Socel: Social for the Animation Arts

0 posts0 participants0 posts today

Kevin Karhan :verified:<a href="https://infosec.exchange/@katrinakatrinka" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@katrinakatrinka</a> <a href="https://universeodon.com/@digyoursoul" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@digyoursoul</a> <a href="https://hachyderm.io/@molly0xfff" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@molly0xfff</a> granted, compared to <a href="https://infosec.space/tags/CustomerProtection" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CustomerProtection</a> and <a href="https://infosec.space/tags/Regulations" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Regulations</a> in the <a href="https://infosec.space/tags/EU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EU</a>, <a href="https://infosec.space/tags/finance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#finance</a> inctue <a href="https://infosec.space/tags/USA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#USA</a> is a shitshow.<ul><li><a href="https://infosec.space/tags/Carding" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Carding</a> as a form of <a href="https://infosec.space/tags/fraud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fraud</a> doesn't really exist here, and the few possibilities does.with <a href="https://infosec.space/tags/PSD2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PSD2</a> mandating <a href="https://infosec.space/tags/3Dsecure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#3Dsecure</a> in <a href="https://infosec.space/tags/SEPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SEPA</a> member nations...</li></ul>

Kevin Karhan :verified:<a href="https://hachyderm.io/@lucasmz" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@lucasmz</a> I guess you never had to do payments within <a href="https://infosec.space/tags/EU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EU</a> / <a href="https://infosec.space/tags/EFTA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EFTA</a> / <a href="https://infosec.space/tags/SEPA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SEPA</a> where <a href="https://infosec.space/tags/PSD2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PSD2</a> applies...<ul><li>Cuz <a href="https://infosec.space/tags/3Dsecure" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#3Dsecure</a> is <a href="https://infosec.space/tags/VISA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VISA</a>'s implementation of it!</li></ul>Basically it boils down to mandating <a href="https://infosec.space/tags/2FA" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2FA</a> via <a href="https://infosec.space/tags/App" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#App</a> or <a href="https://infosec.space/tags/SMS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SMS</a> for any substantial online transaction...

QuincyFür das Weglassen einer einfachen und universellen Schnittstelle habe ich exakt null Verständnis ...nirgends. Auch bei der <a href="https://chaos.social/tags/Bank" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Bank</a> nicht. Das ist viel schlimmer. Fuck <a href="https://chaos.social/tags/PSD2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PSD2</a> 😡

dreiwert<a href="https://social.tchncs.de/@kuketzblog" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@kuketzblog</a> Gibt es empfehlenswerte (idealerweise quelloffene) Authenticator-Apps, die als <a href="https://digitalcourage.social/tags/psd2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#psd2</a> Authentifizierungsfaktor zulaessig sind?<a href="https://digitalcourage.social/tags/appzwang" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#appzwang</a>

Kevin Karhan :verified:<a href="https://grapheneos.social/@GrapheneOS" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@GrapheneOS</a> +9001%The sheer amount of liabilities if not legal through <a href="https://infosec.space/tags/GDPR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GDPR</a> & <a href="https://infosec.space/tags/BDSG" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#BDSG</a>, but indirectly through.mandated <a href="https://infosec.space/tags/standards" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#standards</a> like <a href="https://infosec.space/tags/PCIDSS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PCIDSS</a> & <a href="https://infosec.space/tags/PSD2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PSD2</a> are the reason one should avoid storing them at all costs!

pink<a href="https://ma.fellr.net/@fell" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@fell</a> I am not overly familiar with <a href="https://norden.social/tags/PSD2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PSD2</a> but there is an open standard for verifying arbitrary data in a challenge-response procedure based on a shared secret (like TOTP) called OCRA: <a href="https://www.rfc-editor.org/rfc/rfc6287" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.rfc-editor.org/rfc/rfc6287</a> <a href="https://hessen.social/@Caroline" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Caroline</a> <a href="https://101010.pl/@didek" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@didek</a> <a href="https://brotka.st/users/kaia" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@kaia</a>

Erik van StratenAfter reading more in <a href="https://developer.mastercard.com/open-banking-europe/documentation/licensed/aiia-enterprise/production/tpp-certs/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://developer.mastercard.com/open-banking-europe/documentation/licensed/aiia-enterprise/production/tpp-certs/</a> I noted:<<< We do not require a pass-phrase for the private key. [...] The requirement to set hostname on QWAC certificates is somewhat confusing, as this is a requirement for TLS server certificates, whereas QWAC certificates are TLS client certificates. >>>WHAT?From <a href="https://crt.sh/?id=12752024628" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://crt.sh/?id=12752024628</a>:<<< X509v3 Extended Key Usage: TLS Web Client Authentication, TLS Web Server Authentication >>>If my understanding is correct, an attacker who obtains access to the private key, sends a phishing mail asking to open https:⁄⁄bunq-com.aiiaclient.com and is able to inject falsified DNS replies (or some other possible network-based attacks), can trick users by showing them a fake bunq website - notably using a QWAC?I surely hope that I misunderstand all of this.If not: which idiot decided to put a domain name (instead of, for example, an email address) in a QWAC intended for client authentication?<a href="https://infosec.exchange/@agl" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@agl</a> <a href="https://infosec.exchange/@Tarah" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Tarah</a> <a href="https://infosec.exchange/@ScottHelme" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@ScottHelme</a> <a href="https://infosec.exchange/@dangoodin" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@dangoodin</a> <a href="https://infosec.exchange/tags/QWAC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#QWAC</a> <a href="https://infosec.exchange/tags/ClientAuthentication" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClientAuthentication</a> <a href="https://infosec.exchange/tags/ClientCertificate" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClientCertificate</a> <a href="https://infosec.exchange/tags/ClientCertificates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ClientCertificates</a> <a href="https://infosec.exchange/tags/ServerCertificate" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ServerCertificate</a> <a href="https://infosec.exchange/tags/ServerCertificates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ServerCertificates</a> <a href="https://infosec.exchange/tags/TLS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TLS</a> <a href="https://infosec.exchange/tags/PSD2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PSD2</a>

https://purl.org/rzr#<a href="https://talk.maemo.org/showthread.php?p=1572325#post1572325#" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://talk.maemo.org/showthread.php?p=1572325#post1572325#</a> <a href="https://mastodon.social/tags/PSD2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PSD2</a> : Yea I have been using a <a href="https://mastodon.social/tags/JP1" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JP1</a> with <a href="https://mastodon.social/tags/AndroidRuntime" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AndroidRuntime</a> but will it be future proof ? to support "forced intrusive apps" from banks , state etc ? <a href="https://hachyderm.io/@cyberlyra" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@cyberlyra</a>

Alejandro MartínezThere was only a single bank that I knew of, Wise, that let a customer use their APIs to read your account transactions... but not anymore, because of regulation 🫠In the EU, that's how PSD2 forces you to "buy" API access to your own personal bank account transaction data through a third-party🤦‍♂️<a href="https://hachyderm.io/tags/gdpr" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#gdpr</a> <a href="https://hachyderm.io/tags/psd2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#psd2</a> <a href="https://hachyderm.io/tags/data" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#data</a> <a href="https://hachyderm.io/tags/api" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#api</a> <a href="https://hachyderm.io/tags/banks" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#banks</a> <a href="https://hachyderm.io/tags/plaintextaccounting" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#plaintextaccounting</a>

Caroline<a href="https://mastodon.online/@ilyess" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@ilyess</a> You might be wrong in 2 ways, at least if I relate this to how mobile banking is working in Europe: 1) Weak passwords are only a risk if brute forcing is possible. In Europe, after 3 or 5 false attempts to enter the password, access is blocked. Complex passwords do not help when so. is shoulder surfing. 2) There might have been a second factor: the phone as a possession factor (activated through some other trust factor), and/or biometrics (so maybe even 3 factors).<a href="https://hessen.social/tags/psd2" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#psd2</a> <a href="https://hessen.social/tags/2fa" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#2fa</a> <a href="https://hessen.social/tags/Banking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Banking</a>

Recent searches

Search options

Administered by:

Server stats:

#psd2