API assumes Issuer communication is OOB

[cyberphone]

The current Web Payment API does the (implicit) assumption that interactions with the issuer is performed OOB. However, the Saturn payment authorization scheme uses a "conversational" mode where all "Wallet" communication goes through the Merchant. It is therefore incompatible with the Web Payment API. It might be worth knowing at least.

https://cyberphone.github.io/doc/saturn/bank2bank-payment.html#provuserresp

Why the Saturn Wallet only talks to the Merchant? Because it has considerable system advantages.

[marcoscaceres]

OOB?

…

On 3 Mar 2017, at 5:17 pm, Anders Rundgren ***@***.***> wrote: OOB

[bentian]

I think OOB=Out-of-band.

Out-of-band is activity outside a defined telecommunications frequency band, or, metaphorically, outside some other kind of activity.

[cyberphone]

OOB like in step 3 of:
http://w3c.github.io/webpayments-methods-credit-transfer-direct-debit/

[marcoscaceres]

Ah, thanks!

…

On 3 Mar 2017, at 6:30 pm, Ben Tian ***@***.***> wrote: I think OOB=Out-of-band. Out-of-band is activity outside a defined telecommunications frequency band, or, metaphorically, outside some other kind of activity. — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.

[ianbjacobs]

Nothing prevents a payment app from communicating with other parties. That is neither required nor forbidden by this API. Payment service providers can communicate through multiple paths.

I am closing this issue. If there is a more specific issue with the specification we can revisit it.

[cyberphone]

Nothing prevents a payment app from communicating with other parties. That is neither required nor forbidden by this API

What I said (or meant at least), is that the API (particularly when used with native Apps), requires OOB calls for anything outside of the core API. Putting it another way: The API fits card-emulating Apps like Android Pay but may turn out to be less useful for more advanced schemes, designed from scratch (including Saturn).

OOB means that the invoking Web page is not in the process and may have to be dealt with through AJAX hacks. Multiple channels to the Merchant adds complexity.