Hacker News Reader

Comment by jsiepkes | Hacker News Reader

So we had something good in the Netherlands with iDeal, then they had to make it EU global and they messed it up.

For starters there is going to be percentage commission on each payment instead of just a flat fee low price like iDeal has. For some reason they felt compelled to introduce buyer protection like a credit card has, instead of just making it a digital debit payment system. And now we are also forced in to the Google ecosystem.

Great. Just great.

Why do they even feel they need the Google Play integrity API anyway? If you are really so concerned about the kind of attacks that supposedly fixes, you better ban Windows, macOS and Linux desktops and notebooks from banking online. Because their security model doesn't even come close to what Android or iOS has.

View on HN

Wero is an initiative introduced by the banks, not by the EU government. They specifically lobbied to make the "digital euro" initiative much worse so that it doesn't compete with Wero. So it makes sense that Wero has the interests of the banks in mind.

I have noticed zero change in using iDeal / Wero since the rebrand.

iDEAL | Wero was just a rebrand of iDEAL to make people get used to the new name Wero. The actual Wero roll-out has only just started. ASN and Bunq seem to be the first Dutch banks to actually roll out Wero (and not just renaming iDEAL to iDEAL | Wero).

ABN Amro also seems to be rolling out changes. I can't tell if it is just front end, but they did break some stuff. Including, annoyingly, making online payments without a phone.

The situation changes every couple of months, can't figure out if they unbroke it already.

Exactly. We are currently in a transition phase (of about a year iirc) where, for example, the fee will stay fixed. After that it will be a percentage of the total amount. Which is why Mollie announced[1] they would be launching a Wero alternative.

In the end this whole "buyer protection with percentage fee" is about the banks thinking: "We don't want to be a dumb digital sock for people's money. We have to provide value to them". But I want my bank to be a dumb digital sock to put my money in, nothing more. I'm really getting fat-up with all these MBA-types's thinking their company "needs to have a relation with me and add value". I mean I get emails from my utilities trying to get to know me. Seriously? I don't give a wooden nickle about my drinking water supplier. I just want to pay them and use their services and other than that I want to think about them as little as possible.

[1] https://www.accountant.nl/nieuws/2026/10/betaalbedrijf-molli...

Auto translation:

https://www-accountant-nl.translate.goog/nieuws/2026/10/beta...

From the write-up, it looks like mollie will be using PSD2 Payment Initiation Service (PIS). Which is exactly what PSD2 PIS was meant for. Kudos to them.

Wero is a mess.

The reasoning goes like that. App is more secure than web because 1. you can share a password but can't share the shared secret generated when the app is bound to account (lol, yes, they believe so) and 2. It has certificate pinning so you can't be mitmed when the system trust store is manipulated

The app however is only secure as long as your system isn't rooted. To make sure it isn't rooted you need to ask somebody who signed the system image if the integrity still holds.

I heard interesting ideas about phones, such as all phones having secure enclave and hsm which the app is totally using, so you can't just lift both the encrypted secret and it's kek from the same filesystem

Reply on news.ycombinator.com