Making history with FiSync – Real time bank transfers are here | Hacker News Reader

Making history with FiSync – Real time bank transfers are here

blog.dwolla.com

48 pointslarrys16 comments

I think it's naive for Dwolla to think that they have a secure system when it's been untested and will start by being used on a small scale.

While the delay in the current ACH system may not have been a QWERTY type thing in place to prevent some fraud (in other words it existed because of real reasons not to prevent "jammed" keys) a system that operates faster is going to certainly be more of a challenge to get right.

Edit: Specifically I'm not seeing anything on the Dwolla site to back up this statement: "A system that inherently better protects you than before is live"

That page and those I found linked from it seemed quite light on details.

Can anyone point me to a white paper or something more in-depth on how they plan to run a full blown competitor to ACH? The legal, technical and security challenges seem quite daunting.

I'm still waiting for Dwolla to produce an RFC on this before I even bother looking into it.

Does anyone else find it a little disconcerting that Dwolla would effectively control the direct financial payments market if this did replace ACH?

Obviously, this is what Dwolla wants but the larger banks must be able to see it. They're the masters at playing angles like this. Sure it's free now, but what about when you're a monopoly?

Why would anyone trust Dwolla for these transfers when they are not able to even handle the current fraud they get? Using a third party so heavily will just mean you are completely subject to their whims.

How does this system handle chargebacks? What is the incentive for a bank to use this over the well established ACH?

> How does this system handle chargebacks?

How does cash handle chargebacks? How can we possibly do so much business with a financial instrument that provides no way to un-pay someone you've already paid?

Cash is generally hard to steal in bulk. You can't just get a bunch of numbers from people surreptitiously and then empty their entire life savings in effectively untraceable milliseconds.

An absence of chargebacks does not mean "effectively untraceable". Even cash is potentially traceable, and this seems quite a bit more traceable than cash (which represents both a feature and a bug).

I actually meant this as a negative. I view chargebacks as a pain point in many cases (for merchants etc) not a positive. I was hinting at the the fact that this system probly has chargebacks and again is no better than before.

The biggest problem I see is that the system does not seem to have any form of two-factor authentication at all.

Here in Europe, where online electronic bank transfers have been commonplace for years, two-factor authentication has been shown to be a must because otherwise levels of fraud become too high.

Are you referring to chip-and-pin? It's broken http://www.lightbluetouchpaper.org/2010/02/11/chip-and-pin-i...

I think this is slightly different from the article you link.

Here in the UK in my business account I have to login with my password and then get a token from a small gadget that authenticates my debit card (I enter the pin and it gives me a unique code that I enter in the banks' web page).

Then, when I am in, if I want to do a transfer money to another account I need to use that gadget in a different way and enter a few more details after authenticating again and at the end it gives me yet another unique number to conclude the transaction(s).

The article you link to applies to online and offline payments (not transfers) using a POS when paying with a chip and pin card. Although I guess that the same principle might apply to money transfer this has not been demonstrated yet. It certainly is better than the previous version where all yo had to do was reenter your password. It is a bit annoying though.

No, I am not referring to chip-and-pin, but to two-factor authentication when doing online banking. Chip-and-pin has nothing to do with two-factor authentication and is solely for when the user is present. Two-factor authentication is primarily used when the user is not physically present.

For example, my UK bank makes an automated call to me whenever I am sending money to a new recipient, where I have to confirm that yes, I want to send money to that person or institution.

To send money from my German bank account, I use a special external device (TAN generator) where I sign off on the details of the transaction itself.

Oh I see, thank you.

The user interface for the transfer seemed to be too confusing and disjointed.

You have to enter the money amount at the top of the left hand column, click a button, and then the other details in a center column. It's not one flow.

This is a real significant milestone for a company that's disrupting the financial system.

They talk about replacing ACH but the end result is more than that - it's replacing the ubiquity of credit cards. It'll take years to do but these folks at Dwolla are smart and working with the right people (from Kutcher for investment to the Federal Reserve for compliance to credit unions to serve).

Cheers to Dwolla!

Reply on news.ycombinator.com