Post #3956513
2026-07-14 11:22 UTC
@yvg@indieweb.social I mean, *I* get logged out after a few minutes, and I have 2fa active, so it's not a huge deal in practice, but imagine there was a *way* to delegate fine grained, temporary API access to third parties without handing over half of the two authentication factors...
(And I don't think PDS2 compliant third party would need to access my password for that matter.)
Replies (1)
-
@yvg@indieweb.social 2026-07-14 11:27
@mrc@mastodon.berlin Well I've worked with these systems briefly and from what I know: everybody hates each other. Banks don't want PDS2 because it forces the concept of "open banking" on them, that the EU requires (and slowly the US). The middlemen like Qwist or TrustLayer need to implement hundreds if not thousands of different banks with different APIs and mechanisms. The users get a shitty experience when that market isn't big enough or the relationship between bank and provider isn't on ideal terms.