alt.hn

3/20/2026 at 7:09:07 AM

FSFE supporters affected: Payment provider Nexi cancelled us

 https://fsfe.org/news/2026/news-20260316-01.en.html

by rasjani

3/20/2026 at 8:54:41 AM

Reminds me of the famous "Our security auditor is an idiot. How do I give him the information he wants? [1]

[1] https://serverfault.com/questions/293217/our-security-audito...

by sam_lowry_

3/20/2026 at 10:06:30 AM

That is crazier than any old dailywtf stories, and that site felt like everyone tried to one-up each other.

by zvqcMMV6Zcr

3/20/2026 at 9:52:35 AM

Is there some part of PCI auditing requirements that is getting misinterpreted by some auditors to demand this? Though in my experience with standards like this what auditors want to see and what the standards say often have only loose overlap anyhow.

by rcxdude

3/20/2026 at 1:53:33 PM

It's pretty counterintuitive from an auditing perspective. If the PCI standards require server racks to be painted red, it's entirely normal for an auditor to ask to see them, and very suspicious for you to say that they're in an encrypted box where nobody can check if they're red or not. I don't mean to excuse it, but I can understand how the error happens.

by SpicyLemonZest

3/20/2026 at 2:13:05 PM

This is true. Maybe it's someone seeing a requirement like "all passwords must conform to these rules" and deciding that it means they need to check them directly, instead of looking at the systems that enforce that constraint.

by rcxdude

3/20/2026 at 12:24:15 PM

Right until the end I thought the guy was doing a social engineering penetration test, checking whether he could brow beat the server admins into bending over backwards to reveal this information.

by samus

3/20/2026 at 8:31:23 AM

> Over the past few months, our former payment provider Nexi S.p.A. (“Nexi”) requested access to private data, which we understood to be specifically the usernames and passwords of our supporters.

I must be missing something, but why is there an expectation that clear text passwords would even be known?

by eequah9L

3/20/2026 at 9:54:19 AM

Probably because most people haven't internalized how password hashing works.

by rcxdude

3/20/2026 at 7:40:30 AM

The FSFE justly drew the line at providing private information of supporters. How many other customers of Nexi simply handed over such data 'because audit'?

by Freak_NL

3/20/2026 at 7:37:08 PM

It's not even just private information, because in any properly configured system it is explicitly unknowable information.

by zettabomb

3/20/2026 at 7:58:23 AM

So this was not only about FSFE and payments for them but a general audit of their (Nexi's) customers ?

by rasjani

3/20/2026 at 9:49:27 AM

It seems unlikely that the FSFE is the first customer they have asked for this information.

by rcxdude

3/20/2026 at 4:31:26 PM

Nexi’s mid-2025 statement notes that they’re finalizing imposition of a ‘one process, all subsidiaries’ auditing costs reduction program across all of their subsidiary banks. The FSFE was likely being (incorrectly) audited under business-provides-services rules imposed by the parent megacorp, rather than as whatever human-led interpretation the bank had used formally, or as whatever charities or PACs are called in the EU. Ironically, had they switched exclusively to freedom-restricted passkeys, they could have structured their credentials store to divulge no private information and no usable credentials while formally complying with the bank’s efforts to find cause to fire them as a customer. But I think the bank would still have just found another way to fire them regardless.

by altairprime

3/20/2026 at 4:46:43 PM

Yeah, using the word "cancelled" that way in the title is... hyperbolic, even if it is technically true that the contract was cancelled.

by andrewflnr

3/20/2026 at 8:07:48 AM

That’s how I read the linked post as well, yes.

by TavsiE9s

3/20/2026 at 10:09:58 AM

We work with MLS provider(s) that requires us to keep plaintext password for our users and provide it on request in case of `breach in the security of MLS Listing Information or a violation of MLS Rules`.

The user is accessing only copy of their data in _our_ systems, the user has no contact with MLS itself directly or indirectly.

by samsk

3/20/2026 at 11:22:45 AM

Sounds like someone is being "overenthusiastic" about interpreting the KYC/ALM regulations.

Combined with the FSFE not being your "usual" charitable or business organization so setting off auditor red flags and perhaps raising the risk profile of Nexi as a payment processor.

by rswail

3/20/2026 at 7:47:58 AM

As an Italian living in another EU country, I always thought that the amount of (broken) bureaucracy of Italy was not particularly worse. However this story comes after a couple more I heard this week, in a line of absurd practice possibly due to absurd regulations.

by butokai

3/20/2026 at 9:05:35 AM

So what did Nexi really want, and how did it get mangled so badly that it came out as "specifically the usernames and passwords of our supporters"?

by janpio

3/20/2026 at 9:51:17 AM

It's entirely possible that is actually what they wanted (at least what the people in the company they were talking to wanted). I suspect that "we understood to mean" is language carefully designed to avoid a lawsuit.

by rcxdude

3/20/2026 at 8:52:16 AM

Everytime people say bitcoin has no use case, I'd like to point them to cases like this.

by littlecranky67

3/20/2026 at 10:09:01 AM

I will bite. How do I set up recurring crypto payments/donations for my site? How big cut will be taken by intermediary?

by zvqcMMV6Zcr

3/20/2026 at 1:06:08 PM

[dead]

by sebastien_b

3/20/2026 at 12:15:08 PM

[dead]

by lokimoon

3/20/2026 at 8:17:56 AM

Maybe now more F/OSS supporters will understand the need of Bitcoin/Monero

by grigio

3/20/2026 at 10:11:44 AM

You could put it this way, but to me the bigger question is why would a payment processor have such ridiculous requests? That probably should be examined first.

by g947o

3/20/2026 at 1:06:53 PM

[dead]

by sebastien_b

3/20/2026 at 8:50:36 AM

Not unless they start questioning the Club of Rome induced climate scam.

by jasonvorhe