Comment by microtonal | Hacker News Reader

Comment by microtonal | Hacker News Reader

Parent Full thread

If Wero is going to be similar to iDEAL, which it is based on, the payment flow will be through your bank's app. Heck, even the Wero app description says so:

The Wero app is available only for account holders from the German bank Postbank and the French bank La Banque Postale.

Are you a customer of another Wero-enabled bank? If so, you can easily use Wero within your banking app.

https://play.google.com/store/apps/details?id=eu.epicompany....

I have seen quite some people downloading their banking apps through the Aurora store (admittedly, it's a frontend for the Play Store, but you don't need an account or the app). Or you can use something like APKMirror and verify that they have the correct signing keys.

Of course, if they need Play Services or Play Integrity basic, then you need sandboxed Google Play or microG. If your bank does remote attestation through Play Integrity, then it is game over, but it is worth contacting your bank. E.g. some banks have added the GrapheneOS signing keys and added support for AOSP remote attestation.

Im a German with a German Postbank account, living in Switzerland.

Wero app Play Store page: "This item isn't available in your country."

Hard to cheer for a thing when it prevents you to access your own money, and promises to "easily pay" immediately fall flat.

Paypal is bad but at least it doesn't fail at step 0.

To be fair, how is Google blocking you from downloading an app, a Wero problem though?

The publisher, in this case Postbank, decides what countries to allow installs from for an app. Google just enforces the policy the publisher sets.

Country availability is a policy set up by the app publisher, not a Google policy

Which is complete bullshit with the Euro having been specifically invented to be used across the EU.

I had a similar moment of stupidifiedment trying to park in Germany with a phone set to Dutch region. Euro in cash works everywhere Euros are accepted but apps on the freaking Internet? Nah, gotta restrict that to the publisher country only.

Switzerland is not part of the EU nor the Eurozone though. It's still a shortsighted stance of Postbank not to open the app to at least the DACH region, but that specific argument carries little weight.

I accidentally skipped that part :(

I mean, there's some reason for it as EU countries have different laws and regulations, but yes, it's a dumb choice on the publisher's part

I can pay with iDEAL without interacting with a smartphone, using only my laptop and a physical 2FA device provided by my bank. Do you know if this will be possible with Wero?

I am not 100% sure, but I think PSD3 will require that authentication methods without a smartphone are provided:

https://ec.europa.eu/commission/presscorner/detail/fr/qanda_...

Require payment services providers to ensure that all users can benefit from methods to perform SCA which are adapted to their needs and situations and, in particular, that those methods do not depend on one single technology, device or mechanism, for instance on the possession of a smartphone.

It's up to your bank actually. Banks (generally) don't want to pay for your hardware key so you need to do a special dance to trigger their compliance bound neural pathways to send you one.

But then the true bliss will arrive the next year with eidas 3.0 or whatever it is called

In the Netherlands this boils down to the 'system banks' (the big ones like ING, ABN AMRO, Rabobank, etc.) which grudgingly offer hardware devices for people who won't or can't use a smartphone, and the neobanks (like Revolut, Knab, and Bunq) which make an Android or IOS smartphone a hard requirement.

ASN Bank has a website that allows you to set a browser-linked code once, after verifying both your email address and phone number. You can then use that browser+code as the 2FA device. It's pretty neat.

With Nordea, you get a code book full of one-time codes.

I have German bank accounts at two different banks and can send SEPA SCT instant transactions via webinterface and physical tan generator with both of them. Wero however is restricted to mobile apps regardless of what your tan generator is and in fact from what I heard, banks generally force you to switch to mobile app tan generators when opting into Wero.

The GLS bank implies it's not up to them. Generally I feel like implementation details are intentionally not made public. For example so far there is no definitive statement on the public internet I could find about whether iDEAL web based payments will still be available after iDEAL will actually switch to Wero. Statements like "For consumers, the online payment experience will remain largely unchanged, as they will continue to pay through their own bank." are always kept vague.

I'm not sure I understand the question actually. Will it work the same way for consumer as ideal does now? Yes, that the promise. Will the actual protocol and endpoints used be the same? I guess not, but also nothing drastic for integrators to worry about.

What I don't get is -- what will be added on top of what ideal already does.

>The GLS bank implies it's not up to them.

They probably can't make two systems within the bank talk to each other for whatever reason. One reason could be -- we are afraid to touch one side and the other is supplied by a vendor. Or politics, or just a plain skill issue. I'm not them and can't possibly know, but my employer was named in comments already, so I feel like I can extrapolate a bit

Oh wow actual news: https://nos.nl/artikel/2624737-scanner-van-ing-kan-nieuwe-id...

google translate: https://nos-nl.translate.goog/artikel/2624737-scanner-van-in...

This looks like it proves me wrong and at least two dutch banks will not require a smartphone app to pay with Wero, if this actually refers to the upcoming actual Wero transition.

> At Rabobank, "approximately 8 percent of all transactions" are conducted using the Rabo Scanner, says a spokesperson. A spokesperson says that research shows that 15 percent of customers prefer using the scanner instead of the app because they find the Scanner secure.

> There are no problems at Rabobank with the transition from iDeal to Wero, according to a spokesperson. Therefore, nothing changes for customers who use the Scanner with the transition this autumn.

> At ABN Amro, the tool for making payments via online banking is called the E.dentifier. According to a spokesperson, around 250,000 ABN Amro customers are using this device this month, which is 4 percent of the total. The number of users is declining because, according to the bank, more and more customers are switching to the app.

> Although ABN Amro intends to continue offering the internet banking function, including for payments via Wero, the bank will be phasing out the E.dentifier over the coming year. ABN Amro is currently already in the process of informing the first private customers about the switch to the so-called USB Security Key. The E.dentifier will only disappear once all customers have made the switch.

This gives me some hope that this might also be possible in the rest of Europe...

That's encouraging. It also suggests banks recognize that removing hardware authenticators entirely would lock out a non-trivial group of customers. Hopefully the transition ends up being "app-first" rather than "app-only."

Will it work the same only for users who use banking apps for ideal, or also for users who use their banking websites to pay with ideal? It's a rhetorical question, right now people can only give their opinion what their statements mean or not. We'll have to wait until the end of next year to see what's actually going to happen. Unless EPI or banks decide to publish an actual roadmap with actual features.

Reply on news.ycombinator.com