undefined | Better HN

0 pointsbux931y ago0 comments

Yes, the Payment Services Directive requires "dynamic linking" to a specific amount and a specific payee in article 97, and the RTS in article 5 go on to say that the payer should be "made aware of the amount of the payment transaction and of the payee".

The most elegant implementation I saw of this were card readers with a 2D (colored) barcode scan ; the 2D barcode contained transaction details that the card reader would display on its screen. This was an effective control against MITM. But even I myself always misplaced the card reader.

So now, most confirmations are done using the banking app. Even if I use a credit card by filling in its details on a US website, I get a push notification on my phone to confirm the tx on my app.

The app asks for a password or uses biometrics, so thats 1FA, and the app is enrolled at some point, so the token on your phone (I presume in some secure storage) counts as the 'thing you have' for 2FA.

Enrolling the app nowadays usually entails scanning your ID card and a 'live selfie' (blink your eyes). And of course you get notified (via e-mail) that you just installed the app on some device.

0 comments

namibj1y ago

I preferred the blinky bars; the reader for them is tiny, not locked to an account, battery lasts what feels like forever, and they're cheap enough that you can trivially eat a loss (from forgetting where it is or leaving it in a place where it disappears before you get a chance to collect it).

Maybe just stick an airtag to the back?

bux93OP1y ago

The blinky bars were great! Already forgot about those. If I remember correctly, a problem with those were people with displays that had funky refresh rates? I think that in the current era that would be much less of a concern. Conceptually it's great to have an actual physical, airgapped device under your full control as your signing device.

namibj1y ago

You can just press on "slower" to fix that issue. Though really you should probably figure out how to get a decent refresh rate from your screen.

Also, it's not like they're gone, they're still going strong.

j / k navigate · click thread line to collapse

0 pointsbux931y ago0 comments

So now, most confirmations are done using the banking app. Even if I use a credit card by filling in its details on a US website, I get a push notification on my phone to confirm the tx on my app.

Enrolling the app nowadays usually entails scanning your ID card and a 'live selfie' (blink your eyes). And of course you get notified (via e-mail) that you just installed the app on some device.

0 comments

namibj1y ago

Maybe just stick an airtag to the back?

bux93OP1y ago

namibj1y ago

You can just press on "slower" to fix that issue. Though really you should probably figure out how to get a decent refresh rate from your screen.

Also, it's not like they're gone, they're still going strong.

j / k navigate · click thread line to collapse