive keys. The receiver is programmed to allow any future key (in case the fob was pressed away from the car), and will happily reset to past keys when you send three consecutive keys in sequence.

Ostensibly this is to avoid people’s fobs from becoming “unpaired” somehow if the car receives a future key. You just hit the button a few times and it works. In practice, it’s trivially easy to exploit.

https://www.usenix.org/system/files/conference/usenixsecurit...

This is a good start.

Here's my template:

I am a Canadian citizen in your riding (A1B 2C3) and multiple business owner in the technology sector.

As an expert in the field of electronics and information security, I am concerned about the ISED’s initiative to ban Flipper Zero and similar devices, announced at: https://www.canada.ca/en/public-safety-canada/news/2024/02/f...

The Flipper Zero is a general-purpose tool for engineering and information security research. By banning the device, we will be doing a disservice to our country’s practitioners in these fields, while doing little to thwart car thefts.

If possession of a device like Flipper Zero is the enabler for car theft, then it leads me to believe that such cars had negligently insecure encryption from the day they were manufactured, and a recall of such cars would be more appropriate.

If different people want to mix up approaches, and hit various notes, to see what resonates, a couple thoughts (as a tech nerd, not a political communicator):

* "Information security research" has different connotations for different people. No matter how professionally you conduct yourself and respect the term, and no matter how much you promote the term positively as professional... if a particular reader considers the term to be a euphemism for behavior they think should be curtailed, and they think that's the only use of FZ, that might hurt your effort. (Unless you can find a way to promote both at the same time, to those readers, without compromising on either more than you want to.)

* All the hobbyist experimenting and building things, by kids and adults alike, I consider constructionist "education", which is valued. And I suspect it doesn't hurt to say "STEM", as a keyword for the kinds of jobs and economic development this leads to. (Imagine kids figuring out how modern devices work, which today requires more than just unscrewing an appliance and finding the motor and gears. Or getting interested in the RF that backs much of our global technology infrastructure, and inspired to pursue engineering or science. Or using that knowledge to build things that help get them into universities, or that become a tech startup company.)

While accurate, the standard may not be as rigorous as you'd like to imagine; there was a time not long ago when a wire coat hanger was enough to unlock a car.

It’s impossible, you can’t even use it against garage doors rolling keys without accessing the garage unit and program it like a new remote. The ban has nothing to do with car theft.