5 ms·

This is good to hear, but also rings a bit hollow given the industry's history with trying to keep data locked up. There are very simple things the industry cou

by curun1r 10y ago

This is good to hear, but also rings a bit hollow given the industry's history with trying to keep data locked up. There are very simple things the industry could have done long ago to make their users more secure and they've done none of it. For instance, banks could have let users create read-only credentials to give to aggregators greatly reducing the potential for fraud. They could've created application-specific passwords, similar to what Google has done, that would allow more intelligent application of MFA and such...every time I log into Mint, I get a text message from Vanguard telling me that an unrecognized device is attempting to log in, requiring me to fix the account in Mint. Instead, they've basically adopted a "let's make it as difficult to scrape as possible" mentality which has contributed to the insecure and buggy situation we have today. APIs are good, as are OAuth-style permissions requests where users get to at least know what data a service is asking for. But they shouldn't be used as a way to kill off screen scraping. They should be a better option that allows screen scraping to die off normally. The aggregation industry that scrapes hates it even more than the banks do. It costs them a ton of man power to keep it working and each integration needs to be done as a one-off. If the banks provide a better solution, it will get used. Better yet, if they can come up with a single standard API that will work with most/all banks, that would be even better. But if the banks also take measures to prevent scraping, it is going to cause problems and not be a good thing for account holders.

tln 10y ago
Wells Fargo allows me to create Read Only credentials! They should get credit for this feature. I wish all my financial accounts had this.
- ceejayoz 10y ago
  That's amazing as banks go. Wow.
- fatbob 10y ago
  Do you have a link for this? Is it only for business accounts?
  - StavrosK 10y ago
    It seems to work for my personal account. Account Services -> Guest users. I haven't tried to add an account, but I see the interface fine.
    - fatbob 10y ago
      That's pretty nice - it's even better than what ING used to do. It still doesn't get around the problem of Wells Fargo charging for OFX access though.
- semi-extrinsic 10y ago
  I was going to ask, why do you need to give third parties read access to your account? I've never done so in my life, and can't see the use case. Then I see further down: it's for the FUBAR tax return system in the US. Here's a solution for you: fix your damned tax return system first (and watch Intuit go out of business in the process). Then you've solved many big problems, not just a small one.
  - mryan 10y ago
    > I was going to ask, why do you need to give third parties read access to your account? Tax is not the only reason. How about data analysis services for your personal finances? e.g. mint.com.
    - semi-extrinsic 10y ago
      TIL this is a thing third parties do in the US. Round here (Norway), your bank already does this analysis part. When I log into my bank's app or webpage, I get an instant overview of how much I spent last month on the mortgage, food, gas, insurance, clothes etc. And I can define custom categories, as well as change how the system sorts transactions into different categories. The budgets for the next 12 months my wife and I keep in a shared Google Docs spreadsheet. Planning requires thought, so I'm skeptical that you can automate a budget and then have people follow it (unless it's a very lenient budget).
      - toomanybeersies 10y ago
        It's a separation of concerns thing. Sure, you can use your bank for analysis, but there's better options out there. Banks are for storing money, not financial analysis.
        mrexroad 10y ago
        i think if my bank offered advice, i'd strongly consider doing the exact opposite of whatever they suggested. i'd rank it up there w/ listening to jiffy lube's recommendation to refill the blinker fluid.
fatbob 10y ago
It's hypocrisy from banks/brokerages in general since they actually promote aggregation on their own websites. Vanguard has one, for instance - they're probably using Yodlee. They also charge absurd prices ($10/month) for OFX access. OFX access + very simple read-only passwords would solve this whole mess of screen scraping.
- chimeracoder 10y ago
  OFX is great. I mean, it's not great if you have to implement it, but if you just want to use it (ie, with Quicken or GNUCash or some other piece of software), it Just Works™. The only problem with it is that not all banks support it, and when they do, many charge prohibitive fees for it. Security shouldn't be a premium feature.
  - themartorana 10y ago
    That's the Quote Of The Day. "Security shouldn't be a premium feature." Apply liberally.
HannibalLecter 10y ago
Banks don't do anything unless they can make a buck.
click170 10y ago
I think part of the problem is people dont complain to their bank about the lack of these features, and don't ask about them when shopping around for a new bank. Call your bank. Ask for these features. What have you got to lose? They'll probably ignore you, but we have to start somewhere and asking them certainly won't make things worse.
andyjdavis 10y ago
>banks could have let users create read-only credentials I am Australian and at least one bank here does this. We used it for a book keeper in a former company. It was helpful for the book keeper to have the ability to access our financial data to do their job without having to hassle us for data exports or whatever. At the same time the don't want to be in possession of a big collection of bank log in details that could be used to steal money. It let them log in, export the data they needed and that was all.
- iofj 10y ago
  Which bank are you talking about ? I'd love to have a bank account like that for nonstandard transactions. As far as I can tell, this is only possible paid.
  - Schwolop 10y ago
    Certainly not CBA, but allegedly Westpac and NAB both allow "view only" access for third parties. (I cannot confirm this, but have seen it mentioned on the CBA's uservoice request for this feature[1]) [1] https://community.commbank.com.au/t5/NetBank/How-to-set-up-a-read-only-user-to-my-netbank/td-p/3299 https://community.commbank.com.au/t5/NetBank/How-to-set-up-a...
  - andyjdavis 10y ago
    Pretty sure it was bank of queensland but this was quite some time ago. If you go to http://www.boq.com.au/ http://www.boq.com.au/ and go through to their log in screen this is why there are three text boxes instead of the usual two (a clunky solution to needing different login details from different people).

by curun1r 10y ago

tln 10y ago

Wells Fargo allows me to create Read Only credentials! They should get credit for this feature. I wish all my financial accounts had this.

ceejayoz 10y ago
That's amazing as banks go. Wow.
fatbob 10y ago
Do you have a link for this? Is it only for business accounts?
- StavrosK 10y ago
  It seems to work for my personal account. Account Services -> Guest users. I haven't tried to add an account, but I see the interface fine.
  - fatbob 10y ago
    That's pretty nice - it's even better than what ING used to do. It still doesn't get around the problem of Wells Fargo charging for OFX access though.
semi-extrinsic 10y ago
I was going to ask, why do you need to give third parties read access to your account? I've never done so in my life, and can't see the use case. Then I see further down: it's for the FUBAR tax return system in the US. Here's a solution for you: fix your damned tax return system first (and watch Intuit go out of business in the process). Then you've solved many big problems, not just a small one.
- mryan 10y ago
  > I was going to ask, why do you need to give third parties read access to your account? Tax is not the only reason. How about data analysis services for your personal finances? e.g. mint.com.
  - semi-extrinsic 10y ago
    TIL this is a thing third parties do in the US. Round here (Norway), your bank already does this analysis part. When I log into my bank's app or webpage, I get an instant overview of how much I spent last month on the mortgage, food, gas, insurance, clothes etc. And I can define custom categories, as well as change how the system sorts transactions into different categories. The budgets for the next 12 months my wife and I keep in a shared Google Docs spreadsheet. Planning requires thought, so I'm skeptical that you can automate a budget and then have people follow it (unless it's a very lenient budget).
    - toomanybeersies 10y ago
      It's a separation of concerns thing. Sure, you can use your bank for analysis, but there's better options out there. Banks are for storing money, not financial analysis.
      - mrexroad 10y ago
        i think if my bank offered advice, i'd strongly consider doing the exact opposite of whatever they suggested. i'd rank it up there w/ listening to jiffy lube's recommendation to refill the blinker fluid.

fatbob 10y ago

It's hypocrisy from banks/brokerages in general since they actually promote aggregation on their own websites. Vanguard has one, for instance - they're probably using Yodlee. They also charge absurd prices ($10/month) for OFX access. OFX access + very simple read-only passwords would solve this whole mess of screen scraping.

chimeracoder 10y ago
OFX is great. I mean, it's not great if you have to implement it, but if you just want to use it (ie, with Quicken or GNUCash or some other piece of software), it Just Works™. The only problem with it is that not all banks support it, and when they do, many charge prohibitive fees for it. Security shouldn't be a premium feature.
- themartorana 10y ago
  That's the Quote Of The Day. "Security shouldn't be a premium feature." Apply liberally.

HannibalLecter 10y ago

Banks don't do anything unless they can make a buck.

click170 10y ago

I think part of the problem is people dont complain to their bank about the lack of these features, and don't ask about them when shopping around for a new bank. Call your bank. Ask for these features. What have you got to lose? They'll probably ignore you, but we have to start somewhere and asking them certainly won't make things worse.

andyjdavis 10y ago

>banks could have let users create read-only credentials I am Australian and at least one bank here does this. We used it for a book keeper in a former company. It was helpful for the book keeper to have the ability to access our financial data to do their job without having to hassle us for data exports or whatever. At the same time the don't want to be in possession of a big collection of bank log in details that could be used to steal money. It let them log in, export the data they needed and that was all.

iofj 10y ago
Which bank are you talking about ? I'd love to have a bank account like that for nonstandard transactions. As far as I can tell, this is only possible paid.
- Schwolop 10y ago
  Certainly not CBA, but allegedly Westpac and NAB both allow "view only" access for third parties. (I cannot confirm this, but have seen it mentioned on the CBA's uservoice request for this feature[1]) [1] https://community.commbank.com.au/t5/NetBank/How-to-set-up-a-read-only-user-to-my-netbank/td-p/3299 https://community.commbank.com.au/t5/NetBank/How-to-set-up-a...
- andyjdavis 10y ago
  Pretty sure it was bank of queensland but this was quite some time ago. If you go to http://www.boq.com.au/ http://www.boq.com.au/ and go through to their log in screen this is why there are three text boxes instead of the usual two (a clunky solution to needing different login details from different people).