Comment by 3np | Hacker News Reader

Comment by 3np | Hacker News Reader

Without having checked it out properly outside of the landing page, here's a brain-dump of things that competitors get wrong and you can improve by a lot:

  1. Support self-custodied 2FA: TOTP/U2F. Do not require phone-number/SMS "for your own protection".
  2. Be honest with your customers and users. Don't succumb to dark UX for the sake of control, engagement and growth. Allow setting separate notification settings for marketing/"news"/functionality/security, and don't silently add and enable new marketing channels.
  3. Full functionality even on devices without Google Play Services/SafetyNet/Apple. Preferably I should be able to do everything through the web UI, without requiring involvement of a native iOS/Android app.
  4. Adhere to a strict interpretation of the GDPR, regardless of where users/customers are geographically residing or located; No sharing PII with third-parties (above what you are legally required to do). No loading assets from third-party servers.
  5. Allow access over anonymized channels (mainly tor/paid VPNs)

A pinky promise on the above would make me sign up and recommend you to my network in a heartbeat. Would also be very curious to hear if you agree with me that the above are completely reasonable requirements/requests or if any of them stand out as something you may not be able or willing to do.

It looks like you're aiming for a USP of competitive fees but I think I'm not alone in being very happy to not get the absolutely cheapest rate compared to Wise/Revolut/Paypal/N26/PS/MG et al if you stay aligned with the above.

/ Someone who's fed up with the existing landscape

This is a good list. Point 3 alone would net a lot of customers alone, be it banking or other.

A lot of people, in the tens to hundreds of millions, not through choice of not wanting to use Google Play Services (or knowing what it is) cannot access Play Services on their locally purchased / locked device.

These people are largely outside North America / Western Europe, potential customers for whom a service such as that of OP may be very attractive.

1. We follow a "trusted devices" model, where you 2FA using your phone number for the first login on a device. Future logins on that device aren't 2FA'd. I agree that using a code gen is a good improvement we can make over time. 2. Marketing opt-out is prominent in account settings. Any email that is very strictly not transactional is considered marketing by our team, and can be opted out of. Developing simple, focused products is core to our identity and we won't add irrelevant features that might upsell to 10% of customers. I assure you there won't be a "refer your friends" badge blinking on the home page of the app. 3. Unfortunately we're not on web yet - but we'd love to get there after iOS and Android. We hear from most people that iOS or Android are their preferred platforms, so we have to start there. 4. We share data as required to support financial transactions and other core parts of the business, but we do adhere to the GDPR. 5. I think VPNs are allowed - at least I don't think we block them in particular.

We're excited to bring a fresh perspective and better pricing to a landscape with a lot of providers doing approximately the same thing. We'd love for you to try out the app once it's available - if you decide to register on our site we'll be sure to keep you updated.

Thanks for following up! (BTW, double line breaks if you want to make a HN comment more readable, or double leading spaces for blockquotes)

> We follow a "trusted devices" model, where you 2FA using your phone number for the first login on a device

It sounds like associating and verifying a phone number is required to sign up and use the service - is this something you're open to changing?

> I assure you there won't be a "refer your friends" badge blinking on the home page of the app

That's great! And TBH I wouldn't mind terribly as long as it can be permanently disabled after a first view.

> We hear from most people that iOS or Android are their preferred platforms, so we have to start there

Understandable. At the very least it would be a huge boon if we can expect to run the Android app without hickups on a fully degoogled Android device (e.g. GrapheneOS).

Will keep an eye on how things develop :)

Hi, other founder here. Thank you for your feedback!

>It sounds like associating and verifying a phone number is required to sign up and use the service - is this something you're open to changing?

Are you looking for something like Authy or Google Authenticator here?

> Are you looking for something like Authy or Google Authenticator here?

Precisely! Both are implementations of TOTP[0] - it's a simple protocol which doesn't rely on any particular implementation.

The other common one with that same characteristic would be Fido U2F[1] (for hardware keys such as Yubikey and Google Titan). If/when you do implement it, make sure to support adding more than one token to facilitate users sorting out their own backups.

Both are open standards that are well-supported with both proprietary and open implementations across platforms.

If you have to initially only pick one of the two I'd go with TOTP.

[0]: https://en.wikipedia.org/wiki/Time-based_one-time_password

[1]: https://en.wikipedia.org/wiki/Universal_2nd_Factor

Cool, we should be able to do this. Thank you for your feedback.

In addition, for regular users, consider providing free or subsidised hardware keys (yubikey, Google titan).

While many will raise concern with the UX of having to carry around hardware, in the fintech world I think it's a good tradeoff and raises the bar for the industry (I always shudder when I see "we use industry-standard protection"). :)

Reply on news.ycombinator.com