Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
hachyderm.io is one of the many independent Mastodon servers you can use to participate in the fediverse.
Hachyderm is a safe space, LGBTQIA+ and BLM, primarily comprised of tech industry professionals world wide. Note that many non-user account types have restrictions - please see our About page.

Administered by:

Server stats:

9.4K
active users

hachyderm.io: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#psd2

0 posts0 participants0 posts today
Continued thread
Public
rugk

In Germany, #finanzguru is e.g. a very popular proprietary product that is mostly an app.

Apparently they got their own #PSD2 respectively (as I learned) #XS2A API (access to account API).

The thing is you need to get approved to use that, so for a customer, you cannot easily get access without a third-party or what?

hilfe.finanzguru.de/de/article

hilfe.finanzguru.dePSD2 im ÜberblickSeit September 2019 gilt die sogenannte PSD2-Richtlinie (Payment Services Directive 2) europaweit. Sie regelt, wie du deine Bankdaten sicher mit Dri...
Replied in thread
Public
rugk

@Xavier Well… in an ideal world we would have a standarized (and obviously secure) API that (nearly) all banks use. Or maybe even a few per region or so.

Of course, we don't. So apparently #fintech 's grew, which is their whole job to handle this (and maybe legal/complaint stuff).

In the #EU we have regulation (#PSD2) which then allows such fintechs access to bank APIs and maybe this is somewhat standardized (?), but yet again… end-customers cannot access that?

see:
chaos.social/@rugk/11378843817

chaos.socialrugk (@rugk@chaos.social)@kresus@tutut.delire.party ah uhm whyy? So they were only regulation for #fintech's? Does one need to ask for access or what is required? I mean these third-parties like #gocardless, #saltedge or #SimpleFIN bridge (#SimpleFINBridge) do need to get access to these, too? Are there more resources to learn here?
Public *
aerique

Here's my periodical lamentation on the (Dutch) banking system and the fact that in the year of (almost) 2025 I still cannot get easy API access to my own transaction data. Even not read-only.

I have to either scrape their website for a shitty CSV format file (or worse) or go through some skimming, #PSD2 middle-man asshole service.

Say what you want about crypto but the centralized exchanges have had this covered for more than a decade.

(Next, ask me about IBAN.)

Public *
HALLOWIEGEHTS

PSD2 oder wie die Bundesdruckerei mit etwas das nichts kostet den Leuten Geld aus der Tasche zieht.
Die vermieten tatsächlich x509 Zertifikate, die nur 2 Jahre halten, und lassen sich das richtig gut kosten.
So ein Zertifikat zu erstellen ist ein Einzeiler in der Linux Konsole.

#EU#Bank#psd2
Public
dorotaC

@iron_bug I don't know the case here, but the #bank regulation imposing the #PSD2 interoperability requirement is widely known as "third party access" and if you ask your bank for the #API to access your own data (I'm the first party, not third! I even wrote the software), then they will get confused.

Public
Sandro Santilli

La seconda direttiva europea sui sistemi di pagamento ( #PSD2 ) operativa dal 2021, obbliga le banche ad aprire le proprie API consentendo la gestione di qualunque conto da una qualunque app di propria scelta.

Quanti di voi hanno trovato ostacoli nella realizzazione di questo obiettivo ? Quali app consigliereste per una gestione centralizzata ? App #OpenSource ne abbiamo ?

#OpenBanking
Continued thread
Public
Erik van Straten

After reading more in developer.mastercard.com/open- I noted:

<<< We do not require a pass-phrase for the private key.
[...]
The requirement to set hostname on QWAC certificates is somewhat confusing, as this is a requirement for TLS server certificates, whereas QWAC certificates are TLS client certificates. >>>

WHAT?

From crt.sh/?id=12752024628:

<<< X509v3 Extended Key Usage:
TLS Web Client Authentication, TLS Web Server Authentication >>>

If my understanding is correct, an attacker who obtains access to the private key, sends a phishing mail asking to open https:⁄⁄bunq-com.aiiaclient.com and is able to inject falsified DNS replies (or some other possible network-based attacks), can trick users by showing them a fake bunq website - notably using a QWAC?

I surely hope that I misunderstand all of this.

If not: which idiot decided to put a domain name (instead of, for example, an email address) in a QWAC intended for client authentication?

@agl @Tarah @ScottHelme @dangoodin

developer.mastercard.comMastercard Developers
#QWAC#ClientAuthentication#ClientCertificate
Public
Marwe

Die #DB hasst ihre Kunden zunehmend und nennt den erzwungenen Vollzugriff aufs Bankkonto auch noch "Openbanking". Das ist nicht die Art von "open" wie sie sein sollte. Leider sind solche namenlosen Zecken im Business durch die #psd2 geadelt worden, jetzt sieht man, wohin das führt.
Buchung eines Tickets wird jetzt zuverlässig verhindert, habe das > 30 min. versucht, danach kommt leider nichts oder maximal Fehlermeldungen. eID wäre ja OK zur Prüfung der Identität, Kontoverlauf nicht
#dbnavigator

ExploreLive feeds
About