User avatar
Miranda // erin // Eileen @erin@quiescent.nexus
2y
netherlands:
everyone speaks english.
“card only” signs everywhere.
“sorry, we’re forbidden from accepting cash”.
employees even at big grocery chains visibly confused by cash and struggling to count coins.

germany:
“was?”
“cash only” signs everywhere.
“sorry, card payments from 10eur only”.
“easy online payments, just provide your online banking login and password to sofort, it’s completely safe and totally does not blatantly violate the terms of agreement you signed with your bank”.
⭐3
3
10
0
3
User avatar
Thibaultmol 🌈 @thibaultmol@en.osm.town
2y
@erin I mean, I never liked Sofort, but what is the main problem with them? (except data selling or something I would assume)
1
0
0
0
User avatar
Miranda // erin // Eileen @erin@quiescent.nexus
2y
@thibaultmol so apparently this is no longer the case, but their system used to work like this:
you select your bank out of a list of supported banks.
you give them your login and password for the online banking interface of your bank - on their website, within their domain.
they log into your bank through the online banking web intrerface pretending to be a browser session.
they “click” through that to issue a money transfer in your name.

yes, this is exactly as insane and fucked up in terms of security as it sounds.
2
1
0
0
User avatar
Thibaultmol 🌈 @thibaultmol@en.osm.town
2y
@erin WTF

good yeah, understandable.

Tbf, I don't like how they do it for my bank either but atleast it's not as bad how you describe it.

Like, in Belgium we pay using Bancontact/Payconiq (our own payment system similar to Giropay in DE I guess?) and instead of just showing the qr code that I then scan with my phone; depending on how Sofort was implemented on the merchants website, it will do that OR it will ask me to sign in to my bank ... wait hold on... I need to check something ....
1
0
0
0
User avatar
Thibaultmol 🌈 @thibaultmol@en.osm.town
2y
@erin was about to test it on Steam but they actually switched to a different system that does now use the QR code.

But yeah, with Sofort often (not always, again depends on how the merchant implemented it iirc) you select your bank, login using "it's me" belgian auth method for banks/gov, and then you see all your accounts. Then you choose the account and do another it's me verification to actually do the transaction

and this was the case a year ago still
1
0
0
0
User avatar
Thibaultmol 🌈 @thibaultmol@en.osm.town
2y
@erin sounds an awful lot like what you're describing though.

Wanted to do a test just now to see exactly what permissions it was getting from the it's me auth. But either way, it was always a weird way of implementing it in my opinion.
1
0
0
0
User avatar
Miranda // erin // Eileen @erin@quiescent.nexus
2y
@thibaultmol they’re probably using a psd2-compliant api now.

before that was a thing, they literally used a glorified web scraper.

they tried to enter the polish online payment market while most polish banks explicitly state that you, the customer, must never give the login/password to anyone other than the bank itself and lose most safety guarantees if you do it willingly.
2
0
0
0
User avatar
Jeder neocat_floof_googly_woozy neocat_flag_agender 🔜 eth0 @jeder@miau.jeder.pl
2y
@erin @thibaultmol i remember when paypal had some "quick top-up" method in poland where it did sound very much like what sofort did and pretty much every site was rightfully pissed off about it
⭐1
1
0
0
1
User avatar
Thibaultmol 🌈 @thibaultmol@en.osm.town
2y
@jeder @erin meanwhile Belgium has a sketchy website that is not even on the paypal.com domain:
www.paypal-opladen.be/en/topup
Anyway to tell this is a legit website? nope. But it is from Paypal officially....
1
0
0
0
User avatar
Jeder neocat_floof_googly_woozy neocat_flag_agender 🔜 eth0 @jeder@miau.jeder.pl
2y
@thibaultmol @erin i mean that's what they seem to do everywhere because it's also a thing here
www.paypal-doladowania.pl
⭐1
1
0
0
1
User avatar
Jeder neocat_floof_googly_woozy neocat_flag_agender 🔜 eth0 @jeder@miau.jeder.pl
2y
@thibaultmol @erin and here's one of the articles about this debacle www.antyradio.pl/news/PayPal-chce-loginu-i-hasla-do-banku-8172 lmao
they had to conform to the criticism and like, actually use bank APIs nowadays
⭐1
0
0
0
1