rene_kapusta

You can register multiple hardware tokens for a service (if the site supports that).

Regarding export of private keys -- some crypto hardware wallets also support the FIDO[2] specs. -- so there you have the option to use the 12 words to setup a new hardware with the same private keys ...

Regarding storing sensitive data at the client -- how good / bad / secure is it to store data in the IndexedDB store (as this is the only option for web apps used in the PR modal)?

SEPA Instant Credit Transfer (SCTInst) + PSD2 Strong Customer Authentication (SCA) is working fine with PR API + Payment Handler + Payment Method ID + Payment Method Manifest specs.

Here is a not-so-uptodate PoC showing SCTInst with a live Raiffeisen Bank account (Austria) via S€PA.digital in Microsoft Edge: https://sepa.digital/pay.mp4

As Webkit / Safari only implemented the Payment Method ID for usage with Apple Pay (on the web), there it is only possible to redirect the user to a web page (a Progressive Web App which is else rendered in the PR modal). ... but in combination with the QR code format recommended by the European Payments Council* you'll get an other nice UX like "iOS Scan & Pay": https://www.linkedin.com/posts/renekapusta_apple-ios-scan-pa... // vimeo.com/391365723

QR codes suck you think? Card schemes & payment apps too.

So, I think "Request to Pay" in combination with eIDAS will be the future of frictionless SEPA / EUR real time payments (in combination with PR API to exchange the checkout data): https://www.linkedin.com/posts/renekapusta_instant-account2a... // vimeo.com/391881139

btw.: Persona was quite nice -- WebAuthn seems promising too (but it is/was only supporting hardware tokens and not the finger print reader on osx at my first trials ...)

) https://www.europeanpaymentscouncil.eu/document-library/guid... *) https://en.wikipedia.org/wiki/EIDAS

Safari only supports "Apple Pay" + "basic card" -- it's blocking / not supporting other payment methods / instruments -- W3C Payment Method ID / Payment Handler API is not implemented right.

Like the successful lawsuit against Apple regarding the closed NFC API for payments in Germany, I suppose the same would apply for "Apple Pay on the web" (non-discrimination of other payment methods).