Hacker News Reader

> then receiving a code in a text message and typing it back, and now typing yet another personal code

Really? In my experience aside from typing the card numbers, all I have to do is approve the transaction with 3D secure which is one tap in my bank's app. It has never failed in my experience.

Maybe you need to switch banks? :)

It depends on how the payment is integrated, i guess.

Is some relatively local stores it's along the lines of:

  - check out an item in the cart
  - you're taken to a payment processor's page (gateway)
  - there you pick your payment method, e.g. which of the supported banks you use
  - then you enter your bank's user ID and personal identifier
  - then a prompt pops up on your phone (though you can also use a "code calculator") with a reference ID
  - you enter your PIN code to confirm the prompt on your phone, granting the gateway access to your bank account
  - it then lists your payment accounts, from which you pick one that you'd like to pay with
  - then you get yet another prompt on your phone, this time you have a separate longer PIN to enter for confirming the payment
  - you do so, the payment is processed and you're taken back to the store page, with your order placed

Note: that app (SmartID) that's used for the codes and confirmations isn't actually maintained by the bank, but is a separate entity, so to make a payment you might have to rely on the shop being up, the payment gateway being up, the confirmation solution being up and the bank also being up. Despite all of those vectors for failure, i've actually had a pretty good track record with this solution (i've only seen the bank's service crash once and the occasional store have issues).

Oh, and the app can also be used to confirm authentication for online banking: you enter your bank user ID and personal identifier, which makes a prompt pop up on your phone, so you also get 2FA there out of the box!

For anyone wondering: https://www.seb.lv/en/private/daily-banking/smart-id

Of course, the bank also has its own app where you can make payments to specific people, or request payments, as well as view your account balance and see how your investments are doing, which is pretty nice, though you cannot use it for confirming those purchases.

On global stores (e.g. the likes of Amazon, eBay, AliExpress etc.), however, the process is generally far less involved, you just check out an item that you want, shortly afterwards the money shows up as "reserved" on your account. If you don't recognize that order, you can dispute the charge. Of course, if you don't have card details saved, you would need to enter that information first (card number, name, expiration date, code), but the end result is the same there.

That said, despite the seemingly more cumbersome approach of integrating with the bank directly for payment processing instead of going with just the card approach, i'd say that it has some security advantages for sure! With this approach, even if my bank account is compromised, no one can make payments without having direct access to my phone AND knowing the codes (as long as the system works). Of course, many still choose to pay with their cards instead.

That always scares me, if you lose/break your phone you can't use your card any more?

You can still pay in person using chip & PIN or use an ATM without the app. This only applies to online shopping AFAIK.

Online shopping at the more secure sites.

Surely the bank's website offers the same security features, so that accounts may be accessed without a specific phone with a specific app. If not, then that bank should be avoided.

Security codes is a special case of fraud ruining things for everyone.

I recently gave up on becoming a Hetzner customer (to set up a Minecraft server for friends). After going through all the security checks it declined to provision the server, demanding a photo of me with my ID—even though it successfully made a transaction to validate my payment method, it matches my name and address on file, etc. I blame crypto miners playing chargebacks.

Hum... I think they require it from everybody that isn't from the EU. I don't know if they have any means of validating the identity of EU citizens, or if they do that too.

I imagine Germany has some laws about identifying who you host things for.

> incredibly painful

Now, now… calling extra security steps for online purchases ‘extremely painful’ and ‘economically detrimental’ seems a bit excessive.

In fact, I think these steps may be there just to make people feel more secure about buying online (this would totally work with my mom, who after many years of visiting me in the USA is still afraid of giving her card to the waiter in a restaurant to pay for dinner).

> this would totally work with my mom, who after many years of visiting me in the USA is still afraid of giving her card to the waiter in a restaurant to pay for dinner

To be fair - her instincts aren't bad. It was always a shitty security model, it led to a lot of fraud, and it was one of the design principles of Chip and Pin to eliminate it.

My dad calls this “punishing the masses for the indiscretions of the few”. Like airport security theater.

> in Europe, online payments are becoming annoying to a degree that would have been unthinkable ten years ago.

I'd just like to chime in here to say that this isn't universal across Europe. The dutch iDeal payment system only requires you to scan a QR code with your phone and enter your PIN also on your phone. I believe belgium at least uses a similar system, but I'm sure iDeal is not unique.

Not to discount your experience of course, sounds like a real hassle and an unnecessary one at that.

that tragedy is much more prolific than just security. It applies to workplace policies, classroom rules, tourism etc...

Revolut does this better. You put card info and press Approve in the app a few seconds later.

Three European accounts I sometimes use for online payments, each from a different country, don't make me miserable like that. Apparently one of these banks was founded early in Abraham Lincoln's presidency, so it's not a matter of choosing the new coolness too.

payU, BLIK and other processors mostly solve this but they seem to be popular only in some european countries. They also beat paypal easily.

Before, you had to go to the store.

Well, yes and no. There was a time when we could shop online without all this nonsense. It's getting worse every year, instead of better.

And also, going to the store has its own rewards. You get to talk to real people, see and touch the things you want to buy, etc.

Now we're alone behind a screen, jumping through absurd and arbitrary hoops that keep getting harder and harder (tried to solve a captcha lately) and fighting "AI" systems fed with stupid data.