alt Hacker NewsSo we had something good in the Netherlands with iDeal, then they had to make it EU global and they messed it up.
For starters there is going to be percentage commission on each payment instead of just a flat fee low price like iDeal has. For some reason they felt compelled to introduce buyer protection like a credit card has, instead of just making it a digital debit payment system. And now we are also forced in to the Google ecosystem.
Great. Just great.
Why do they even feel they need the Google Play integrity API anyway? If you are really so concerned about the kind of attacks that supposedly fixes, you better ban Windows, macOS and Linux desktops and notebooks from banking online. Because their security model doesn't even come close to what Android or iOS has.
Replies
I have noticed zero change in using iDeal / Wero since the rebrand.
The reasoning goes like that. App is more secure than web because 1. you can share a password but can't share the shared secret generated when the app is bound to account (lol, yes, they believe so) and 2. It has certificate pinning so you can't be mitmed when the system trust store is manipulated
The app however is only secure as long as your system isn't rooted. To make sure it isn't rooted you need to ask somebody who signed the system image if the integrity still holds.
I heard interesting ideas about phones, such as all phones having secure enclave and hsm which the app is totally using, so you can't just lift both the encrypted secret and it's kek from the same filesystem
Wero is an initiative introduced by the banks, not by the EU government. They specifically lobbied to make the "digital euro" initiative much worse so that it doesn't compete with Wero. So it makes sense that Wero has the interests of the banks in mind.