3 ms·

The authors of the PWAs would need to opt-in to this. We distribute LOB banking apps as PWAs to our customers. In no reality would I consider incorporating thi

The authors of the PWAs would need to opt-in to this. We distribute LOB banking apps as PWAs to our customers. In no reality would I consider incorporating this into our tech stack. We use PWAs and avoid native apps precisely to maximize compatibility across arbitrary IT policies in our various customer installs. I don't know if our customers want to use linux, windows, android or apple. I don't WANT to know anymore. I just want to target a common API (HTML5), add some bandaids for iOS/Safari (usually after WWDC each year) and move on with life. Throwing DRM and platform constraints into the mix sounds like I might as well go back to native (I won't). We are one of the few vendors that will actually get into a heated argument and push back against customers over FUD security crap like this. If a prospect insists that we add some draconian DRM to our product stack, I would make it very clear to leadership that I do not think we should do business with that customer on technical grounds. If you find yourself in a situation where you need to trust the client implicitly, then you have catastrophically failed in the rest of your design.

jabroni_salad 3y ago
I appreciate what you do if you really do deliver that, but plenty of FIs are happy to mandate things like Trusteer Rapport and I would anticipate that sector to jump onto WEI just as fast as media companies will. It's going to be sold to execs as a zero operational cost lightswitch solution to preventing account hijacks. Up until about a year ago one major core provider had been using the password 'money' for all their client accounts, many of which were domain admins since that is a 'just make it work' button and they cannot actually tell you what privs their service accounts need. When we asked the clients to press them on it, we determined via cracking that they had changed it to 'monet' as a workaround. The standards for excellence are SO LOW.
- bob1029 3y ago
  > that they had changed it to 'monet' as a workaround > The standards for excellence are SO LOW. I'm 99% sure I know which vendor you are referring to. Almost everything in fintech is a hacky mess. This is our competitive advantage. Doing the barest-acceptable thing makes us look like rockstars compared to every other vendor in the space.

jabroni_salad 3y ago

I appreciate what you do if you really do deliver that, but plenty of FIs are happy to mandate things like Trusteer Rapport and I would anticipate that sector to jump onto WEI just as fast as media companies will. It's going to be sold to execs as a zero operational cost lightswitch solution to preventing account hijacks. Up until about a year ago one major core provider had been using the password 'money' for all their client accounts, many of which were domain admins since that is a 'just make it work' button and they cannot actually tell you what privs their service accounts need. When we asked the clients to press them on it, we determined via cracking that they had changed it to 'monet' as a workaround. The standards for excellence are SO LOW.

bob1029 3y ago
> that they had changed it to 'monet' as a workaround > The standards for excellence are SO LOW. I'm 99% sure I know which vendor you are referring to. Almost everything in fintech is a hacky mess. This is our competitive advantage. Doing the barest-acceptable thing makes us look like rockstars compared to every other vendor in the space.