Hacker News Reader

Comment by tut-urut-utut | Hacker News Reader

It's funny that I haven't heard about it before, although I live in Germany and Klarna is probably the biggest payment processor in Germany.

Luckily, I haven't used it. I never liked that one need to provide his bank login data to Klarna / Sofort to use it. How is that even legal?

EDIT: I haven't heard about Klarna outage, Klarna is well known.

View on HN

> I never liked that one need to provide his bank login data to Klarna / Sofort to use it. How is that even legal?

I am parroting other HN comments here, but the reason this is necessary is because banks do not provide a public (or private) API except between other banks. Therefore the only avenue for integration would be directly accessing the account.

I wish this wasn't normal to me, but I've been fully conditioned to expect this from QuickBooksOnline

They do though. PDS2 requires all banks to have an accessible API.

This is different from banks actually _having_ an API. Many have stalled or successfully asked for exemptions, and even those who have gone ahead and, to some extent, complied, have still tried to make their APIs as difficult to use, feature-poor, and unreliable as possible. Source: worked at a bank which actually tried to do this well, and which also offered functionality which required us to integrate with other banks' APIs.

Not really true in Germany where FinTS and its precursor HBCI have been supported by many banks since the 90s or so. Ironically, it's typically the hip start-up banks like N26 that don't support this standard.

> How is that even legal?

It's worse than that. Several banks tried to enforce in their terms and conditions that sharing your bank login data would be a breach of contract or at least absolve the bank of any liability. This was deemed in violation of antitrust laws for some reason, so now banks have to actively allow this which is just brain-dead IMHO.

The only upside of this is that we now have PSD2 now anyway, so the damage that can be done by someone who has your login credentials is limited.

> This was deemed in violation of antitrust laws for some reason

My best guess at what that "some reason" may be is that it breaks shoddily built integrations like [Teller](https://teller.io/), which, instead of using schemes like Open Banking where available, simply rely on credential sharing.

For others wondering what PSD2 is: https://en.wikipedia.org/wiki/Payment_Services_Directive and there were also a lot of "what is it and how does it affect you" articles from name brand bank websites, too, but I figured start here

In Finland it is illegal to give your bank login data to others, including scrapers. One couple both got sentenced when the other used the bank login data left on table to order something online. Fraud for the other and neglegence of leaving the login data easily accessible for the other.

I agree, haven’t used it (knowingly) and regularly order from other sites if klarna is the only payment option.

Are you certain you haven’t used it? Some shopping sites use them as payment processor for regular CC transactions without much visibility. You have to look at the T&C to even notice.

I usually don't leave CC info on some random site, only to major and well known. If the site is unknown, it's either PayPal, "pay by invoice" or no order at all.

Either PayPal or CC issuer provide at least some buyers' protection, while given your bank credentials to Klarna is normally against ToC of your bank.

I try not to use PayPal in the hope they will become irrelevant as a business (I know, not holding my breath), mainly because their customer service and fees are terrible.

CCs are not a great mechanism and I wished we had better bank services and safer integrations to process payments, but that's what we have. I check my bank statement regularly and I know I can get money back if fraud happens. If I don't trust a website I used a prepaid with the exact amount on.

> I usually don't leave CC info on some random site, only to major and well known.

That's the whole point of klarna (who also do CC processing so might have used them unknowingly): you don't need to trust Johnny's Little Online Store handling your CC, since the payment is handled by klarna.

The irony is, as a buyer, I trust unknown Johnny's Little Online Store as much as Klarna. Maybe even more, since I can give a Little Johnny the benefit of the doubt.

But in practice it's either invoice, PayPal or CC. Even if Klarna process that payment in the background, I can still object to my CC company and let them settle it, instead of having to deal with them.

Do you believe Johnnys has the resources to create a secure payment system and keep it secure?

Also, Klarna is a major invoice and CC processor. You probably have already used them unknowingly.

Reply on news.ycombinator.com