<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-2022-jp">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi Anders,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Further to Nats questions, there is nothing stopping a confidential client being run on a mobile device. Indeed this is how a lot of Banks Mobile applications are written. With a confidential client on a mobile device there is nothing stopping the app from
interacting with a providers APIs using the FAPI Security profiles.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Joseph calls this out explicitly in implementation guidance section however there are significant challenges for implementation of this model under PSD2. The use of qualified certificates for 'identification' makes this almost impossible for a TPP to do safely
or at least in a way that would be appropriate from a risk point of view however, if a TPP wanted to do this they could.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Be interested to know where the specs technically don't work for confidential clients on a mobile.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
RB</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Openid-specs-fapi <openid-specs-fapi-bounces@lists.openid.net> on behalf of Nat Sakimura via Openid-specs-fapi <openid-specs-fapi@lists.openid.net><br>
<b>Sent:</b> Friday, July 24, 2020 6:20 AM<br>
<b>To:</b> Financial API Working Group List <Openid-specs-fapi@lists.openid.net>; Anders Rundgren <anders.rundgren.net@gmail.com><br>
<b>Cc:</b> Nat Sakimura <nat@sakimura.org><br>
<b>Subject:</b> Re: [Openid-specs-fapi] FAPI meeting request - Mobile app access</font>
<div> </div>
</div>
<div>
<div name="x_messageBodySection">
<div dir="auto">Hi.<br>
<br>
Certainly we can take it up as an agenda item but I would like to understand what you mean by FAPI methods. Could you please elaborate on it?</div>
</div>
<div name="x_messageSignatureSection"><br>
<div dir="auto">Nat Sakimura
<div dir="auto">Chairman, OpenID Foundation </div>
<div dir="auto">https://nat.sakimura.org</div>
</div>
</div>
<div name="x_messageReplySection">2020$BG/(B7$B7n(B24$BF|(B 15:04 +0900$B!"(BAnders Rundgren <anders.rundgren.net@gmail.com>$B$N%a!<%k(B:<br>
<blockquote type="cite">Hi FAPIers,<br>
<br>
Currently FAPI methods are only accessible by TPPs.<br>
<br>
This may be "by design" but it also makes the API less universal and force banks to create competing APIs.<br>
<br>
As an example some mobile wallets provide real-time account balances. This obviously requires a direct call to the associated bank.<br>
<br>
Could we have a meeting on this topic?<br>
<br>
Sincerely,<br>
Anders Rundgren<br>
</blockquote>
</div>
</div>
</body>
</html>