10 ms·

OAuth (Google Sign In / Facebook Login) is a pretty good technology in order to manage and share your information. What's nice about OAuth is that it allows th

by Johnie 11y ago

OAuth (Google Sign In / Facebook Login) is a pretty good technology in order to manage and share your information. What's nice about OAuth is that it allows the end user to control access to information and revoke access as needed. What is truly scary is that the banks and financial institutions have not implemented OAuth. Currently, financial data is provided to third party apps via aggregators, like Plaid and Yodlee. Unlike OAuth, once you log into your bank with a third party app, they get an access token that allows access to your account indefinitely. There is no mechanism to monitor which apps have access to your account and ability to revoke the access to individual apps. I posted about this a while back: https://medium.com/@johnie/let-my-financial-data-free-74f3b7476bda https://medium.com/@johnie/let-my-financial-data-free-74f3b7...

doomrobo 11y ago
Once access is established, there's nothing stopping the connected service to download all your information before you can disconnect it
njovin 11y ago
It goes beyond access to your data. With an account and routing number and access to ACH protocols anyone has essentially unrestricted access to your money. I ran into an issue last year where I was unable to get an insurance company to stop pulling money, unauthorized and automatically, from my account. Since the amounts were different each time, my bank said I had no recourse other than to continue disputing the charges or change my account number. So in that way it's a bit like oAuth, except you only have one key and when you revoke it, everybody loses access.
- Johnie 11y ago
  This is the CRAZIEST part of the banking system. The information to withdraw money from your account is on the bottom of the paper checks that you freely give out. Anyone with the routing number and account number can drain the entire account. ACH fraud in the US is in the ballpark of $100M / year. This is why I think we're only in the opening days of the FinTech shift. There's a lot to be done and a lot to fix.
  - julianz 11y ago
    "paper checks"... wow. You guys still have those? I found a book of them when I moved house recently, unused, from 10 years ago. Don't miss them even slightly.
    - raverbashing 11y ago
      Yeah, in the US and Canada they're pretty popular, since apparently nobody bothered to upgrade what ACH runs on
      - exelius 11y ago
        Also, because my wife and I use different banks but pay bills jointly, I just have her write me a check every month for her part of the bills. I then accept it using my bank's mobile check deposit feature. While we could do ACH transfers, it's way easier to just write a check.
        techsupporter 11y ago
        It amazes me the kinds of workarounds we have to do just to move money. I am a member of two credit unions, both of which participate in the Co-Op Shared ATM network so I can use most credit union ATMs to make withdrawals and deposits. One credit union holds my regular checking account. The other has my mortgage. Until the automatic payment gets set up, I pay my mortgage by going to a third-credit-union ATM (owned by a CU that is also on the shared ATM network) and withdrawing a pile of cash with one CU's card. I then stick that cash back into the ATM as a deposit with the other CU's card. The payment can thus be made as a "transfer" on the mortgage CU's online banking platform. It takes minutes to do that versus approximately 3 days to do an account-to-account transfer.
        lukebennett 11y ago
        3 days to do a bank transfer, ouch, that's a blast from the past. Sounds like you desperately need the Faster Payments system we have in the UK - allows you to transfer money between accounts (at different banks) instantly. Other than collections at church and the occasional business that doesn't take card, I hardly ever use cash these days.
- pault 11y ago
  I ran into this recently when my girlfriend paid her ~$5,000 credit card bill just by typing in my account/routing number. No authorization was required from me. I'm still confused and slightly outraged that this is possible.
  - sp332 11y ago
    The system is based more on forgiveness than permission.
  - astazangasta 11y ago
    It is cheaper to insure against theft than prevent it.
  - plaguuuuuu 11y ago
    This is completely impossible in Australia and, I suspect, many other places on earth.
- dsmithatx 11y ago
  The good news is that for personal accounts you should have 60 days to recover. Although if someone drained your account and you have to wait to pay rent, that might not be so comforting. Businesses I believe only get one day. This ACH fraud is crazy that it exist. My landlord gives me his account number to pay rent. The routing number is trivial to google but, lucky for him, I'm not a thief.
- KirinDave 11y ago
  > It goes beyond access to your data. With an account and routing number and access to ACH protocols anyone has essentially unrestricted access to your money. Fortunately Intuit has really, really poor coverage for this. Comically poor. Plaid only supports a few FIs. Never sign up for a service with Yodlee and you're statistically covered here. > Since the amounts were different each time, my bank said I had no recourse other than to continue disputing the charges or change my account number. For future reference, your bank should have offered to migrate you to a new ACH number for free. It's really quite illegal for them to allow ongoing fraud to occur once you've informed them of it. It's no different than if someone loads your Chase Debit number into an Apple Pay device and then adds biometrics (which btw: true tragedy and incredibly stupid. Chase needs to implement yellow path. I closed my accounts due to waves of fraud via this method). You're still not liable for damage, it's just scary and frustrating and time wasted.
- occamrazor 11y ago
  Doesn't the bank require previous written authorisation? I've used banks in several European countries, and on all cases I had to tell my bank explicitly who could send bills to be debited to my account. Moreover, all the authorisations were revokable at any time (although charge backs were not possible).
chejazi 11y ago
If you consider Coinbase a "bank" for Bitcoin, then they have implemented OAuth, quite nicely. Users can review permissions and revoke access in their Coinbase account. The link shortener I run relies on it to transact with my users (https://credhot.com https://credhot.com). I also use it for logging in, but that will go away soon in favor of social logins.
- ska 11y ago
  If you consider Coinbase a "bank" for Bitcoin. But of course that would not make much sense in this context.
  - chejazi 11y ago
    I don't understand. Why does this not make much sense?
IshKebab 11y ago
What bank allows logging in with a third party app? In the UK they all use secure tokens, SMS codes, etc.
- Johnie 11y ago
  UK and Europe is a lot more advanced than we are in the States. Some even provide APIs: * https://getmondo.co.uk/docs/ https://getmondo.co.uk/docs/ * https://openbankproject.com/ https://openbankproject.com/ * https://developer.fidor.de/ https://developer.fidor.de/
  - m1sta_ 11y ago
    UK banking is pathetic compared to Australia (and nobody in Austrlia is particularly proud of their bank)
    - yandie 11y ago
      My fiance is Australian, and so far from what I've heard, Australian system is inferior: * ATM has fees unless you use your own bank's * Transferring money takes quite some time to arrive There's higher rate of contactless payment adoption in Oz though it's picking up fast here in the UK as well
    - Symbiote 11y ago
      How so? I don't see anything mentioned here that the UK doesn't have.
    - deleted 11y ago
      [deleted]
  - tachion 11y ago
    UK in particular has the worst bankins systems and services I've yet seen in my life. Many European countries, including these from eastern Europe, have a banking industry that's 100 years ahead of UK (on example is where you can't just walk in to a bank and have your thing done - you have to schedule a visit, often weeks in advance. And opening an account - real nightmare, good luck with that, if you're not born&breed brit). However, said that, I do understand that this is the result of UK banks being actually oldest ones and the usual inertia of 'working' things made the changes way slower than the rest of the world.
Alex3917 11y ago
As someone who has recently developed an app with Google OAuth I'd like to second this. Google lets you register which servers the auth tokens can be used from, which means that even if the application database gets hacked your data is safe. Tokens are also rate limited at both the user and application level, which means that even if there is a zero-day attack targeting your web servers, you can set up monitoring software to automatically revoke your tokens so that no more than a tiny percentage of data is at risk of getting exposed. Although it can be dangerous to implement your own OAuth as a provider due to the complexity of the protocol, if you're merely granting an app access to your Facebook or Google account then as a user the security story is quite good.
- BinaryIdiot 11y ago
  > Google lets you register which servers the auth tokens can be used from, which means that even if the application database gets hacked your data is safe. This works when there are places of origin it can track but if you're handling tokens via a mobile device it's not as easy. Regardless I wouldn't say your data is "safe". If someone broke into your system and you cached Google's data (which you probably did; federated queries suck) then your data isn't safe at all. Even the token can be re-used (I mean if someone broke in I don't see why they couldn't run stuff on the same server or even looking like it came from the same server).
haddr 11y ago
I don't see how OAuth could mitigate the problem stated in the article. Once you allow some malucious app to your secret zone, it's done. Your data is now theirs. Doesn't matter if it was OAuth authorisation or you gave them your password (although the second one is probably worse).
- nine_k 11y ago
  You can revoke an OAuth token and prevent further data access, and, most important, data manipulation.
  - jtheory 11y ago
    Yes, but if they're already downloaded the last decade of your email history... well, I'm not sure how much it helps that you're blocking them from further access. What if they start emailing "helpful" links, invitations, whatever to everyone in your contact list? What if they are rather less strict about how they secure their (your) data, and they're employees spend lunch breaks poking around for public figures who might have interesting histories? These sharing mistakes are hugely easy to make, and sometimes have unpleasant consequences even with no malice intended on the app company's side. Someone in our company tried out do.com several months ago, and granted it access to our company directory in Google along the way. We didn't end up using the service; but unfortunately after a while of inactivity they started sending "invitation" emails to not just users on our own domain, but also Google Groups we have set up... some of which include customers of ours who were not at all amused to see that (it appeared) we had exposed their addresses to some random 3rd party without permission. Apologies all around, of course, but these days it's simply hard to be paranoid enough about this sort of thing. Gmail & Google Apps have tons of useful apps you can add with a few clicks; but what are you actually risking, using them?
jakubp 11y ago
"What's nice about OAuth is that it allows the end user to control access to information and revoke access as needed." Really? This has NEVER been my experience with OAuth or similar protocols. It's always all or nothing, and I can never: - limit the scope of any given type of permission - find out which data was actually accessed - limit the number of permissions given (it's all or nothing) I realize this takes much more work than simple protocol, but it's the same as on Android: either an app takes EVERYTHING they ask for, and noone tells you how exactly they used those capabilities (no api log, no nothing), or you can't use the app. I would much prefer a solution which lets me: - understand full scope of data access (what does it mean that a web-app can "manage my contacts" in Google account? Manage as in... delete? Change their details arbitrarily? What?!) - see full list, by app, what was actually accessed, and when - be able to pick which things I want the app to do, and which I don't - define (with groups, individual item selection or similar) which specific items I want the app to access If the app breaks because it doesn't support partial access, so be it. But not designing this ability into the UI is basically forcing users to forever become oblivious of how technology works.
- CaptSpify 11y ago
  Marshmallow is much better about this. You can actually control what apps can read, what they can write, etc. I wish it prompted you during the installation of the app, but it's getting better.
  - magicalist 11y ago
    Yeah, for those that don't know, you can go into Settings -> Apps -> pick an app -> Permissions and disable them at will. I believe only apps compiled against a Marshmallow SDK version will prompt you at runtime, and there's little (or even negative) incentive for app developers to do that yet.
    - dudus 11y ago
      There's a great incentive on automatic updates. If you updated an app pre marshmallow with an extra permission it required the user to approve the update and that ultimately creates a problem with a large user base stuck on older versions. Maybe for new apps there's less incentive to reduce access, I can't think about any other than compliance and user scrutinity. It's easy to spot bad reviews complaining about excessive permissions for some apps.
peter_l_downs 11y ago
> What's nice about OAuth is that it allows the end user to control access to information and revoke access as needed. One thing to know is that this is entirely up to the implementer. As others have noted, some sites do this, some don't. The concept of an access token having some "scope" of authorization is not limited to OAuth – there's no reason this can't be done with any other sort of authorization protocol. Bank security procedures are bad and they should feel bad but I'm not sure OAuth is the right solution.
KirinDave 11y ago
> What is truly scary is that the banks and financial institutions have not implemented OAuth. Currently, financial data is provided to third party apps via aggregators, like Plaid and Yodlee. Hi. I was the CTO of Level Money, that ultimately had a meta-aggregation platform on top of all the major aggregators. We were acquired by Capital One. Disclosures: complete. Can I just put out there: every major FI has talked about OAuth2. We all know about OAuth2. It's entirely within our technical capabilities to make an API and then allow OAuth2 access. We could even make said access public. The "can they" is answered: yes we could. Yes, we have prototypes. And yes, there are non-technical obstacles. Pardon me while I Nod Dance & Amble. But there is a larger question about the aggregation problem. Banks are rightly concerned that if they do open these up, they'll be consumed wholesale by the major tech companies. You could imagine a world where Google partners with your bank to make a pretty amazing experience, but in the process it's almost certain that Google would have a significant upper hand. Most banks (even C1360, which I and many other people are working constantly on modernizing) simply aren't ready to work with giants like Microsoft, Google or Facebook as equals. That, sadly, will take years as these organizations realize they have to do this. We're all in sort of a slow motion race towards this goal. Slow motion compared to the outside world (as I am all to keenly aware), that is. Internally, the process by which we do this is hugely complicated by US law and regulation. There is this wonderful thing where "regulatory capture" backfires and then you're imprisoned. For every thing that a bank charter enables, it closes off another 2-3 things that never mattered until things started being judged by their slickness in a mobile app context. As for disconnecting from aggregators, let me tell you as an insider what you can do. Change your password. No really, change your bank password. EVERY major aggregator has a flow that requires they respect this at a technical level. If that fails, it's on your bank and you should shout at them VERY loudly. But before you do, make sure you are ready to prove yourself as a banker. What will happen with most aggregators is that they'll have to decide, "is this person actually gone or is this stupid web scraper just having a bit of a problem?" They'll try and log in again, at least once in most cases. If you have hooked up multiple services (or the same service multiple times), these will trigger account lockouts just like any failed web login would.
csours 11y ago
It's kind of incredible to me that EVE Online can get this right [1], but my banks cannot [2]. 1. https://support.eveonline.com/hc/en-us/articles/202428251-API-Key-Management https://support.eveonline.com/hc/en-us/articles/202428251-AP... 2. I have to log provide my passwords to mint.com and hope they don't misuse them.

by Johnie 11y ago

doomrobo 11y ago

Once access is established, there's nothing stopping the connected service to download all your information before you can disconnect it

njovin 11y ago

It goes beyond access to your data. With an account and routing number and access to ACH protocols anyone has essentially unrestricted access to your money. I ran into an issue last year where I was unable to get an insurance company to stop pulling money, unauthorized and automatically, from my account. Since the amounts were different each time, my bank said I had no recourse other than to continue disputing the charges or change my account number. So in that way it's a bit like oAuth, except you only have one key and when you revoke it, everybody loses access.

Johnie 11y ago
This is the CRAZIEST part of the banking system. The information to withdraw money from your account is on the bottom of the paper checks that you freely give out. Anyone with the routing number and account number can drain the entire account. ACH fraud in the US is in the ballpark of $100M / year. This is why I think we're only in the opening days of the FinTech shift. There's a lot to be done and a lot to fix.
- julianz 11y ago
  "paper checks"... wow. You guys still have those? I found a book of them when I moved house recently, unused, from 10 years ago. Don't miss them even slightly.
  - raverbashing 11y ago
    Yeah, in the US and Canada they're pretty popular, since apparently nobody bothered to upgrade what ACH runs on
    - exelius 11y ago
      Also, because my wife and I use different banks but pay bills jointly, I just have her write me a check every month for her part of the bills. I then accept it using my bank's mobile check deposit feature. While we could do ACH transfers, it's way easier to just write a check.
      - techsupporter 11y ago
        It amazes me the kinds of workarounds we have to do just to move money. I am a member of two credit unions, both of which participate in the Co-Op Shared ATM network so I can use most credit union ATMs to make withdrawals and deposits. One credit union holds my regular checking account. The other has my mortgage. Until the automatic payment gets set up, I pay my mortgage by going to a third-credit-union ATM (owned by a CU that is also on the shared ATM network) and withdrawing a pile of cash with one CU's card. I then stick that cash back into the ATM as a deposit with the other CU's card. The payment can thus be made as a "transfer" on the mortgage CU's online banking platform. It takes minutes to do that versus approximately 3 days to do an account-to-account transfer.
        lukebennett 11y ago
        3 days to do a bank transfer, ouch, that's a blast from the past. Sounds like you desperately need the Faster Payments system we have in the UK - allows you to transfer money between accounts (at different banks) instantly. Other than collections at church and the occasional business that doesn't take card, I hardly ever use cash these days.
pault 11y ago
I ran into this recently when my girlfriend paid her ~$5,000 credit card bill just by typing in my account/routing number. No authorization was required from me. I'm still confused and slightly outraged that this is possible.
- sp332 11y ago
  The system is based more on forgiveness than permission.
- astazangasta 11y ago
  It is cheaper to insure against theft than prevent it.
- plaguuuuuu 11y ago
  This is completely impossible in Australia and, I suspect, many other places on earth.
dsmithatx 11y ago
The good news is that for personal accounts you should have 60 days to recover. Although if someone drained your account and you have to wait to pay rent, that might not be so comforting. Businesses I believe only get one day. This ACH fraud is crazy that it exist. My landlord gives me his account number to pay rent. The routing number is trivial to google but, lucky for him, I'm not a thief.
KirinDave 11y ago
> It goes beyond access to your data. With an account and routing number and access to ACH protocols anyone has essentially unrestricted access to your money. Fortunately Intuit has really, really poor coverage for this. Comically poor. Plaid only supports a few FIs. Never sign up for a service with Yodlee and you're statistically covered here. > Since the amounts were different each time, my bank said I had no recourse other than to continue disputing the charges or change my account number. For future reference, your bank should have offered to migrate you to a new ACH number for free. It's really quite illegal for them to allow ongoing fraud to occur once you've informed them of it. It's no different than if someone loads your Chase Debit number into an Apple Pay device and then adds biometrics (which btw: true tragedy and incredibly stupid. Chase needs to implement yellow path. I closed my accounts due to waves of fraud via this method). You're still not liable for damage, it's just scary and frustrating and time wasted.
occamrazor 11y ago
Doesn't the bank require previous written authorisation? I've used banks in several European countries, and on all cases I had to tell my bank explicitly who could send bills to be debited to my account. Moreover, all the authorisations were revokable at any time (although charge backs were not possible).

chejazi 11y ago

If you consider Coinbase a "bank" for Bitcoin, then they have implemented OAuth, quite nicely. Users can review permissions and revoke access in their Coinbase account. The link shortener I run relies on it to transact with my users (https://credhot.com https://credhot.com). I also use it for logging in, but that will go away soon in favor of social logins.

ska 11y ago
If you consider Coinbase a "bank" for Bitcoin. But of course that would not make much sense in this context.
- chejazi 11y ago
  I don't understand. Why does this not make much sense?

IshKebab 11y ago

What bank allows logging in with a third party app? In the UK they all use secure tokens, SMS codes, etc.

Johnie 11y ago
UK and Europe is a lot more advanced than we are in the States. Some even provide APIs: * https://getmondo.co.uk/docs/ https://getmondo.co.uk/docs/ * https://openbankproject.com/ https://openbankproject.com/ * https://developer.fidor.de/ https://developer.fidor.de/
- m1sta_ 11y ago
  UK banking is pathetic compared to Australia (and nobody in Austrlia is particularly proud of their bank)
  - yandie 11y ago
    My fiance is Australian, and so far from what I've heard, Australian system is inferior: * ATM has fees unless you use your own bank's * Transferring money takes quite some time to arrive There's higher rate of contactless payment adoption in Oz though it's picking up fast here in the UK as well
  - Symbiote 11y ago
    How so? I don't see anything mentioned here that the UK doesn't have.
  - deleted 11y ago
    [deleted]
- tachion 11y ago
  UK in particular has the worst bankins systems and services I've yet seen in my life. Many European countries, including these from eastern Europe, have a banking industry that's 100 years ahead of UK (on example is where you can't just walk in to a bank and have your thing done - you have to schedule a visit, often weeks in advance. And opening an account - real nightmare, good luck with that, if you're not born&breed brit). However, said that, I do understand that this is the result of UK banks being actually oldest ones and the usual inertia of 'working' things made the changes way slower than the rest of the world.

Alex3917 11y ago

As someone who has recently developed an app with Google OAuth I'd like to second this. Google lets you register which servers the auth tokens can be used from, which means that even if the application database gets hacked your data is safe. Tokens are also rate limited at both the user and application level, which means that even if there is a zero-day attack targeting your web servers, you can set up monitoring software to automatically revoke your tokens so that no more than a tiny percentage of data is at risk of getting exposed. Although it can be dangerous to implement your own OAuth as a provider due to the complexity of the protocol, if you're merely granting an app access to your Facebook or Google account then as a user the security story is quite good.

BinaryIdiot 11y ago
> Google lets you register which servers the auth tokens can be used from, which means that even if the application database gets hacked your data is safe. This works when there are places of origin it can track but if you're handling tokens via a mobile device it's not as easy. Regardless I wouldn't say your data is "safe". If someone broke into your system and you cached Google's data (which you probably did; federated queries suck) then your data isn't safe at all. Even the token can be re-used (I mean if someone broke in I don't see why they couldn't run stuff on the same server or even looking like it came from the same server).

haddr 11y ago

I don't see how OAuth could mitigate the problem stated in the article. Once you allow some malucious app to your secret zone, it's done. Your data is now theirs. Doesn't matter if it was OAuth authorisation or you gave them your password (although the second one is probably worse).

nine_k 11y ago
You can revoke an OAuth token and prevent further data access, and, most important, data manipulation.
- jtheory 11y ago
  Yes, but if they're already downloaded the last decade of your email history... well, I'm not sure how much it helps that you're blocking them from further access. What if they start emailing "helpful" links, invitations, whatever to everyone in your contact list? What if they are rather less strict about how they secure their (your) data, and they're employees spend lunch breaks poking around for public figures who might have interesting histories? These sharing mistakes are hugely easy to make, and sometimes have unpleasant consequences even with no malice intended on the app company's side. Someone in our company tried out do.com several months ago, and granted it access to our company directory in Google along the way. We didn't end up using the service; but unfortunately after a while of inactivity they started sending "invitation" emails to not just users on our own domain, but also Google Groups we have set up... some of which include customers of ours who were not at all amused to see that (it appeared) we had exposed their addresses to some random 3rd party without permission. Apologies all around, of course, but these days it's simply hard to be paranoid enough about this sort of thing. Gmail & Google Apps have tons of useful apps you can add with a few clicks; but what are you actually risking, using them?

jakubp 11y ago

"What's nice about OAuth is that it allows the end user to control access to information and revoke access as needed." Really? This has NEVER been my experience with OAuth or similar protocols. It's always all or nothing, and I can never: - limit the scope of any given type of permission - find out which data was actually accessed - limit the number of permissions given (it's all or nothing) I realize this takes much more work than simple protocol, but it's the same as on Android: either an app takes EVERYTHING they ask for, and noone tells you how exactly they used those capabilities (no api log, no nothing), or you can't use the app. I would much prefer a solution which lets me: - understand full scope of data access (what does it mean that a web-app can "manage my contacts" in Google account? Manage as in... delete? Change their details arbitrarily? What?!) - see full list, by app, what was actually accessed, and when - be able to pick which things I want the app to do, and which I don't - define (with groups, individual item selection or similar) which specific items I want the app to access If the app breaks because it doesn't support partial access, so be it. But not designing this ability into the UI is basically forcing users to forever become oblivious of how technology works.

CaptSpify 11y ago
Marshmallow is much better about this. You can actually control what apps can read, what they can write, etc. I wish it prompted you during the installation of the app, but it's getting better.
- magicalist 11y ago
  Yeah, for those that don't know, you can go into Settings -> Apps -> pick an app -> Permissions and disable them at will. I believe only apps compiled against a Marshmallow SDK version will prompt you at runtime, and there's little (or even negative) incentive for app developers to do that yet.
  - dudus 11y ago
    There's a great incentive on automatic updates. If you updated an app pre marshmallow with an extra permission it required the user to approve the update and that ultimately creates a problem with a large user base stuck on older versions. Maybe for new apps there's less incentive to reduce access, I can't think about any other than compliance and user scrutinity. It's easy to spot bad reviews complaining about excessive permissions for some apps.

peter_l_downs 11y ago

> What's nice about OAuth is that it allows the end user to control access to information and revoke access as needed. One thing to know is that this is entirely up to the implementer. As others have noted, some sites do this, some don't. The concept of an access token having some "scope" of authorization is not limited to OAuth – there's no reason this can't be done with any other sort of authorization protocol. Bank security procedures are bad and they should feel bad but I'm not sure OAuth is the right solution.

KirinDave 11y ago

> What is truly scary is that the banks and financial institutions have not implemented OAuth. Currently, financial data is provided to third party apps via aggregators, like Plaid and Yodlee. Hi. I was the CTO of Level Money, that ultimately had a meta-aggregation platform on top of all the major aggregators. We were acquired by Capital One. Disclosures: complete. Can I just put out there: every major FI has talked about OAuth2. We all know about OAuth2. It's entirely within our technical capabilities to make an API and then allow OAuth2 access. We could even make said access public. The "can they" is answered: yes we could. Yes, we have prototypes. And yes, there are non-technical obstacles. Pardon me while I Nod Dance & Amble. But there is a larger question about the aggregation problem. Banks are rightly concerned that if they do open these up, they'll be consumed wholesale by the major tech companies. You could imagine a world where Google partners with your bank to make a pretty amazing experience, but in the process it's almost certain that Google would have a significant upper hand. Most banks (even C1360, which I and many other people are working constantly on modernizing) simply aren't ready to work with giants like Microsoft, Google or Facebook as equals. That, sadly, will take years as these organizations realize they have to do this. We're all in sort of a slow motion race towards this goal. Slow motion compared to the outside world (as I am all to keenly aware), that is. Internally, the process by which we do this is hugely complicated by US law and regulation. There is this wonderful thing where "regulatory capture" backfires and then you're imprisoned. For every thing that a bank charter enables, it closes off another 2-3 things that never mattered until things started being judged by their slickness in a mobile app context. As for disconnecting from aggregators, let me tell you as an insider what you can do. Change your password. No really, change your bank password. EVERY major aggregator has a flow that requires they respect this at a technical level. If that fails, it's on your bank and you should shout at them VERY loudly. But before you do, make sure you are ready to prove yourself as a banker. What will happen with most aggregators is that they'll have to decide, "is this person actually gone or is this stupid web scraper just having a bit of a problem?" They'll try and log in again, at least once in most cases. If you have hooked up multiple services (or the same service multiple times), these will trigger account lockouts just like any failed web login would.

csours 11y ago

It's kind of incredible to me that EVE Online can get this right [1], but my banks cannot [2]. 1. https://support.eveonline.com/hc/en-us/articles/202428251-API-Key-Management https://support.eveonline.com/hc/en-us/articles/202428251-AP... 2. I have to log provide my passwords to mint.com and hope they don't misuse them.