3 ms·

Yeah, basically banks don't want a public api because security concerns. So people get around it by logging into the user's bank and scraping. Which is much le

Yeah, basically banks don't want a public api because security concerns. So people get around it by logging into the user's bank and scraping. Which is much less secure than just providing a secure api to begin with... All good intentions have consequences.

djsumdog 10y ago
Which is what mint.com does right? That service was terrifying; storing all those usernames and passwords. I'm very surprise there haven't been more security break-ins with that site.
- Cshelton 10y ago
  To my knowledge, that is what Mint is doing. I'm curious how they handle two factor authentication?
  - alistproducer2 10y ago
    In Project Posada, my open source Mint alternative project, we handle it with an app on the user's phone that receives texts and, using regex, grabs the code of relevant sms messages then pushes the code back to the scraper, which then inputs the code and continues on.
- overcast 10y ago
  David K Michaels, VP Engineering, Mint.com 27.2k Views For passwords to Mint itself, we compute a secure hash of the user's chosen password and store only the hash (the hash is also salted - see http://en.wikipedia.org/wiki/Sal.. http://en.wikipedia.org/wiki/Sal... ). Hashing is a one-way function and cannot be reversed. It is not possible to ever see or recover the password itself. When the user tries to login, we compute the hash of the password they are attempting to use and compare it to the hashed value on record. (This is a standard technique which every site should use). For banking credentials, we generally must use reversible encryption for which we have special procedures and secure hardware kept in our secure and guarded datacenter. The decryption keys never leave the hardware device (which is built to destroy the key material if the tamper protection is attacked). This device will only decrypt after it is activated by a quorum of other keys, each of which is stored on a smartcard and also encrypted by a password known to only one person. Furthermore the device requires a time-limited cryptographically-signed permission token for each decryption. The system (which I designed and patented) also has facilities for secure remote auditing of each decryption. https://www.quora.com/How-do-mint-com-and-similar-websites-avoid-storing-passwords-in-plain-text/answer/David-K-Michaels?share=1 https://www.quora.com/How-do-mint-com-and-similar-websites-a...
  - alistproducer2 10y ago
    If anyone is curious exactly how the system he describes works, here's a list of Mint's patent's. http://www.justanswer.com/intellectual-property-law/8u21f-patents-awarded-mint-com-la.html http://www.justanswer.com/intellectual-property-law/8u21f-pa...
fab123 10y ago
Check out https://geltbox.com https://geltbox.com With it you can basically create financial scrapers by just browsing the web. No API in the meantime but works just fine.

djsumdog 10y ago

Which is what mint.com does right? That service was terrifying; storing all those usernames and passwords. I'm very surprise there haven't been more security break-ins with that site.

Cshelton 10y ago
To my knowledge, that is what Mint is doing. I'm curious how they handle two factor authentication?
- alistproducer2 10y ago
  In Project Posada, my open source Mint alternative project, we handle it with an app on the user's phone that receives texts and, using regex, grabs the code of relevant sms messages then pushes the code back to the scraper, which then inputs the code and continues on.
overcast 10y ago
David K Michaels, VP Engineering, Mint.com 27.2k Views For passwords to Mint itself, we compute a secure hash of the user's chosen password and store only the hash (the hash is also salted - see http://en.wikipedia.org/wiki/Sal.. http://en.wikipedia.org/wiki/Sal... ). Hashing is a one-way function and cannot be reversed. It is not possible to ever see or recover the password itself. When the user tries to login, we compute the hash of the password they are attempting to use and compare it to the hashed value on record. (This is a standard technique which every site should use). For banking credentials, we generally must use reversible encryption for which we have special procedures and secure hardware kept in our secure and guarded datacenter. The decryption keys never leave the hardware device (which is built to destroy the key material if the tamper protection is attacked). This device will only decrypt after it is activated by a quorum of other keys, each of which is stored on a smartcard and also encrypted by a password known to only one person. Furthermore the device requires a time-limited cryptographically-signed permission token for each decryption. The system (which I designed and patented) also has facilities for secure remote auditing of each decryption. https://www.quora.com/How-do-mint-com-and-similar-websites-avoid-storing-passwords-in-plain-text/answer/David-K-Michaels?share=1 https://www.quora.com/How-do-mint-com-and-similar-websites-a...
- alistproducer2 10y ago
  If anyone is curious exactly how the system he describes works, here's a list of Mint's patent's. http://www.justanswer.com/intellectual-property-law/8u21f-patents-awarded-mint-com-la.html http://www.justanswer.com/intellectual-property-law/8u21f-pa...

fab123 10y ago

Check out https://geltbox.com https://geltbox.com With it you can basically create financial scrapers by just browsing the web. No API in the meantime but works just fine.