PhilLab

joined 7 months ago
 

With version 142, Google Chrome just rolled out a new permission prompt for Local Network Access.

While technically a good feature, this caused me the better half of the day hunting a production bug in our SaaS product, which after all did not exist.

Turns out that Chrome will display the permission dialog also for requests which your company's IT-mandated Endpoint Protection solution is grabbing for inspection. In our case, it was Zscaler causing issues.

If you deny the request (which from an end user perspective is the only reasonable choice), your web application will act weird.

Lucky me, our devices had just upgraded to Chrome 142 at the very same day we rolled out a production release. That's how all hell broke loose.

[–] PhilLab@feddit.org 6 points 1 month ago

Meta? Die sind ja noch LLama!

[–] PhilLab@feddit.org 11 points 1 month ago

Sorry, geändert

69
ich✨iel (infosec.pub)
submitted 1 month ago* (last edited 1 month ago) by PhilLab@feddit.org to c/ich_iel@feddit.org
 

Klopf, Klopf.

Wer ist da?

Gemini.

Wer?

Gemini auf den Sack!

[–] PhilLab@feddit.org 1 points 1 month ago* (last edited 1 month ago)

Wero's Data Processing Officer confirmed via email that they DO access the bank account:

We can confirm that the term “payment account” in our Privacy Policy refers to the bank account that you connect to Wero. This is the official legal term used in the applicable EU regulations.

When using the Wero standalone app, Wero may access both:

  • the balance of the enrolled account; and

-the transaction history of that account for the past 90 days.

And they stated:

The lack of clarity in the FAQ materials likely stems from the fact that Wero is offered under two different models, depending on the bank:

Standalone app, operated by EPI Company SE (Wero is its trade name), acting as an authorised AISP and Payment Initiation Service Provider. In this case, Wero accesses the account balance and transaction history to display them in the app.

Integration into the bank’s mobile app, where Wero is provided only as a technical module. In this case, Wero does not access the account information described above, as this remains fully within the control of the bank.

[–] PhilLab@feddit.org 1 points 1 month ago* (last edited 1 month ago)

Thank you for diving deeper into this topic. I see how you come to your conclusion - that would be a relief. However, if payment account is the Wero account, why do they need to store the "type of payment account" (they are not stating "type of payment source").

I also found an FAQ answer of a German bank, Postbank

Hat Wero Zugang zu Informationen über mich und meine Bank­verbindung?

We­ro kann le­dig­lich Ih­ren Kon­to­stand und Ih­re We­ro Zah­lun­gen an­zei­gen [...]

Archive.org link, in German only , translates to

Does Wero have access to information about me and my bank details?

Wero is only able to display your account balance and your Wero payments [...]

Again, it is not 100% certain, but answering about "account balance" when being asked about bank access does sound like my bank account balance. But it could also be the Wero account balance (if there is such a thing?)

Maybe I am hearing the grass growing here. I do wish Wero to be a success, but it does feel more intermingled with the internals of my bank account than I'd like it to be

[–] PhilLab@feddit.org 1 points 1 month ago (2 children)

But the document states that this type of data is also stored:

Information about your payment source (account holder name, type of payment account, technical identifier of the payment source)

So I would understand "type of payment account" to be the type of your bank account. Hence, payment account == bank account. But it is unclear.

[–] PhilLab@feddit.org 4 points 1 month ago

Some banks require to install the Wero app.

 

Wero seems promising. But I am confused as it appears they have acess to my bank account's balance and transaction history. The privacy policy (Archive.org) states on page 4

Purpose: Displaying your account information (performance of a contract – art. 6.1.b of GDPR)

Categories of data processed: Balance and transaction history of your payment account

Retention period: Duration of the contract (the Wero General Terms & Conditions)

The term "payment account" is not properly defined in the document, but I would infer from the first line on page 4 that it is the connected bank account.

This would be significantly more invasive than PayPal. Would be a dealbreaker for me, as I don't even see a plausible reason for doing this.

Their FAQ states the contrary:

Wero does not have access to your transactions or any other account activity beyond the information we need to complete a Wero payment.

Again, "information we need" is quite vague...

Update: Wero confirmed

See my comment below, Wero's Data Processing Offices confirmed via email that they do access your bank's transaction history, depending on which implementation mode your bank chose.

Quite invasive, IMHO

[–] PhilLab@feddit.org 3 points 2 months ago

Yes, it will!

[–] PhilLab@feddit.org 4 points 7 months ago

F-Droid fände ich auch super! Ist ein Open Source Projekt und in der Hand der "community". Erste Voraussetzung dafür ist, dass die app selbst als open source veröffentlicht wird. Und da kommt dann auch der erste handfeste Vorteil zum Tragen: Die Builds müssen reproduzierbar aus dem Source Code erzeugt werden, sodass man sich sicher sein kann, dass die installierte App auch dem veröffentlichten Code entspricht. Das kann man bei anderen Appstores nicht.