3 ms·

I agree with the banks in part. Giving your online account credentials to access your banking information is complete madness. It's a giant security risk that n

I agree with the banks in part. Giving your online account credentials to access your banking information is complete madness. It's a giant security risk that neither company would likely cover if someone got a hold of your login details. This is the reason I purposely never signed up for Mint. On the second half of the argument. Banks need address the fact that users needs are changing and they want access to their own data, that they own, not the bank. A bank could create an API service with API keys specifically for these types of aggregate services to use. This could be done at first for just read only access, whereby the API does not allow you to transfer funds, etc. It would be a secure interface to access your data from third trusted third parties or your own apps. A secure standard API would be beneficial to customers, to third party services, and to the banks that offer them. Freeing information inside of hoarding it, when it doesn't belong to them in the first place. Credit unions could have a major advantage here if they would start using modern tech.

KirinDave 11y ago
> I agree with the banks in part. Giving your online account credentials to access your banking information is complete madness. It's a giant security risk that neither company would likely cover if someone got a hold of your login details. This is the reason I purposely never signed up for Mint. As someone who collects these daily; I'd rather not collect them. The lengths I have to go to to ensure that they're not a major risk for our product? Significant. It's not a hard problem to solve, but the question is: "do banks want to solve it?" There's not much incentive for big banks to DECREASE account stickiness, and a lot of us waiting for great aggregation tools to totally dis-intermediate the big banks from their customers 8 ways till Tuesday. But to be honest, financial data is all sort of like this. For example, once someone has your ACH routing and account numbers, the only thing that really stops them from building a fraud factory is the fact that it's difficult to get permission to interact with the ACH network. You need to handle those with at least as much care as bank login info. And then, there was the MASSIVE fraud spree that everyone who didn't implement yellow path validation for ApplePay opened up. I personally had well over 80k stolen from my account in less than 1 day via that outrageous fraud loop. Thanks, Apple Stores and Chase, for pretending that someone else's fingerprint constitutes my biometric permission. On the subject of Chase, everyone in the industry was completely shut down without warning at the worst possible time by Chase. We're all pretty spicy about how it was handled.
- ska 11y ago
  In my experience (just as a client) Chase is very happy to act unilaterally and without communication. On the other hand, as an ex-client I have the option of just never dealing with them again.
xur17 11y ago
> On the second half of the argument. Banks need address the fact that users needs are changing and they want access to their own data, that they own, not the bank. A bank could create an API service with API keys specifically for these types of aggregate services to use. This could be done at first for just read only access, whereby the API does not allow you to transfer funds, etc. It would be a secure interface to access your data from third trusted third parties or your own apps. My capital one 360 account does this. I can generate an api key that I give to mint.
morgante 11y ago
> It's a giant security risk that neither company would likely cover if someone got a hold of your login details. Sure, but it shouldn't be the bank's decision to keep me from accessing my own customer data because it's insecure. If they actually wanted to fix this, it would be entirely possible to provide a read-only API.
lsaferite 11y ago
Isn't that the basic idea behind OFX though? I mean, role specific credentials with limited rights seems like it would work perfectly fine with the existing OFX spec.
- shawkinaw 11y ago
  My bank already does this, to a limited extent anyway. I use (slightly) different credentials for OFX login than if I go to the website.
superuser2 11y ago
> Giving your online account credentials to access your banking information is complete madness. It's a giant security risk Is it? My bank requires multi-factor confirmation to set up a new payee for electronic transfers and sends several emails for any transfer. You couldn't actually steal any money just by having online banking credentials.

KirinDave 11y ago

> I agree with the banks in part. Giving your online account credentials to access your banking information is complete madness. It's a giant security risk that neither company would likely cover if someone got a hold of your login details. This is the reason I purposely never signed up for Mint. As someone who collects these daily; I'd rather not collect them. The lengths I have to go to to ensure that they're not a major risk for our product? Significant. It's not a hard problem to solve, but the question is: "do banks want to solve it?" There's not much incentive for big banks to DECREASE account stickiness, and a lot of us waiting for great aggregation tools to totally dis-intermediate the big banks from their customers 8 ways till Tuesday. But to be honest, financial data is all sort of like this. For example, once someone has your ACH routing and account numbers, the only thing that really stops them from building a fraud factory is the fact that it's difficult to get permission to interact with the ACH network. You need to handle those with at least as much care as bank login info. And then, there was the MASSIVE fraud spree that everyone who didn't implement yellow path validation for ApplePay opened up. I personally had well over 80k stolen from my account in less than 1 day via that outrageous fraud loop. Thanks, Apple Stores and Chase, for pretending that someone else's fingerprint constitutes my biometric permission. On the subject of Chase, everyone in the industry was completely shut down without warning at the worst possible time by Chase. We're all pretty spicy about how it was handled.

ska 11y ago
In my experience (just as a client) Chase is very happy to act unilaterally and without communication. On the other hand, as an ex-client I have the option of just never dealing with them again.

xur17 11y ago

> On the second half of the argument. Banks need address the fact that users needs are changing and they want access to their own data, that they own, not the bank. A bank could create an API service with API keys specifically for these types of aggregate services to use. This could be done at first for just read only access, whereby the API does not allow you to transfer funds, etc. It would be a secure interface to access your data from third trusted third parties or your own apps. My capital one 360 account does this. I can generate an api key that I give to mint.

morgante 11y ago

> It's a giant security risk that neither company would likely cover if someone got a hold of your login details. Sure, but it shouldn't be the bank's decision to keep me from accessing my own customer data because it's insecure. If they actually wanted to fix this, it would be entirely possible to provide a read-only API.

lsaferite 11y ago

Isn't that the basic idea behind OFX though? I mean, role specific credentials with limited rights seems like it would work perfectly fine with the existing OFX spec.

shawkinaw 11y ago
My bank already does this, to a limited extent anyway. I use (slightly) different credentials for OFX login than if I go to the website.

superuser2 11y ago

> Giving your online account credentials to access your banking information is complete madness. It's a giant security risk Is it? My bank requires multi-factor confirmation to set up a new payee for electronic transfers and sends several emails for any transfer. You couldn't actually steal any money just by having online banking credentials.