4 ms·

As a (reluctant) Quicken user, I was not aware that Express Web Connect credentials are stored on Quicken servers. Do you have anything to back that assertion

by avemg 11y ago

As a (reluctant) Quicken user, I was not aware that Express Web Connect credentials are stored on Quicken servers. Do you have anything to back that assertion up?

snuxoll 11y ago
https://quicken.intuit.com/support/help/bank-download-issues/how-quicken-connects-to-your-bank/GEN83013.html https://quicken.intuit.com/support/help/bank-download-issues... Expand the "Express Web Connect / Quicken Connect - Details" section underneath the comparison matrix and you will see this: * Your login credentials are stored on Intuit-hosted servers. This makes updates faster for you. * Your financial data is stored on Intuit-hosted servers. This provides a more complete history of your financial transactions than is typical for data stored on financial institution servers. * We use state-of-the-art security measures to protect your login credentials and your financial data. ---- This is half of why I pay $9.99/mo to use Direct Connect with my Wells Fargo account (that, and having bill pay within Quicken is pretty handy).
breischl 11y ago
From Quicken's security guide (emphasis added): When using Express Web connect to automate Web connect downloads from your financial institution's Web site, your user name and password are encrypted and, depending on your financial institution's procedures, will be stored on our firewall-protected servers or in your Quicken software. Your financial information is transmitted using secure socket layer technology and is encrypted, so it is unreadable during transmission. It is then stored on our firewall-protected servers and is securely transmitted directly to your desktop computer when you initiate One Step Update. Your information is confidential and is not used for anything other than providing and maintaining the One Step Update service. http://quicken.intuit.com/support/help/account-transaction-issues/how-quicken-protects-financial-information/GEN82538.html?priorityCode=1327800000 http://quicken.intuit.com/support/help/account-transaction-i...
- toomuchtodo 11y ago
  Yes. They store your credentials at rest in a data store, and the creds are decrypted on demand when API requests are made.
KirinDave 11y ago
This is (probably) not global. Some financial institutions will offer aggregators safer ways of keeping a negotiated connection around. Like most big aggregators, Intuit negotiates with all the major banks individually for both batch and realtime refreshes. The entire world of aggregation is simultaneously really interesting and rock-boring stupid. I'm surprised we don't see more fintech startups using it more aggressively, even as I am happy this made my former endeavor more acquirable.
zymhan 11y ago
There's really no way around it, if Quicken is going to login to your bank account for you, it needs your password in cleartext somewhere on its server.

by avemg 11y ago

As a (reluctant) Quicken user, I was not aware that Express Web Connect credentials are stored on Quicken servers. Do you have anything to back that assertion up?

snuxoll 11y ago

https://quicken.intuit.com/support/help/bank-download-issues/how-quicken-connects-to-your-bank/GEN83013.html https://quicken.intuit.com/support/help/bank-download-issues... Expand the "Express Web Connect / Quicken Connect - Details" section underneath the comparison matrix and you will see this: * Your login credentials are stored on Intuit-hosted servers. This makes updates faster for you. * Your financial data is stored on Intuit-hosted servers. This provides a more complete history of your financial transactions than is typical for data stored on financial institution servers. * We use state-of-the-art security measures to protect your login credentials and your financial data. ---- This is half of why I pay $9.99/mo to use Direct Connect with my Wells Fargo account (that, and having bill pay within Quicken is pretty handy).

breischl 11y ago

From Quicken's security guide (emphasis added): When using Express Web connect to automate Web connect downloads from your financial institution's Web site, your user name and password are encrypted and, depending on your financial institution's procedures, will be stored on our firewall-protected servers or in your Quicken software. Your financial information is transmitted using secure socket layer technology and is encrypted, so it is unreadable during transmission. It is then stored on our firewall-protected servers and is securely transmitted directly to your desktop computer when you initiate One Step Update. Your information is confidential and is not used for anything other than providing and maintaining the One Step Update service. http://quicken.intuit.com/support/help/account-transaction-issues/how-quicken-protects-financial-information/GEN82538.html?priorityCode=1327800000 http://quicken.intuit.com/support/help/account-transaction-i...

toomuchtodo 11y ago
Yes. They store your credentials at rest in a data store, and the creds are decrypted on demand when API requests are made.

KirinDave 11y ago

This is (probably) not global. Some financial institutions will offer aggregators safer ways of keeping a negotiated connection around. Like most big aggregators, Intuit negotiates with all the major banks individually for both batch and realtime refreshes. The entire world of aggregation is simultaneously really interesting and rock-boring stupid. I'm surprised we don't see more fintech startups using it more aggressively, even as I am happy this made my former endeavor more acquirable.

zymhan 11y ago

There's really no way around it, if Quicken is going to login to your bank account for you, it needs your password in cleartext somewhere on its server.