<div dir="ltr">HI Nat,<div><br></div><div>I suspect his problem is not the redirection per se, but a redirection "to the Banks' Web pages or apps"</div><div><br></div><div>I guess he would prefer to have redirection to a public OP and not to the banks' ones though it's just me guessing</div><div><br></div><div>Thanks,</div><div><br></div><div>Philippe </div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sat, Mar 9, 2019 at 3:31 PM nat via Openid-specs-fapi <<a href="mailto:openid-specs-fapi@lists.openid.net">openid-specs-fapi@lists.openid.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Restarting the thread as I want to make a youtube video on this one and <br>
want to hear your opinions.<br>
<br>
So, Mr Dombrovskis says:<br>
<br>
"I would like to encourage industry players to shift their attention <br>
away from authentication methods that are redirecting TPP customers to <br>
the banks' webpages (or apps). This cannot be the basis for innovative <br>
and competitive European payment services. Instead, the focus should in <br>
my view be on the development of convenient and secure new <br>
authentication methods. Such new forms of authentication, which are now <br>
more and more widely used, can be linked to e-IDs, issued by public <br>
authorities or private entities as in the Nordic countries, that may be <br>
used by customers with numerous market participants..."<br>
<br>
What I do not understand is that why he thinks "Such new forms of <br>
authentication" does not involve a redirect.<br>
As far as I understand, "private entities as in the Nordic countries" <br>
uses either SAML or OpenID Connect and make use of "redirect" to perform <br>
the user authentication that is linked to e-IDs, and they are provided <br>
by banks. If I am right, then the above statement is saying:<br>
<br>
"Shift their attention away from authentication methods that are <br>
redirecting TPP customers to the banks' webpages (or apps) to <br>
authentication methods that are redirecting TPP customers to the banks' <br>
webpages (or apps)."<br>
<br>
It just does not make sense...<br>
<br>
I could go on with a generic Youtube video showing how redirecting can <br>
be non-intrusing but I wanted to understand the above statement better.<br>
<br>
Best,<br>
<br>
Nat<br>
<br>
On 2019-02-22 18:25, Dave Tonge via Openid-specs-fapi wrote:<br>
> Dear FAPI WG<br>
> <br>
> I just received this and think it may be of interest to you:<br>
> <br>
> Please find attached a letter and attachment from Commission Vice<br>
> President Dombrovskis.<br>
> <br>
> He has made some discouraging comments about redirection to webpages<br>
> and apps:<br>
> <br>
> “I WOULD LIKE TO ENCOURAGE INDUSTRY PLAYERS TO SHIFT THEIR ATTENTION<br>
> AWAY FROM AUTHENTICATION METHODS THAT ARE REDIRECTING TPP CUSTOMERS TO<br>
> THE BANKS' WEBPAGES (OR APPS). THIS CANNOT BE THE BASIS FOR<br>
> INNOVATIVE AND COMPETITIVE EUROPEAN PAYMENT SERVICES. Instead, the<br>
> focus should in my view be on the development of convenient and secure<br>
> new authentication methods. Such new forms of authentication, which<br>
> are now more and more widely used, can be linked to e-IDs, issued by<br>
> public authorities or private entities as in the Nordic countries,<br>
> that may be used by customers with numerous market participants…”<br>
> <br>
> …“I also invite industry players to work together to find<br>
> practical solutions to other problems that payment initiation service<br>
> and/or account information service providers are facing. One of them<br>
> is the regular renewal, every 90 days, of consent for the TPPs’<br>
> access to accounts. This consent renewal requires STRONG CUSTOMER<br>
> AUTHENTICATION, WHICH WOULD BE A MAJOR INCONVENIENCE IF DONE FOR EACH<br>
> BANK USING CONVENTIONAL AUTHENTICATION METHODS AND POSSIBLY<br>
> REDIRECTION TO THE BANKS’ AUTHENTICATION PAGES.”<br>
> <br>
> Dave<br>
> _______________________________________________<br>
> Openid-specs-fapi mailing list<br>
> <a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank">Openid-specs-fapi@lists.openid.net</a><br>
> <a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-fapi</a><br>
_______________________________________________<br>
Openid-specs-fapi mailing list<br>
<a href="mailto:Openid-specs-fapi@lists.openid.net" target="_blank">Openid-specs-fapi@lists.openid.net</a><br>
<a href="http://lists.openid.net/mailman/listinfo/openid-specs-fapi" rel="noreferrer" target="_blank">http://lists.openid.net/mailman/listinfo/openid-specs-fapi</a><br>
</blockquote></div>