4 ms·
I would think handing over your bank username and password is a horribly backward and insecure design. Am I missing something?
by hayksaakian 11y ago
I would think handing over your bank username and password is a horribly backward and insecure design.
Am I missing something?
- nemothekid 11y agoI'm not sure about Dwolla's offering, but on Mint when you do it, it functions similarly the same as an OAuth login.
- deleted 11y ago[deleted]
- hayksaakian 11y agoWell, with oauth, you are not telling dwolla your password. You are telling the 3rd party, that dwolla (or whoever) can have an access token to your account, verified via popup to facebook, or a redirect to facebook. Imagine if "login with facebook" meant "tell my startup your facebook password". How is this considered OK?
- simoncion 11y ago> How is this considered OK? If I might snark for a second: Because banks say: "We're the bank. We're run by Masters of the Universe, we are the smartest people in the room, and you can trust us and our data-handling practices!" To be serious: Having to disclose the same credentials that give you access to the web UI for your bank accounts to a random third-party in order to use their service is insane.
- uptown 11y agoWith Mint you give them your username and password.
- nemothekid 11y agoI'm not sure about Dwolla's offering, but on Mint when you do it, it functions similarly the same as an OAuth login.
- deleted 11y ago[deleted]
- almost_usual 11y agoThis is pretty common nowadays, there are companies that have designed APIs specifically for bank account verification using username and password (Yodlee, Plaid, etc..).
- pbreit 11y agoI would tend to agree that a lot of "random" sites asking for your online banking username/password is not ideal. This is potentially a step in the right direction since it's "iframed" so the host site presumably never has access to your credentials. But then you have to worry about who Dwolla (or Plaid) is which I'm guessing most of America doesn't.
- tomasien 11y agoIt's much better than using account and routing numbers because you can change the password at any time. Account and routing numbers are static.