W3C announces new Web standard for online payments | Hacker News Reader

W3C announces new Web standard for online payments

applemust.com

185 pointsserhack_102 comments

The W3 press release and a relevant Chrome link,

https://www.w3.org/2023/06/pressrelease-spc-cr.html.en

https://developer.chrome.com/articles/secure-payment-confirm...

W3C should standardize cookie policy banners, and popups. This monstrosity of a feature should have always been a browser feature, not a burden for web developers.

I never understood why websites are required to inform about cookies if it's acutally the browsers who store the cookies on the device and send them back to the server.

How about a domain.tld/.well-known/cookies.txt file that contains a description about each cookie-key and then let the browser provide the UI for displaying that information and being configurable on which individual cookies to store for how long? (and for example discard all cookies that are not described in the cookies.txt file)

A voluntary feature for the convenience of users in choosing whether to have specific cookies?

That won't work. The cookie banners are annoying and tricky on purpose.

Because it's not just about cookies. There are two laws at play, the GDPR and the ePrivacy directive. It's a mix of cookies, local storage, allowing the browser to load third party tracking scripts after information/consent, and data processing taking place on the server side. Simply solving cookies won't make the banners go away.

Websites are legally required (both e-privacy directive and GDPR) to inform users (at least those from the EU) about what user information they store/track. This pertains to cookies as well as any other methods of doing so. Since they're the ones doing that, it makes sense that they're the ones with the legal obligation. It just so happens that just about every website decided to make this incredibly obnoxious, instead of respecting their visitors.

As a legal professor said (paraphrased): it was amazing to see an entire industry come together to undermine legislation.

Ok, lets rephrase it a different way:

Why are websites required to inform a user about data tracking and required to ask for consent in a custom implemented, not-machine-readable dialog/poup. The user can not even check if the tracking is actually disabled once they clicked "decline" or "only accept technical required cookies".

Why not require websites to provide that information on a per-file/per-cookie/per-localstorage-key level. Then browser could block all js-files/cookies/storage-entries that have now proper description included (eg, in an http-header for files, or a robots.txt-like cooies.txt file, or as standardized comment at the top of a js file).

Currently there are extension like no-script taht block everything, but how about allowing/requirig site-owners to annotate files with tracking meta data in order to be unblocked?

They are not. They are required to inform and ask for the user’s consent to process their information. They have to provide a way to retract that consent at any time too. How they do it is mostly beyond the scope of the legislation. They have to provide some points of contact but that’s about it.

Since I'm getting 500 errors, https://www.w3.org/TR/secure-payment-confirmation/

It's not clear to me from the article how this is supposed to work.

My favourite payment system is still the Dutch iDeal: marchant creates a payment request, redirects the user to their own bank, the user uses thhe bank's authorization system to authorize the payment, informs the merchant that payment is successful, and then redirects the user back to the merchant who now knows the transaction is successful, without having to know anything about how the user paid.

How is it different than the Payment Request API?

This is explicitly to authenticate payment, cryptographically sign/verify user consent. It’s about authentication and less about the paying.

Whew. I saw the word crypto… and figured that the W3C is running a ponzi scam. No one is above ridicule the moment I see crypto involved! It has no good use cases and that’s final

Sounds like it's Payment Request API + the biometric verification, so no more "open your bank app to approve this transaction"

That's the whole part I liked about Payment Request API

Adds integration with WebAuthn to skip 3DSecure/SCA popups in cases where the user has a biometric authenticator that's been registered with the bank

Let's hope you can't just pass through "NoNe" as the algorithm and break the entire thing like some JWTs

How is this going to integrate with my banking app, though? I quite like the Apple Pay or iDeal approaches. I don't really want my browser to confirm payments to be honest.

On the one hand seems convenient, but on the other, I'm not a fan of tech that lowers the friction between my money and my pocket.

Let’s go back to mailing personal checks to shareware companies

Don't forget to mail them the floppies to load up and send back :-)

What are you going to use the money for, if not spend it on something?

Are you going to make a pile of gold and sit on it like a dragon?

Some people like to save and invest instead of spending every single cent they have.

We'd be a much more stable society if the majority of the population wasn't one paycheck away from being financially ruined.

37% of Americans don't have enough savings to cover a $400 emergency[0]. That percentage goes up as the amount goes up and a $400 emergency is easy to hit - medical bill, moving expense, car repair, etc. It becomes 68% at $1,000[1].

[0]https://fortune.com/2023/05/23/inflation-economy-consumer-fi... [1]https://fortune.com/recommends/banking/57-percent-of-america...

Saving and investing are not realistic options for you if you're living paycheck to paycheck. That's why it's called that, because you have no money left over after paying for your necessities. Sometimes you don't even get to cover all your bills and you start racking up debt or are forced to be clever with frugality (read: giving up recurring payments like healthcare).

Saving money is basically buying into the baning industry’s narrative of a fat bank account, or of borrowing money in order to pay it off for 30 years.

Now investing is another story! Buy durable things with your cash that hold value over time!

Those studies are horribly misinterpreted. Look at the original data, it includes using a credit card as not having the money...

That still counts in my book. If you have to borrow money then you don't actually have it.

Right, because people don't use credit cards for the additional protection, points or miles. It's because they are all borrowing money they don't have.

And billionares who borrow money because it's tax efficient must all be secretly broke too. /s

> Right, because people don't use credit cards for the additional protection, points or miles.

I actually don't know, because I'm not American. Over here just having a credit card draws questions about one's financial stability and responsibility.

At the end of the day it's really not your money you're spending like that. I mean - it's in the name even. You'll have to pay it back eventually.

> actually don't know, because I'm not American.

Neither am I.

> At the end of the day it's really not your money you're spending like that. I mean - it's in the name even. You'll have to pay it back eventually.

Eventually in this case is in less than 50 days. In the 15 or so years that I've been using credit cards, I have never once failed to pay off the bill in full before the due date. And the miles and points I've accrued have saved me significant amount of money.

> Over here just having a credit card draws questions about one's financial stability and responsibility.

I am really curious to know where in the world that is. Even if that is the general perception, it is unlikely to be actually true. Even in Germany, the rich use credit cards at a higher rate than the poor. That is a pattern you'll see replicated the world over. Getting approved for a premium credit card requires one to have a demonstably good income and credit score. So, having such a card is an indicator of strong financial stability and responsibility.

> In the 15 or so years that I've been using credit cards, I have never once failed to pay off the bill in full before the due date

Yeah, but that's you. People living paycheck to paycheck don't have a realistic chance of achieving the same.

> I am really curious to know where in the world that is. Even if that is the general perception, it is unlikely to be actually true.

Poland. Out of 44mln payment cards issued, less than 5mln are credit cards. This is reflected in statistics:

https://www.theglobaleconomy.com/rankings/people_with_credit...

> So, having such a card is an indicator of strong financial stability and responsibility.

Yeah, such a card, not any card. Over here the most popular type of debt is one taken to purchase consumer goods like appliances and electronics in installments, mortgages are second.

Upper-middle class people and higher just buy things cash. There's no benefit in stretching this out if you can afford not to and any, even accidental, delay might hurt one's credit score - not worth it.

The GP's point was that counting someone using credit cards as living paycheck to paycheck is flawed. Especially moreso in a country that had high credit card penetration.

Your contention might be true in Poland. But that most definitely is not universal.

Investments are not very liquid on the time scale of less than a day. It's very often not about having to borrow money, it's about being able to leave less money sitting idle in your bank account.

I think maybe the focus of GP was on impulse purchases, but more likely it was just a cheeky comment.

That’s what I ask all the 401k nerds. You could literally die next week. Sure seems like a great way to live; when you’re young and in your prime, live below your means to max out your 401k, which there’s a fair risk you won’t live to see or enjoy, or… just stop hoarding money and live your life (I’m not saying be financially ignorant or irresponsible).

17.27% of men don’t live to age 60, and another ~6%, or 23.57% of men overall, don’t make it to age 65.[1] For reference, one must typically be age 59.5 before they can withdraw from their 401k without penalty.

So, if you save for 40 years, live below your means so you can maybe have a chance at enjoying all that money you’ve socked away. Pretty crazy to think that nearly a quarter of us won’t live to see or use the money beyond 5 or 6 years after retirement.

* [1] - https://www.ssa.gov/oact/STATS/table4c6.html

As someone who spends quite a bit of his time counting the sand in the hourglass that is one of his relatives' retirement funds...

There's no definite win-strategy here. It is possible to die young. It is possible to outlive your savings and live a miserable final years. We can't guarantee a happy solution.

(Well, TBF, we could decrease the misery of the one option by deeply funding social security, not to sustain it but to raise to a higher standard of living than previous generations ever knew because we currently live in a world with a higher productive capacity than previous generations ever knew. So I'm speaking of transient political reality and not concrete laws of the universe.)

> Well, TBF, we could decrease the misery of the one option by deeply funding social security,

Take from the young (poor) to pay the old (rich). Yeah, that sounds amazing, where do I sign up? /s

Not necessarily. The source of funding for social security was an arbitrary decision. We could fund it with a wealth tax.

There are a few ways you can withdraw from your 401k early without penalty. The best is probably Roth conversion laddering, which requires that you plan your withdrawals 5 years ahead of time. If you have a spouse and children, then it also makes sense to consider what will help you best set them up for a good life; you might not get to benefit much from that savings, but maybe your children will be able to avoid starting their adulthood as debt/rent slaves.

> www.ssa.gov

Interesting you cite Social Security, the mandatory pyramid scheme that every American pays into and many/most retirees rely on for income. If you die before you retire, you get nothing from Social Security. If you have a 401k and die before using all the money in it, your beneficiaries (the people who inherit your stuff when you die) keep it; nothing like that happens to your Social Security benefits.

> If you die before you retire, you get nothing from Social Security. If you have a 401k and die before using all the money in it, your beneficiaries (the people who inherit your stuff when you die) keep it; nothing like that happens to your Social Security benefits.

Social security has both death and survivors benefits, actually.

"Pay in $10k a year for 40 years, get paid $40k a year for 10 years" isn't a pyramid scheme.

You can go buy life annuities at your will, and they're pretty close in function and clearly not schemes.

> 17.27% of men don’t live to age 60, and another ~6%, or 23.57% of men overall, don’t make it to age 65.[1] For reference, one must typically be age 59.5 before they can withdraw from their 401k without penalty.

You are making the almost certainly mistaken assumption that the population of men who "live below [their] means to max out [their] 401k" are representative of the overall population of American men with regards to life expectancy.

> 17.27% of men don’t live to age 60, and another ~6%, or 23.57% of men overall

The demographics and actuarial numbers of people maxing out their 401k will look very different. The richest live ~15 years longer than the poorest.

> Are you going to make a pile of gold and sit on it like a dragon?

If you want to buy a house, yes. A pile of gold is also handy to start a business.

That friction could use some lubrication, at least in Europe. I loathe outdated/misconfigured card payment terminals outright declining payments that go over the 100€ cumulative total on contactless. The better configured ones just ask for a PIN and that's it. But there are many which just decline the transaction, leaving both me and the shopkeeper frustrated requiring me to "try again".

Contactless in the UK lets you use the card five times before you have to Chip&Pin and too reset.

Pointless and all is displayed is "Declined". Embarrassing if your paying in the party.

That's not my experience, it lasts many more times for me and it says "INSERT CARD". Which is also what it says when you haven't got money to cover the payment.

Yeah, I think it's based on an amount instead of times. I have been to my local shop for months and they never asked for card yet. Each time spending like £3-4

I think this would add friction on the whole, adding an authentication step to transactions where you currently just type in your card number and hit submit. It reduces friction compared to an alternative where you confirm transactions with SMS codes, but I don't think that is very common.

It's mandatory in the EU since PSD2 to have an extra validation step like authorising in the bank's app or via SMS.

Edit: looks like I made a fool of myself. I didn’t know about Apples other implementation of a similar feature.

It seems nice but I think Apple will never implement this for Safari, even if standardized. It’d bypass their AppStore and make the web even more “app-like”, which they already aren’t crazy about.

I think you might be forgetting that Apple Pay exists and has worked on the web for years. This looks like a standardised version of Apple Pay.

Incorrect. The standardized version of Apple Pay is the Payments Request API, which has been in place for years.

And has been supported by Apple for 5 years.

ApplePay in-the-web has existed since the inception of the feature. I'm not sure how the App Store is relevant here?

This is a new web standard, it’s not Apple Pay.

No one is disputing that this is a new standard. The dispute is that Apple wouldn’t support it because it would take away from some hypothetical App Store revenue. Apple already supports the existing standard showing the argument doesn’t hold.

Article & spec mention privacy issues re: connecting users to payments, that seemingly would allow someone to pay for an app subscription without going through the store, since the payment receiver gets user details

This is possible already with Apple-supported Payment Request API (and even without those APIs, like just logging into a website). This is how Netflix on iOS works, which is explicitly supported (though with stupid cavets) by Apple.

I just signed up to a subscription via the web using Apple Pay. They automatically had my name and email address.

Apple has supported the Payments Request API for five years

https://developer.mozilla.org/en-US/docs/Web/API/Payment_Req...

https://webkit.org/blog/8182/introducing-the-payment-request...

Correct. The article is about a new standard.

The conjecture was that Apple wouldn’t support the new standard because it would give an “app like experience”.

The closest similarity we have is that Apple supported the existing payment standard relatively early on.

Does the existing standard make the web more app-like?

The existing one, you click on a button on the web and it takes you through the same Apple Pay process flow that you go through when you pay in app with Apple Pay for something like Uber.

In app purchases - Apple takes 30% for electronic goods in the App Store

Apple Pay - Apple charges standard credit card fees on the web or via the App Store.

As mentioned above, you can use Apple Pay in app if you sell physical goods.

You’re absolutely correct, and there’s privacy concerns for Apple in the spec, e.g. the users info is now sent with transactions.

c.f. example of how merchants M1 and M2 could collide to identify payment method P1 and P2 are connected to the same user

EDIT: Throttled on new comments

I agree: I'd take up more detailed Qs with the article writer & spec/proposal, they seem sure its different.

I also agree if the new proposal is the same as the old proposal, it does seem likely Apple would implement it.

I don't understand why the W3C would make a new proposal that was the same as the old one, but...forget it Jake, it's ̶C̶h̶i̶n̶a̶t̶o̶w̶n̶ web specs.

The user’s info is sent with the existing Payments Request API. If you use Apple Pay on the web, it will send your name and address if requested for shipping physical goods.

SPC does not handle payments, it handles authentication. SPC is designed to work in scenarios like Plaid and 3D Secure, not for what Apple Pay (or the app store) does.

I believe SPC comes out of the Authn working group.

> This specification defines an API that enables the use of strong authentication methods in payment flows on the web. It aims to provide the same authentication benefits and user privacy focus as [webauthn-3] with enhancements to meet the needs of payment processing.

https://www.w3.org/TR/secure-payment-confirmation/

lol that url applemust is a bit much. Really cool that there might be some standards incoming though

Seems like something stripe should be pretty worried over

Nope, not at all.

> Stripe conducted a pilot with an early implementation of SPC and, in March 2020 reported that, compared to one-time passcodes (OTP), SPC authentication led to an 8% increase in conversions at the same time checkout was 3 times faster.

They seem pretty excited about it.

Yep, Stripe partnered with W3C on this. Built into Stripe Checkout (and now Link).

Unlike many companies out there such as Intuit, stripe doesn’t rely on the world continuing to suck in order to exist.

Stripe is where the money goes to and handles getting it to your bank, this is better and faster authentication of purchase.

It should reduce fraud and apparently improve conversion rates, so that’s a big win for Stripe.

This doesn't threaten Stripe at all. They already process Apple Pay payments.

https://www.w3.org/blog/wpwg/2021/03/26/secure-payment-confi...

This describes Stripe's early involvement in the spec.

There's still a W3C?!

I'm kidding on the square, but I thought they'd been effectively displaced by WHATWG (and TC39).

Interesting that this is built on top of FIDO/webauthn.

I'm still somewhat worried about webauthn but recent news around it has (imo) been moving in a more positive direction and I'm less worried about it than I used to be. So I would really love to be cautiously optimistic about this.

Assuming webauthn turns out well, this seems to be a pretty natural and pretty useful extension.

Reply on news.ycombinator.com