4 ms·

If you're in the UK and want a banking API (including payments and transfers), I'm building http://teller.io/ http://teller.io/. It's been in private beta about

If you're in the UK and want a banking API (including payments and transfers), I'm building http://teller.io/ http://teller.io/. It's been in private beta about 2.5 months and access will be opening more broadly soon. I couldn't wait for banks to get themselves into gear so I reverse engineered all of their mobile apps, took their private APIs and expose a single unified API through Teller. Here is a video of me cURL-ing my bank account yesterday: https://www.youtube.com/watch?v=wwWccFD0wv8 https://www.youtube.com/watch?v=wwWccFD0wv8 Here is a CLI one of my beta testers @sebinsua/@nouswaves made for his bank account: https://github.com/sebinsua/teller-cli https://github.com/sebinsua/teller-cli So far the RBS banks, e.g. Natwest are in prod. If you bank with them, want super early access, understand it's beta product and will give some feedback: sg <> @ <> teller.io

neximo4 11y ago
How did you reverse engineer the Natwest/Ulster/RBS app. It is my understanding they use certificate pinning?
- martinald 11y ago
  Certificate pinning is easy to defeat.
  - neximo4 11y ago
    Doesn't exactly answer the question..
    - alcari 11y ago
      If you can run the app on a jailbroken/rooted device, it's fairly easy to beat certificate pinning in a few different ways. Two that come to mind are: * find the certificate file in the app and replace it with your own. * hook the function that verifies the certificate and make it return true.
      - neximo4 11y ago
        If you tried reversing the app in question, none of these methods work as the app has a couple of protections against changing its code.
- sjtgraham 11y ago
  They do pin certs. I don't disable pinning, I quite like the protection it gives me. I actually inject code at runtime to observe and modify behaviour.
  - neximo4 11y ago
    Interesting. I've sent you an email about using teller. Hopefully you give me a shot at it.
konradb 11y ago
An API for Natwest would be amazing, but won't this be against their TOS? Just wondering if they are aware of your work and OK with it.
- sjtgraham 11y ago
  It's not against their TOS for me as a customer to reverse engineer their mobile clients (AFAIK), it is against their TOS for you as a bank customer to give Teller any authentication details. This is nothing new, the incumbent aggregator Yodlee also causes users to violate the bank TOS in this way. But aggregators solve such a pain point that users are prepared to use these services. Every UK bank is aware of Teller, even ones I have not interacted with directly. I've been up to Edinburgh and to the RBS London offices a bunch of times, I know them well. I hope to work with the banks and not against them.
gyre007 11y ago
This looks actually pretty cool. It ooks like its focussed on developers - reminds me of Stripe, but for bank APIs. I'd be curious about security as few of the URLs here shed any light on the topic and from my experience it often is rather INsecurity circus.
insomniacity 11y ago
Do we have to give you the full login details? I'm somewhat impressed though - I was defeated by certificate pinning on one UK bank's mobile app. How did you get round that?
- icebraining 11y ago
  There's a BlackHat presentation on this: https://media.blackhat.com/bh-us-12/Turbo/Diquet/BH_US_12_Diqut_Osborne_Mobile_Certificate_Pinning_Slides.pdf https://media.blackhat.com/bh-us-12/Turbo/Diquet/BH_US_12_Di...
- sjtgraham 11y ago
  Teller emulates the first party mobile client. So what you need to give Teller depends on what you need to enrol your mobile device. I don't disable PKI pinning. I inject code at runtime to observe and change behaviour.
aembleton 11y ago
Can you add Halifax to your dropdown of banks. I've selected Other but I think Halifax is big enough to be on the list.
- phillc73 11y ago
  I'd also like to suggest the addition of the Co-Operative Bank (they're not dead yet!) and/or Smile. I have a Smile account.
scorchin 11y ago
I've played with Teller and it's nothing short of incredible. The developer on boarding is super slick.
AffableSpatula 11y ago
Stevie gave me access a few weeks ago, I'm working on a product on top of Teller. What he's working on is really exciting and enables developers to build all kinds of apps they couldn't do previously.
seibelj 11y ago
Aren't there terms of service that prohibit you from reverse engineering their software and profiting from it? I want to build a mobile app on top of a private reverse engineered API and my lawyer says it could jeopardize my LLC's assets if we get sued
edward 11y ago
Are you using polling to discover new transactions, or do they send a notification to the mobile app?

neximo4 11y ago

How did you reverse engineer the Natwest/Ulster/RBS app. It is my understanding they use certificate pinning?

martinald 11y ago
Certificate pinning is easy to defeat.
- neximo4 11y ago
  Doesn't exactly answer the question..
  - alcari 11y ago
    If you can run the app on a jailbroken/rooted device, it's fairly easy to beat certificate pinning in a few different ways. Two that come to mind are: * find the certificate file in the app and replace it with your own. * hook the function that verifies the certificate and make it return true.
    - neximo4 11y ago
      If you tried reversing the app in question, none of these methods work as the app has a couple of protections against changing its code.
sjtgraham 11y ago
They do pin certs. I don't disable pinning, I quite like the protection it gives me. I actually inject code at runtime to observe and modify behaviour.
- neximo4 11y ago
  Interesting. I've sent you an email about using teller. Hopefully you give me a shot at it.

konradb 11y ago

An API for Natwest would be amazing, but won't this be against their TOS? Just wondering if they are aware of your work and OK with it.

sjtgraham 11y ago
It's not against their TOS for me as a customer to reverse engineer their mobile clients (AFAIK), it is against their TOS for you as a bank customer to give Teller any authentication details. This is nothing new, the incumbent aggregator Yodlee also causes users to violate the bank TOS in this way. But aggregators solve such a pain point that users are prepared to use these services. Every UK bank is aware of Teller, even ones I have not interacted with directly. I've been up to Edinburgh and to the RBS London offices a bunch of times, I know them well. I hope to work with the banks and not against them.

gyre007 11y ago

This looks actually pretty cool. It ooks like its focussed on developers - reminds me of Stripe, but for bank APIs. I'd be curious about security as few of the URLs here shed any light on the topic and from my experience it often is rather INsecurity circus.

insomniacity 11y ago

Do we have to give you the full login details? I'm somewhat impressed though - I was defeated by certificate pinning on one UK bank's mobile app. How did you get round that?

icebraining 11y ago
There's a BlackHat presentation on this: https://media.blackhat.com/bh-us-12/Turbo/Diquet/BH_US_12_Diqut_Osborne_Mobile_Certificate_Pinning_Slides.pdf https://media.blackhat.com/bh-us-12/Turbo/Diquet/BH_US_12_Di...
sjtgraham 11y ago
Teller emulates the first party mobile client. So what you need to give Teller depends on what you need to enrol your mobile device. I don't disable PKI pinning. I inject code at runtime to observe and change behaviour.

aembleton 11y ago

Can you add Halifax to your dropdown of banks. I've selected Other but I think Halifax is big enough to be on the list.

phillc73 11y ago
I'd also like to suggest the addition of the Co-Operative Bank (they're not dead yet!) and/or Smile. I have a Smile account.

scorchin 11y ago

I've played with Teller and it's nothing short of incredible. The developer on boarding is super slick.

AffableSpatula 11y ago

Stevie gave me access a few weeks ago, I'm working on a product on top of Teller. What he's working on is really exciting and enables developers to build all kinds of apps they couldn't do previously.

seibelj 11y ago

Aren't there terms of service that prohibit you from reverse engineering their software and profiting from it? I want to build a mobile app on top of a private reverse engineered API and my lawyer says it could jeopardize my LLC's assets if we get sued

edward 11y ago

Are you using polling to discover new transactions, or do they send a notification to the mobile app?