The reasoning goes like that. App is more secure than web because 1. you can share a password but can't share the shared secret generated when the app is bound to account (lol, yes, they believe so) and 2. It has certificate pinning so you can be mitmed when the system trust store is manipulated

The app however is only secure as long as your system isn't rooted. To make sure it isn't rooted you need to ask somebody who signed the system image if the integrity still holds.

I heard interesting ideas about phones, such as all phones having secure enclave and hsm which the app is totally using, so you can't just lift both the encrypted secret and it's kek from the same filesystem

I have noticed zero change in using iDeal / Wero since the rebrand.

iDEAL | Wero was just a rebrand of iDEAL to make people get used to the new name Wero. The actual Wero roll-out has only just started. ASN and Bunq seem to be the first Dutch banks to actually roll out Wero (and not just renaming iDEAL to iDEAL | Wero).

ABN Amro also seems to be rolling out changes. I can't tell if it is just front end, but they did break some stuff. Including, annoyingly, making online payments without a phone.

The situation changes every couple of months, can't figure out if they unbroke it already.

Exactly. We are currently in a transition phase (of about a year iirc) where, for example, the fee will stay fixed. After that it will be a percentage of the total amount. Which is why Mollie announced[1] they would be launching a Wero alternative.

In the end this whole "buyer protection with percentage fee" is about the banks thinking: "We don't want to be a dumb digital sock for people's money. We have to provide value to them". But I want my bank to be a dumb digital sock to put my money in, nothing more. I'm really getting fat-up with all these MBA-types's thinking their company "needs to have a relation with me and add value". I mean I get emails from my utilities trying to get to know me. Seriously? I don't give a wooden nickle about my drinking water supplier. I just want to pay them and use their services and other than that I want to think about them as little as possible.

[1] https://www.accountant.nl/nieuws/2026/10/betaalbedrijf-molli...

From the write-up, it looks like mollie will be using PSD2 Payment Initiation Service (PIS). Which is exactly what PSD2 PIS was meant for. Kudos to them.

Wero is a mess.

Auto translation:

https://www-accountant-nl.translate.goog/nieuws/2026/10/beta...

Wero is an initiative introduced by the banks, not by the EU government. They specifically lobbied to make the "digital euro" initiative much worse so that it doesn't compete with Wero. So it makes sense that Wero has the interests of the banks in mind.