<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN">
<html><body style='font-family: Verdana,Geneva,sans-serif'>
<p>Thanks for letting us know. </p>
<p>Indeed, it is worrying. Would someone from this group be attending the Berling Group meeting? </p>
<p> </p>
<div>
<pre>---<br />Nat Sakimura
Research Fellow, Nomura Research Institute
Chairman of the Board, OpenID Foundation</pre>
</div>
<p>On 2017-10-03 23:06, Chris Michael wrote:</p>
<blockquote type="cite" style="padding-left:5px; border-left:#1010ff 2px solid; margin-left:5px"><!-- html ignored --><!-- head ignored --><!-- meta ignored -->
<p>Yes Dave - some worrying stuff.</p>
<p> </p>
<p>I am coordinating a response from OB.</p>
<p> </p>
<p>Would probably also add weight if you could do a separate FAPI response too.</p>
<p> </p>
<div id="Signature">
<div style="font-family: Calibri,Arial,Helvetica,sans-serif; margin: 0;">
<p style="font-size: 16px;"><strong><br /></strong></p>
<p style="font-size: 16px;"><strong>Chris Michael</strong></p>
<p style="font-size: 16px;">Head of Technology</p>
<p style="font-size: 16px;">Open Banking</p>
<p style="font-size: 16px;">+44 7767 372277</p>
<p style="font-size: 16px;"><a id="NoLP" href="http://www.openbanking.org.uk/">http://www.openbanking.org.uk</a></p>
</div>
</div>
<div style="color: #212121;"><hr style="display: inline-block; width: 98%;" />
<div id="divRplyFwdMsg" dir="ltr"><span style="font-size: 11pt; color: #000000; font-family: Calibri, sans-serif;"><strong>From:</strong> Openid-specs-fapi <openid-specs-fapi-bounces@lists.openid.net> on behalf of Dave Tonge via Openid-specs-fapi <openid-specs-fapi@lists.openid.net><br /><strong>Sent:</strong> 03 October 2017 14:46<br /><strong>To:</strong> Openid-specs Fapi; Torsten Lodderstedt; John Bradley; Nat Sakimura<br /><strong>Subject:</strong> [Openid-specs-fapi] Berlin Group Specs</span>
<div> </div>
</div>
<div>
<div dir="ltr">
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;">Hi all</div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;"> </div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;">The Berlin Group have started their consultation on their API specs for PSD2:</div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;"> </div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"><a href="https://www.berlin-group.org/market-consultations">https://www.berlin-group.org/market-consultations</a></span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"><a href="https://docs.wixstatic.com/ugd/c2914b_6a15d20b155a4d62922c67fe5a6e3dd5.pdf?index=true">https://docs.wixstatic.com/ugd/c2914b_6a15d20b155a4d62922c67fe5a6e3dd5.pdf?index=true</a><br /></span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"><br /></span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;">There are several worrying sections, for example:</span></div>
<div class="gmail_default"><span style="font-family: 'trebuchet ms', sans-serif;"><br /></span></div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left: 1px solid rgb; padding-left: 1ex;">When using OAuth2, the API calls will work with an access token instead of using the PSU credentials. The only admitted versions of the token grant step is the<strong> "user password grant"</strong> or the "authorization flow" of OAuth2. </blockquote>
<br clear="all" />
<div> </div>
<div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;">There are several sections where the end-user enters their banking credentials on the third party site...</div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;"> </div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;">OAuth 2 and OAuth are mentioned on many occasions but without reference to any security profile.</div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;"> </div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;">I think FAPI should respond.</div>
<div class="gmail_default" style="font-family: 'trebuchet ms',sans-serif;"> </div>
</div>
<div> </div>
-- <br />
<div class="gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div style="font-size: 1em; font-weight: bold; line-height: 1.4;">
<div style="color: #616161; font-family: 'Open Sans'; font-size: 14px; font-weight: normal; line-height: 21px;">
<div style="font-family: Arial,Helvetica,sans-serif; font-size: 0.925em; line-height: 1.4; color: #dc291e; font-weight: bold;">
<div style="font-size: 14px; font-weight: normal; color: #333333; font-family: lato,'open sans',arial,sans-serif; line-height: normal;">
<div style="color: #00a4b7; font-weight: bold; font-size: 1em; line-height: 1.4;">Dave Tonge</div>
<div style="font-size: 0.8125em; line-height: 1.4;">CTO</div>
<div style="font-size: 0.8125em; line-height: 1.4; margin: 0px;"><a style="color: #835ea5; text-decoration: none;" href="http://www.google.com/url?q=http%3A%2F%2Fmoneyhubenterprise.com%2F&sa=D&sntz=1&usg=AFQjCNGUnR5opJv5S1uZOVg8aISwPKAv3A"><img style="border: none; padding: 0px; margin: 7px;" title="Moneyhub Enterprise" src="http://content.moneyhub.co.uk/images/teal_Moneyhub-Ent_logo_200x50.png" alt="Moneyhub Enterprise" width="200" height="50" /></a></div>
<div style="padding: 8px 0px;"><span style="color: #00a4b7; font-size: 11px; background-color: transparent;">10 Temple Back, Bristol, BS1 6FL</span></div>
<span style="font-size: 11px; line-height: 15.925px; color: #00a4b7; font-weight: bold;">t: </span><span style="font-size: 11px; line-height: 15.925px;">+44 (0)117 280 5120</span></div>
<div style="color: #616161; font-size: 14px; font-weight: normal; font-family: lato,'open sans',arial,sans-serif;"><span style="color: #00a4b7;"><span style="font-size: 11px; line-height: 15.925px;"><br /></span></span>
<div style="color: #333333; line-height: 1.4;"><span style="font-size: 0.75em;">Moneyhub Enterprise is a trading style of Momentum Financial Technology Limited which is authorised and regulated by the Financial Conduct Authority ("FCA"). Momentum Financial Technology is entered on the Financial Services Register </span><span style="font-size: 0.75em; background-color: transparent;">(FRN </span><span style="font-size: 0.75em; background-color: transparent; color: #00a4b7; font-weight: bold;">561538</span><span style="font-size: 0.75em; background-color: transparent;">) at <a href="http://fca.org.uk/register">fca.org.uk/register</a>. Momentum Financial Technology is registered in England & Wales, company registration number </span><span style="font-size: 0.75em; color: #00a4b7; font-weight: bold; background-color: transparent;">06909772</span><span style="font-size: 0.75em; background-color: transparent;"> </span><span style="color: #222222; font-family: arial,sans-serif; background-color: transparent;"><span style="font-size: xx-small;">©</span></span><span style="font-size: 0.75em; background-color: transparent;"> . </span><span style="background-color: transparent; font-size: 0.75em;">Momentum Financial Technology Limited 2016. </span><span style="background-color: transparent; font-size: 0.75em; color: #888888;">DISCLAIMER: This email (including any attachments) is subject to copyright, and the information in it is confidential. Use of this email or of any information in it other than by the addressee is unauthorised and unlawful. Whilst reasonable efforts are made to ensure that any attachments are virus-free, it is the recipient's sole responsibility to scan all attachments for viruses. All calls and emails to and from this company may be monitored and recorded for legitimate purposes relating to this company's business. Any opinions expressed in this email (or in any attachments) are those of the author and do not necessarily represent the opinions of Momentum Financial Technology Limited or of any other group company.</span></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
<br clear="both" /> Please consider the environment before printing this email.<br /><br /> This email is from Open Banking Limited, Company Number 10440081. Our registered and postal address is 2 Thomas More Square, London, E1W 1YN. Any views or opinions are solely those of the author and do not necessarily represent those of Open Banking Limited. <br /><br /> This email and any attachments are confidential and are intended for the above named only. They may also be legally privileged or covered by other legal rights and rules. Unauthorised dissemination or copying of this email and any attachments, and any use or disclosure of them, is strictly prohibited and may be illegal. If you have received them in error, please delete them and all copies from your system and notify the sender immediately by return email.</blockquote>
</body></html>