toad.social

Kevin Karhan :verified:<a href="https://mstdn.ca/@JustinDerrick" class="u-url mention" rel="nofollow noopener" target="_blank">@JustinDerrick</a> don't use online banking and never have honest answers on security questions!<a href="https://infosec.space/tags/Funfact" class="mention hashtag" rel="nofollow noopener" target="_blank">#Funfact</a>: This would not have been possible if their bank complied with <a href="https://infosec.space/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a>, which demands active, on-demand <a href="https://infosec.space/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#2FA</a>!

Kevin Karhan :verified:<a href="https://mstdn.social/@juliewebgirl" class="u-url mention" rel="nofollow noopener" target="_blank">@juliewebgirl</a> <a href="https://infosec.space/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a>?

Kevin Karhan :verified:<a href="https://social.linux.pizza/@midtsveen" class="u-url mention" rel="nofollow noopener" target="_blank">@midtsveen</a> how about never unless @Liberapay@mastodon.xyzgets forced under threat of hans for violating <a href="https://infosec.space/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a> to implement it 'at gunpoint' socto speak...?

Kevin Karhan :verified:<a href="https://chaos.social/@martinsteiger" class="u-url mention" rel="nofollow noopener" target="_blank">@martinsteiger</a> wenn kein <a href="https://infosec.space/tags/PGP" class="mention hashtag" rel="nofollow noopener" target="_blank">#PGP</a>-<a href="https://infosec.space/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#2FA</a> existiert nutz' ich kein 2FA aus Prinzip!<ul><li><a href="https://infosec.space/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SMS</a>-<a href="https://infosec.space/tags/TAN" class="mention hashtag" rel="nofollow noopener" target="_blank">#TAN</a>|s sind unsicherer als die qua <a href="https://infosec.space/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a> verbotenen <a href="https://infosec.space/tags/iTANs" class="mention hashtag" rel="nofollow noopener" target="_blank">#iTANs</a>...</li></ul>

Kevin Karhan :verified:<a href="https://toot.io/@hisold" class="u-url mention" rel="nofollow noopener" target="_blank">@hisold</a> My bank stopped issuing <a href="https://infosec.space/tags/girocard" class="mention hashtag" rel="nofollow noopener" target="_blank">#girocard</a> cards with <a href="https://infosec.space/tags/magstrip" class="mention hashtag" rel="nofollow noopener" target="_blank">#magstrip</a> 10+ years ago as magstrip was phased out and <a href="https://infosec.space/tags/NFC" class="mention hashtag" rel="nofollow noopener" target="_blank">#NFC</a> was phased in as well as <a href="https://infosec.space/tags/PSD1" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD1</a> being introduced.<ul><li>Even before that merchants rarely accepted magstrips and those who did asked for <a href="https://infosec.space/tags/ID" class="mention hashtag" rel="nofollow noopener" target="_blank">#ID</a> as soon as purchases [i.e. fuel at a gas station) exceeded like €100 because unlike <a href="https://infosec.space/tags/Chip" class="mention hashtag" rel="nofollow noopener" target="_blank">#Chip</a> + <a href="https://infosec.space/tags/PIN" class="mention hashtag" rel="nofollow noopener" target="_blank">#PIN</a> the payment processor does not guarantee them that the payment will be accepted and the amount guaranteed.</li></ul>That's the main push factor: Alongside lower processing fees and faster processing, the Chip+PIN & <a href="https://infosec.space/tags/NFC" class="mention hashtag" rel="nofollow noopener" target="_blank">#NFC</a> systems actually request a blockage of the amount and will automatically decline without incuring fees if the balance / limit is below that amount - sometimes even before the PIN has been entered (it'll just not show it until the PIN is entered so fraudsters can't just abuse this as a means to check balance.<ul><li>There's a nice <a href="https://www.youtube.com/watch?v=eFYrboLEx2I&t=2043" rel="nofollow noopener" target="_blank">podcast</a> with <a href="https://infosec.space/tags/JohnBoseak" class="mention hashtag" rel="nofollow noopener" target="_blank">#JohnBoseak</a> where he explains how stuff used to [and allegeldy still does] work in the <a href="https://infosec.space/tags/USA" class="mention hashtag" rel="nofollow noopener" target="_blank">#USA</a> re: <a href="https://infosec.space/tags/CreditCards" class="mention hashtag" rel="nofollow noopener" target="_blank">#CreditCards</a>. Given that I worked for a <a href="https://infosec.space/tags/PaymentProcessor" class="mention hashtag" rel="nofollow noopener" target="_blank">#PaymentProcessor</a> in the past this is some basic knowledge re: <a href="https://infosec.space/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#security</a>, because one needs to understand how stuff like CNP ("Card not Present") works and how the system is architected to the point that even if someone were to hack the database of said payment processor, they'd never find any CCs or the CVVs stored there at all. </li></ul>It's also insightful because <a href="https://infosec.space/tags/fraud" class="mention hashtag" rel="nofollow noopener" target="_blank">#fraud</a> would be way more rampant if the card issuer, payment processor and card system operator [i.e. AMEX, VISA, MasterCard] didn't all run their own AFE [Anti-Fraud Engine] each automatically assessing risks within less than a second for every transaction.<ul><li>That's why one can get their <a href="https://infosec.space/tags/CC" class="mention hashtag" rel="nofollow noopener" target="_blank">#CC</a> blocked when using a <a href="https://infosec.space/tags/VPN" class="mention hashtag" rel="nofollow noopener" target="_blank">#VPN</a> and why fraudsters need the location of their victims because if I had a CC and used it regularly and someone were to try to swipe a skilled copy of that at a Walmart or Best Buy on the East Coast of the USA less than 24 hours of my last use in Germany, that would automatically get declined as fraud and the person at the cashier will call security because noone is travelling that quickly that far.</li></ul>But that's just some cold OSINT based off <a href="https://infosec.space/tags/TechSupport" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechSupport</a> and peeking behind the curtains professionally...<ul><li>There's way more but I can't go into details on that. </li></ul>Rest assured if you have a CC you can be as certain that someone tried to abuse it as I'm certain my bank blocked fraudulent money orders against my account because of AFEs working - it's just > 99% of all fraud attempts get blocked instantly and merchants rate-limited or kicked off the system when they do something suspicious.<ul><li>Same reason why one can't frame someone for a crime by just wiring obviously illicit funds to their account: AML (Anti-Money Laundering) will catch that and unless the account holder were to ask "Where's the money/transaction?" <a href="https://infosec.space/tags/FinCEN" class="mention hashtag" rel="nofollow noopener" target="_blank">#FinCEN</a> et. al. won't even bother calling the account holder up simply because "oops I wired money to the wrong account. Can you please send it back?"- <a href="https://infosec.space/tags/scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#scam</a> is a well-known method to turn unsuspecting people into money launderers.</li></ul>So yeah, that "<a href="https://infosec.space/tags/magstrip" class="mention hashtag" rel="nofollow noopener" target="_blank">#magstrip</a>" may be just lacquer but unless it's specifically advertised otherwise only holds the CC & CVV as well as <a href="https://www.youtube.com/watch?v=UHSFf0Lz1qc&t=320" rel="nofollow noopener" target="_blank">service codes</a> [i.e. chip+pin only] to tell the terminal "Don't accept magstrip, mandate Chip+PIN"]...<ul><li>Outside the <a href="https://infosec.space/tags/USA" class="mention hashtag" rel="nofollow noopener" target="_blank">#USA</a>, this is the norm due to <a href="https://infosec.space/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a> exceeding <a href="https://infosec.space/tags/PCIDSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#PCIDSS</a> by quite a lot!</li></ul>Only underdeveloped countries like the <a href="https://infosec.space/tags/US" class="mention hashtag" rel="nofollow noopener" target="_blank">#US</a> still use <a href="https://infosec.space/tags/Magstrips" class="mention hashtag" rel="nofollow noopener" target="_blank">#Magstrips</a> and <a href="https://infosec.space/tags/credit" class="mention hashtag" rel="nofollow noopener" target="_blank">#credit</a> and not Chip+PIN & <a href="https://infosec.space/tags/debit" class="mention hashtag" rel="nofollow noopener" target="_blank">#debit</a>!

Bytes EuropeThe National Bank of Serbia Publishes Regulatory Technical Standards and Extends PSD2 Compliance Deadline to January 1st, 2026 <a href="https://www.byteseu.com/912253/" rel="nofollow noopener" translate="no" target="_blank">https://www.byteseu.com/912253/</a> <a href="https://pubeurope.com/tags/Compliance" class="mention hashtag" rel="nofollow noopener" target="_blank">#Compliance</a> <a href="https://pubeurope.com/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a> <a href="https://pubeurope.com/tags/SaltEdge" class="mention hashtag" rel="nofollow noopener" target="_blank">#SaltEdge</a> <a href="https://pubeurope.com/tags/Serbia" class="mention hashtag" rel="nofollow noopener" target="_blank">#Serbia</a> <a href="https://pubeurope.com/tags/TechnicalStandards" class="mention hashtag" rel="nofollow noopener" target="_blank">#TechnicalStandards</a>

Bytes EuropeLUXHUB chosen by six Luxembourg banks as VoP service provider <a href="https://www.byteseu.com/910385/" rel="nofollow noopener" translate="no" target="_blank">https://www.byteseu.com/910385/</a> <a href="https://pubeurope.com/tags/Banks" class="mention hashtag" rel="nofollow noopener" target="_blank">#Banks</a> <a href="https://pubeurope.com/tags/InstantPayments" class="mention hashtag" rel="nofollow noopener" target="_blank">#InstantPayments</a> <a href="https://pubeurope.com/tags/Luxembourg" class="mention hashtag" rel="nofollow noopener" target="_blank">#Luxembourg</a> <a href="https://pubeurope.com/tags/LUXHUB" class="mention hashtag" rel="nofollow noopener" target="_blank">#LUXHUB</a> <a href="https://pubeurope.com/tags/OpenFinance" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenFinance</a> <a href="https://pubeurope.com/tags/Payments" class="mention hashtag" rel="nofollow noopener" target="_blank">#Payments</a> <a href="https://pubeurope.com/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a> <a href="https://pubeurope.com/tags/PSPs" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSPs</a> <a href="https://pubeurope.com/tags/Spuerkeess" class="mention hashtag" rel="nofollow noopener" target="_blank">#Spuerkeess</a> <a href="https://pubeurope.com/tags/verification" class="mention hashtag" rel="nofollow noopener" target="_blank">#verification</a> <a href="https://pubeurope.com/tags/VerificationOfPayee" class="mention hashtag" rel="nofollow noopener" target="_blank">#VerificationOfPayee</a>

Kevin Karhan :verified:<a href="https://infosec.exchange/@katrinakatrinka" class="u-url mention" rel="nofollow noopener" target="_blank">@katrinakatrinka</a> <a href="https://universeodon.com/@digyoursoul" class="u-url mention" rel="nofollow noopener" target="_blank">@digyoursoul</a> <a href="https://hachyderm.io/@molly0xfff" class="u-url mention" rel="nofollow noopener" target="_blank">@molly0xfff</a> granted, compared to <a href="https://infosec.space/tags/CustomerProtection" class="mention hashtag" rel="nofollow noopener" target="_blank">#CustomerProtection</a> and <a href="https://infosec.space/tags/Regulations" class="mention hashtag" rel="nofollow noopener" target="_blank">#Regulations</a> in the <a href="https://infosec.space/tags/EU" class="mention hashtag" rel="nofollow noopener" target="_blank">#EU</a>, <a href="https://infosec.space/tags/finance" class="mention hashtag" rel="nofollow noopener" target="_blank">#finance</a> inctue <a href="https://infosec.space/tags/USA" class="mention hashtag" rel="nofollow noopener" target="_blank">#USA</a> is a shitshow.<ul><li><a href="https://infosec.space/tags/Carding" class="mention hashtag" rel="nofollow noopener" target="_blank">#Carding</a> as a form of <a href="https://infosec.space/tags/fraud" class="mention hashtag" rel="nofollow noopener" target="_blank">#fraud</a> doesn't really exist here, and the few possibilities does.with <a href="https://infosec.space/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a> mandating <a href="https://infosec.space/tags/3Dsecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#3Dsecure</a> in <a href="https://infosec.space/tags/SEPA" class="mention hashtag" rel="nofollow noopener" target="_blank">#SEPA</a> member nations...</li></ul>

rugk<a href="https://infosec.exchange/@Xavier" class="u-url mention" rel="nofollow noopener" target="_blank">@Xavier</a> Well… in an ideal world we would have a standarized (and obviously secure) API that (nearly) all banks use. Or maybe even a few per region or so.Of course, we don't. So apparently <a href="https://chaos.social/tags/fintech" class="mention hashtag" rel="nofollow noopener" target="_blank">#fintech</a> 's grew, which is their whole job to handle this (and maybe legal/complaint stuff).In the <a href="https://chaos.social/tags/EU" class="mention hashtag" rel="nofollow noopener" target="_blank">#EU</a> we have regulation (<a href="https://chaos.social/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a>) which then allows such fintechs access to bank APIs and maybe this is somewhat standardized (?), but yet again… end-customers cannot access that? see: <a href="https://chaos.social/@rugk/113788438170275630" rel="nofollow noopener" translate="no" target="_blank">https://chaos.social/@rugk/113788438170275630</a>

HALLOWIEGEHTSPSD2 oder wie die Bundesdruckerei mit etwas das nichts kostet den Leuten Geld aus der Tasche zieht. Die vermieten tatsächlich x509 Zertifikate, die nur 2 Jahre halten, und lassen sich das richtig gut kosten. So ein Zertifikat zu erstellen ist ein Einzeiler in der Linux Konsole.<a href="https://goeppingen.social/tags/EU" class="mention hashtag" rel="nofollow noopener" target="_blank">#EU</a> <a href="https://goeppingen.social/tags/Bank" class="mention hashtag" rel="nofollow noopener" target="_blank">#Bank</a> <a href="https://goeppingen.social/tags/psd2" class="mention hashtag" rel="nofollow noopener" target="_blank">#psd2</a> <a href="https://goeppingen.social/tags/money" class="mention hashtag" rel="nofollow noopener" target="_blank">#money</a> <a href="https://goeppingen.social/tags/Geld" class="mention hashtag" rel="nofollow noopener" target="_blank">#Geld</a> <a href="https://goeppingen.social/tags/scam" class="mention hashtag" rel="nofollow noopener" target="_blank">#scam</a> <a href="https://goeppingen.social/tags/Korruption" class="mention hashtag" rel="nofollow noopener" target="_blank">#Korruption</a>

Kevin Karhan :verified:<a href="https://hachyderm.io/@lucasmz" class="u-url mention" rel="nofollow noopener" target="_blank">@lucasmz</a> I guess you never had to do payments within <a href="https://infosec.space/tags/EU" class="mention hashtag" rel="nofollow noopener" target="_blank">#EU</a> / <a href="https://infosec.space/tags/EFTA" class="mention hashtag" rel="nofollow noopener" target="_blank">#EFTA</a> / <a href="https://infosec.space/tags/SEPA" class="mention hashtag" rel="nofollow noopener" target="_blank">#SEPA</a> where <a href="https://infosec.space/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a> applies...<ul><li>Cuz <a href="https://infosec.space/tags/3Dsecure" class="mention hashtag" rel="nofollow noopener" target="_blank">#3Dsecure</a> is <a href="https://infosec.space/tags/VISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#VISA</a>'s implementation of it!</li></ul>Basically it boils down to mandating <a href="https://infosec.space/tags/2FA" class="mention hashtag" rel="nofollow noopener" target="_blank">#2FA</a> via <a href="https://infosec.space/tags/App" class="mention hashtag" rel="nofollow noopener" target="_blank">#App</a> or <a href="https://infosec.space/tags/SMS" class="mention hashtag" rel="nofollow noopener" target="_blank">#SMS</a> for any substantial online transaction...

Quincyrant, absichtlich falsch verstandene technik

dreiwert<a href="https://social.tchncs.de/@kuketzblog" class="u-url mention" rel="nofollow noopener" target="_blank">@kuketzblog</a> Gibt es empfehlenswerte (idealerweise quelloffene) Authenticator-Apps, die als <a href="https://digitalcourage.social/tags/psd2" class="mention hashtag" rel="nofollow noopener" target="_blank">#psd2</a> Authentifizierungsfaktor zulaessig sind?<a href="https://digitalcourage.social/tags/appzwang" class="mention hashtag" rel="nofollow noopener" target="_blank">#appzwang</a>

Kevin Karhan :verified:<a href="https://grapheneos.social/@GrapheneOS" class="u-url mention" rel="nofollow noopener" target="_blank">@GrapheneOS</a> +9001%The sheer amount of liabilities if not legal through <a href="https://infosec.space/tags/GDPR" class="mention hashtag" rel="nofollow noopener" target="_blank">#GDPR</a> & <a href="https://infosec.space/tags/BDSG" class="mention hashtag" rel="nofollow noopener" target="_blank">#BDSG</a>, but indirectly through.mandated <a href="https://infosec.space/tags/standards" class="mention hashtag" rel="nofollow noopener" target="_blank">#standards</a> like <a href="https://infosec.space/tags/PCIDSS" class="mention hashtag" rel="nofollow noopener" target="_blank">#PCIDSS</a> & <a href="https://infosec.space/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a> are the reason one should avoid storing them at all costs!

Erik van StratenAfter reading more in <a href="https://developer.mastercard.com/open-banking-europe/documentation/licensed/aiia-enterprise/production/tpp-certs/" rel="nofollow noopener" translate="no" target="_blank">https://developer.mastercard.com/open-banking-europe/documentation/licensed/aiia-enterprise/production/tpp-certs/</a> I noted:<<< We do not require a pass-phrase for the private key. [...] The requirement to set hostname on QWAC certificates is somewhat confusing, as this is a requirement for TLS server certificates, whereas QWAC certificates are TLS client certificates. >>>WHAT?From <a href="https://crt.sh/?id=12752024628" rel="nofollow noopener" translate="no" target="_blank">https://crt.sh/?id=12752024628</a>:<<< X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication >>>If my understanding is correct, an attacker who obtains access to the private key, sends a phishing mail asking to open https:⁄⁄bunq-com.aiiaclient.com and is able to inject falsified DNS replies (or some other possible network-based attacks), can trick users by showing them a fake bunq website - notably using a QWAC?I surely hope that I misunderstand all of this.If not: which idiot decided to put a domain name (instead of, for example, an email address) in a QWAC intended for client authentication?<a href="https://infosec.exchange/@agl" class="u-url mention" rel="nofollow noopener" target="_blank">@agl</a> <a href="https://infosec.exchange/@Tarah" class="u-url mention" rel="nofollow noopener" target="_blank">@Tarah</a> <a href="https://infosec.exchange/@ScottHelme" class="u-url mention" rel="nofollow noopener" target="_blank">@ScottHelme</a> <a href="https://infosec.exchange/@dangoodin" class="u-url mention" rel="nofollow noopener" target="_blank">@dangoodin</a> <a href="https://infosec.exchange/tags/QWAC" class="mention hashtag" rel="nofollow noopener" target="_blank">#QWAC</a> <a href="https://infosec.exchange/tags/ClientAuthentication" class="mention hashtag" rel="nofollow noopener" target="_blank">#ClientAuthentication</a> <a href="https://infosec.exchange/tags/ClientCertificate" class="mention hashtag" rel="nofollow noopener" target="_blank">#ClientCertificate</a> <a href="https://infosec.exchange/tags/ClientCertificates" class="mention hashtag" rel="nofollow noopener" target="_blank">#ClientCertificates</a> <a href="https://infosec.exchange/tags/ServerCertificate" class="mention hashtag" rel="nofollow noopener" target="_blank">#ServerCertificate</a> <a href="https://infosec.exchange/tags/ServerCertificates" class="mention hashtag" rel="nofollow noopener" target="_blank">#ServerCertificates</a> <a href="https://infosec.exchange/tags/TLS" class="mention hashtag" rel="nofollow noopener" target="_blank">#TLS</a> <a href="https://infosec.exchange/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a>

https://purl.org/rzr#<a href="https://talk.maemo.org/showthread.php?p=1572325#post1572325#" rel="nofollow noopener" translate="no" target="_blank">https://talk.maemo.org/showthread.php?p=1572325#post1572325#</a> <a href="https://mastodon.social/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a> : Yea I have been using a <a href="https://mastodon.social/tags/JP1" class="mention hashtag" rel="nofollow noopener" target="_blank">#JP1</a> with <a href="https://mastodon.social/tags/AndroidRuntime" class="mention hashtag" rel="nofollow noopener" target="_blank">#AndroidRuntime</a> but will it be future proof ? to support "forced intrusive apps" from banks , state etc ? <a href="https://hachyderm.io/@cyberlyra" class="u-url mention" rel="nofollow noopener" target="_blank">@cyberlyra</a>

Ellen TimmerRekeninginformatiediensten zijn in Nederland mislukt en <a href="https://mastodon.nl/tags/openfinance" class="mention hashtag" rel="nofollow noopener" target="_blank">#openfinance</a>/ <a href="https://mastodon.nl/tags/FIDA" class="mention hashtag" rel="nofollow noopener" target="_blank">#FIDA</a> hoort er niet te komen | <a href="https://mastodon.nl/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a><a href="https://ellentimmer.com/2024/04/19/psd2-34/" rel="nofollow noopener" translate="no" target="_blank">https://ellentimmer.com/2024/04/19/psd2-34/</a>

André BeringDie Gerätewechselprozesse bei verschiedenen Onlinebanken sind einfach so kaputt. Diese wurden von Experten mit Domänenwissen für Personen mit Domänenwissen entwickelt. Dieser ganze Mist kann keinem UAT mit Personen außerhalb einer Bank standhalten. <a href="https://chaos.social/tags/rant" class="mention hashtag" rel="nofollow noopener" target="_blank">#rant</a> <a href="https://chaos.social/tags/onlinebanking" class="mention hashtag" rel="nofollow noopener" target="_blank">#onlinebanking</a> <a href="https://chaos.social/tags/psd2" class="mention hashtag" rel="nofollow noopener" target="_blank">#psd2</a> <a href="https://chaos.social/tags/mfa" class="mention hashtag" rel="nofollow noopener" target="_blank">#mfa</a>

Alex JimenezThe State of <a href="https://mas.to/tags/OpenBanking" class="mention hashtag" rel="nofollow noopener" target="_blank">#OpenBanking</a>: Six Years After <a href="https://mas.to/tags/PSD2" class="mention hashtag" rel="nofollow noopener" target="_blank">#PSD2</a> <a href="https://thefintechtimes.com/open-banking-sixth-anniversary/" rel="nofollow noopener" translate="no" target="_blank">https://thefintechtimes.com/open-banking-sixth-anniversary/</a><a href="https://mas.to/tags/FinTech" class="mention hashtag" rel="nofollow noopener" target="_blank">#FinTech</a> <a href="https://mas.to/tags/FinServ" class="mention hashtag" rel="nofollow noopener" target="_blank">#FinServ</a> <a href="https://mas.to/tags/Banking" class="mention hashtag" rel="nofollow noopener" target="_blank">#Banking</a>

Caroline<a href="https://chaos.social/@hexmasteen" class="u-url mention" rel="nofollow noopener" target="_blank">@hexmasteen</a> Once upon a time, the <a href="https://hessen.social/tags/FIDO2" class="mention hashtag" rel="nofollow noopener" target="_blank">#FIDO2</a> standard was designed to support the requirements imposed on payment authentication by the <a href="https://hessen.social/tags/psd2" class="mention hashtag" rel="nofollow noopener" target="_blank">#psd2</a> in Europe. No browser ever implemented the corresponding extension (txAuth*), so it has been dropped from the resp. standard <a href="https://hessen.social/tags/WebAuthn" class="mention hashtag" rel="nofollow noopener" target="_blank">#WebAuthn</a>. So with <a href="https://hessen.social/tags/FIDO2" class="mention hashtag" rel="nofollow noopener" target="_blank">#FIDO2</a> / <a href="https://hessen.social/tags/passkeys" class="mention hashtag" rel="nofollow noopener" target="_blank">#passkeys</a> you'll not be able to securely transmit transaction data to the <a href="https://hessen.social/tags/authenticator" class="mention hashtag" rel="nofollow noopener" target="_blank">#authenticator</a>, which is a requirement in <a href="https://hessen.social/tags/psd2" class="mention hashtag" rel="nofollow noopener" target="_blank">#psd2</a> (Art. 5, secure visualization). <a href="https://hessen.social/tags/banking" class="mention hashtag" rel="nofollow noopener" target="_blank">#banking</a> <a href="https://hessen.social/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#infosec</a> <a href="https://hessen.social/tags/2fa" class="mention hashtag" rel="nofollow noopener" target="_blank">#2fa</a>

Recent searches

Search options

Administered by:

Server stats:

#psd2