News for hackers. Stuff that matters.

A comment on Payment processor for Amazon India had leak of over 100M users. Parent comment

Re:Payment processor for Amazon India had leak of over 100M ... by AkshayPrabhu on Tuesday January 05, 2021 @07:18AM (#25644757)
I'm not fully sure to what extent Juspay is used but one feature they use heavily is autofilling OTPs. Unlike the US, to make a card payment online according to RBI's guidelines, you need to enter a one time password that in most cases is sent to you over SMS.

What Juspay does is, it scans your SMSes and pastes the OTP automatically into the payment page. All the user has to do is click an approve button, streamlining the process as the user never has to exit the app.

[ Parent | on HN ]
Re:Payment processor for Amazon India had leak of over 100M ... by alistairSH on Tuesday January 05, 2021 @08:11AM (#25645104)
it scans your SMSes and pastes the OTP automatically into the payment page

The Apple ecosystem has done this for years. Do Windows and Android not have similar features?

[ Parent | on HN ]
Re:Payment processor for Amazon India had leak of over 100M ... by heroic on Tuesday January 05, 2021 @10:44AM (#25646666)
This is a very new feature on iOS, ~1.5 years. JusPay has been doing this for about 6 years now.
[ Parent | on HN ]
Re:Payment processor for Amazon India had leak of over 100M ... by meibo on Tuesday January 05, 2021 @07:13PM (#25653173)
Android regexes out the code and adds a button to copy it to the notification bar, along with one to dismiss it.
[ Parent | on HN ]
Re:Payment processor for Amazon India had leak of over 100M ... by tsjq on Tuesday January 05, 2021 @07:23AM (#25644789)
yikes! SO, JP had access to our SMS'es too?!

reading OTP from SMS: to a layman, that's a rather small feature: and why doesn't Amazon do it by themselves ?

[ Parent | on HN ]
Re:Payment processor for Amazon India had leak of over 100M ... by heroic on Tuesday January 05, 2021 @10:45AM (#25646675)
not really, I worked on making this for another company. Reading is the simpler side of the story, the complex one is navigating the banking websites to be able to fill this in, and to maintain graceful degradation incase bank websites change
[ Parent | on HN ]
Re:Payment processor for Amazon India had leak of over 100M ... by yowlingcat on Tuesday January 05, 2021 @11:40AM (#25647262)
Indeed. You notice a variant of this with Plaid based integrations, common with roboadvisors to let you see a full-spectrum view of your accounts. The integrations which are based on the major banks that likely have tons of traffic fare okay. But if you've got 401ks from an employer provider that doesn't have a ton of traffic, you're in for some completely broken ugliness and no real major working protocol for your downstream applications to use.

I'm curious in particular about one thing you said, which is graceful degradation. What kinds of graceful degradation are you thinking about here?

[ Parent | on HN ]
Re:Payment processor for Amazon India had leak of over 100M ... by eunos on Tuesday January 05, 2021 @07:31AM (#25644856)
Android has an API for reading OTP from around 2017 I think.
[ Parent | on HN ]