It’s a difficult thing, we don’t want to have to force smartphone choices but the number of users without one these devices is so vanishingly small it’s very difficult to change the legislation in order to support them too.
I think the happy middle ground is making this system also work with bank issued cards.
(GrapheneOS does support remote attestation, but the app needs to add their verified boot key fingerprints.)
What i mean is can you use this to pick up a slab of beer in albert hein, or just to transfer some cash to a friend or such?
But instant online iDEAL payments etc. work fine. Person to person payments using Tikkie/betaalverzoek as wel.
Put differently, I never use my bank's web interface, only the phone app.
Though the Sparkasse is the same actually, unsure about the other german banks
Instant payments bypass typical surveillance and fraud systems and so need some kind of authentication, if you don’t want to 2fa every time you’re at the checkout then the application has to have been previously authenticated (e.g setup with some kinda TAN from your bank) and execute on an attested device. We can def extend attestation to other devices (e.g is the kernel modified, does the app have reasonable version and checksums etc) but again, who is gonna fund that for 10 users?
edit: We have a long road to go before this stuff gets better, I think we should be happy at each step instead of really wishing we were already at the finish.
For the same reason, a pure WebAuthn flow in a compliant browser could technically implement secure payment confirmation mandated by the DSP, but afaik no bank does that, and the W3C is still working on the spec.
Our governments can't even manage not to depend on Microsoft/Google/AWS (and Palantir, the US military industrial complex, Israel, ...), our banks are regularly under the fire of extraterritorial bullshit due to the USD dependence.
Being worried about consumer devices and their OS is cute, but it's missing the forest for the trees.
> I think the happy middle ground is making this system also work with bank issued cards.
That wouldn't let me pay online.
You are missing the point. The issue is that once the "vanishingly small" number of alternatives disappears, users will be completely trapped, and Google and Apple will then free to abuse that position of power (they already do). Worse, since power is centralized, it is very easy for government interference to take place, and we already see that with things such as identity and age verification requirements. It is the possibility of competition that matters more than actual competition.
Your account is from 2021. There were a lot of "Paypal locked my account and all my money is in there" stories at least 10 years before that year.
So YMMV.
The device called "Smartphone" is only used to collect every possible detail about your life. The smart thing on a "Smartphone" is that, besides your bank, a lot of other "vendors" have access (not only) to your financial information.