Hacker News new | past | comments | ask | show | jobs | submit
julianlam | on: Payments Canada announces launch of Canada's Real-Time Rail (RTR) payment system
Interac (eTransfer/EMT) is a great system that has already rolled out nation-wide.

Unfortunately its utility is curtailed severely if your bank doesn't trust your mobile OS (LineageOS, for me). For security purposes, my bank (RBC) triggers identity checks every time I try to send an EMT, and even after sending selfies, drivers licences, etc. — it still rejects the transfer.

So, security at the cost of all utility.

I have now resorted to transferring money between my accounts using paper cheques... like it's the 90s. If somehow they deny me cheque deposits I'll have to use an ATM and walk the money to the other bank. Given how there are now banks that don't even have branches, this could be a major problem in the future.

This Real-Time Rail system sounds promising, but that's not the link that'll kill it for everyone.

T-RN-R | parent | next
99.999% of people don’t root and install custom operating systems on consumer hardware. The bank derives immense security value by enforcing this, at the expense of your hobby installation.
verelo | root | parent | next
I don't think this is as unusual are you're implying it might be.

I've moved funds ranging from 10k to $1m between banks in Canada much more than once, and every single time, I go to one and get a draft and drive that draft over to the destination bank. It's just easier...and its absurd.

dcrazy | root | parent
When you show up to get a cashier’s check, the teller has very strong proof that you’re not a scammer sitting in Malaysia. And you’re presumably OK with waiting the 1-3 days for the cashier’s check to clear.

This might be true in Canada too: the real estate industry down here is entirely dependent on wire transfers, and yet they are absolutely terrified of wire scams. Maybe if FedNow had existed when I bought my place, I could have gotten a draft slip from my bank and driven it over to the title company.

bawolff | root | parent | next
While i agree it is uncommon - i disagree that banks get much security value from this. Most banks let you do etransfers from a desktop computer just normally. I dont really see what attacks banning rooted phones stop when you can just use your normal linux desktop.
thomasjeff1 | root | parent
Exactly my thoughts and why I said what I said here https://news.ycombinator.com/item?id=50436011
switchbak | root | parent
Yeah what did you need that freedom for anyway?
dcrazy | parent | next
The utility is preventing malware bundled with pirated apps from transferring away your personal savings in a hard-to-reverse instant transfer.

You, as a technically savvy user, could choose to use a dedicated device with an acceptable security posture for your electronic transfers.

Marsymars | root | parent
> You, as a technically savvy user, could choose to use a dedicated device with an acceptable security posture for your electronic transfers.

Not really, I'm forced to use e.g. RBC because that's where my employer sends their matched retirement savings funds.

loading story #50428693
gpm | parent | next
Weird... I've never had problems using eTransfer from a browser (firefox) on my computer (linux)... which has got to be as untrustworthy a device as there is.
MrDOS | root | parent | next
For the last several months, eTransfers initiated from my desktop browser (Firefox on Linux, same as you) have required confirmation via the RBC app on my iPhone. Definitely seems like they have multiple scales of trustworthiness for people/devices/activity. Kind of wish they'd be more transparent about what they are, but I guess that sort of transparency can easily become a vulnerability.
loading story #50428553
loading story #50428726
abdullahkhalids | root | parent | next
Similar experience. No real problems. However, RBC limits the amount I can transfer to 2k per day from browser and like 5k per day from the app.

I don't send anything from TD, but if I buy anything online half the time it forces a 2FA which requires signing into the app and confirming the transaction. I imagine signing into the app might not work nicely if I was on LineageOS.

loading story #50428457
julianlam | root | parent
Used to be the case, yes. However even web-initiated EMTs trigger device confirmation. RBC seems to have made this mandatory for at least my account as of this summer.
kevin_nisbet | parent | next
Unless I'm missing something I'd expect Payments Canada to have similar issues for you, since it'll still be the banks that you interact with. What changes is the settlement and messaging system between the banks.
fl4regun | parent | next
can't you just use the web interface?
tamimio | parent | next
Interesting, did you try other apps if they work on grapheneos/lineageos like koho or wealthsimple? If they do, maybe you can use it as an intermediate tool.
metalman | parent
Bieng in a similar situation, my back up plan has been to keep a phone that is used exclusivly for personal banking and pull the sim and shut it off when not in use. Currently I have a much fiddled with android phone and a browser that will interact with the banks web sites for banking. I get a lot of paper cheques and convert to cash for much of my personal spending, and my hope is that the new system will facilitate timely clearance of paper cheques and actualy make them more atractive.