7 ms·

WTF? What is open about a system that only very few organisations can use? Imagine in the paper world, now you not only can ask the bank how much money you have

WTF? What is open about a system that only very few organisations can use? Imagine in the paper world, now you not only can ask the bank how much money you have, you can also authorize other companies to look at your account statements for you ... but noone got the idea that maybe you, the account holder, should be able to get a copy of the account statements? It seems we are still at the "reading and writing is for monks" stage of digital technology? God forbid the laypeople themselves use pen and paper!

ErrantX 9y ago
Its a fair criticism in part; but you are a technologist and so want unfiltered access to play with that data. For the vast majority of people that's meaningless - so to be able to share that data with companies offering new and interesting services (AIS sign up is reasonably lightweight, certainly within trivial reach of any startup) is a big step forward. I think we should be encouraging! (Or in other words; your thinking of the limitations on the micro level and missing the benefits at the macro) FWIW GDPR is more interesting legislation for what your after - you will have the ability to get access to your own data. Unfortunately that legislation didn't push hard enough to promote the idea of digital access - we should level our criticism most harshly there to try and effect change :)
- tialaramex 9y ago
  Digital access to your data isn't likely to work out generally unless you're happy with "Here's a PDF sent to your email address" in which case, sure, that's going to happen. I look after a system that has loads of PII, as a mix of traditional SQL databases and RDF with a bunch of RESTful service layers keeping it all in neat boxes so it's not a sprawling unmanageable mess. Now, if you ask for Subject Access after our verification team is happy that you're who you say you are I can and will extract the data that's clearly about you from those sources, tart it up and reformat it, and shove that into a PDF you can have. What I can't realistically do, even if they tried to legislate for it, is make say the RDF data structures somehow understandable to the lay person who thinks "graph" means "chart" and "a triple" is when you win three things in a row. OpenBanking works because ultimately the banks are pretty interchangeable when it comes to ordinary personal accounts. Money comes in or out, there's some short half-arsed text saying why, an amount, it's a very regular structure. But imagine trying to build a single "digital access" that works for your Reddit posts, health records, grocery purchases, subscription to Playboy, and MetroCard account... what on Earth would the UX be for that? Google gives us an idea what the best we could hope for is - if you sign in and say you want all your data, Google will ZIP it all up for you. But it's not a coherent system, it's just like somebody's old PC backup, a bunch of unrelated files in different formats in a ZIP file.
  - Y_Y 9y ago
    Just because plebs can't understand triples doesnt mean they should have the right to seem (and potentially show them to someone who does). It might even get people to learn or write software to make sense of whatever data structure. In any case it shouldn't be up to the data borrower.
- zAy0LfpBZLC8mAC 9y ago
  > For the vast majority of people that's meaningless Erm ... WTF?! I'm not sure how explain this as it just seems so obvious, but ... you can, like, use software that other people write on your own computer!? There is no need to have any clue whatsoever of software development nor to share your data with any third party in order to profit from open APIs. People can use Thunderbird to read and write email without any need to be able to write software because there are open POP3, IMAP, and SMTP specs and you can have POP3, IMAP, and SMTP credentials for your email provider ... how is that meaningless to the vast majority of people?! > I think we should be encouraging! Encouraging of what? More centralization of data processing? Less control for the consumer? > FWIW GDPR is more interesting legislation for what your after Not at all. That is about data protection, not about machine readable interfaces. First of all, being able to access my data does not in any way allow me to initiate transactions, which is a ciritical part of banking functionality. But also, being able to access data does not at all mean being able to process it using a computer. I can have access to all the data companies store about me now, and most of them will simply send a letter with a printout to fulfill their legal obligations.
  - ErrantX 9y ago
    Thats what I mean; PSD2 has always been about B2B. GDPR is business to consumer and we should critique it to press for digital solutions that are meaningful for consumers. As to the desktop app business; well sure but my hope is we build to this sort of thing. No harm is starting somewhere!
    - zAy0LfpBZLC8mAC 9y ago
      > Thats what I mean; PSD2 has always been about B2B. Which is precisely why it is bad?! > GDPR is business to consumer and we should critique it to press for digital solutions that are meaningful for consumers. No, GDPR simply does not have anything to do with this. GDPR is about human rights, not about technological development. Machine readable access might still be a worthwhile goal in that area, but extending data protection to encompass the right to submit transactions to your bank via a machine readable standardized interface certainly would be a stretch. > As to the desktop app business; well sure but my hope is we build to this sort of thing. No harm is starting somewhere! But are we starting anywhere? Say I want to write free banking software for people who care about their privacy ... are we even the slightest bit closer to being able to do that? Or isn't this rather a step in the opposite direction in that it further cements the idea of having monks do all the reading and writing for your?
Vinnl 9y ago
Are you sure you can't? Besides the paper statements, I can download my transaction data in a variety of formats including CSV from every bank I've use in the Netherlands.
- vidarh 9y ago
  The problem is that for a lot of banks there is no easy way to automate that process. I think 90 percent of use cases would be addressed simply by providing a way of giving automated read only access to statements.
  - zoltaan 9y ago
    Instead giving access to EVERYTHING seems a little overdrive then....
- sambe 9y ago
  Does the history go back more than a year or two?
  - masklinn 9y ago
    I would expect they are, if only for legal reasons. According to my bank's website, I can get account statements up to 10 years back, except for closed accounts.
- zAy0LfpBZLC8mAC 9y ago
  Well, that was just an example for the sake of an analogy? Obviously, I want a fully machine-readable API to all of my bank's functionality. Which also "downloading transaction data as CSV" does not fit at all if I have to manually log in and download the data. Also, CSV lists of transactions usually are useless for synchronization as they usually don't provide any mechanism to reliably deduplicate transactions and to check for completeness.
crdoconnor 9y ago
If you wanted to run a startup that ran APIs which bank customers could use this bill would presumably make that possible.
- zAy0LfpBZLC8mAC 9y ago
  Which is supposed to solve the problem how? Now I as a customer am dependent on the proprietary API of some startup? Or do you expect startups to compete on a standardized API? And why should I have to employ a monk looking through my bank statements to be able to get access to them? Sure that can be a basis for an idiotic hack, but how does that make it a sensible approach?
  - crdoconnor 9y ago
    >Or do you expect startups to compete on a standardized API? At least an API. If that's what customers really want, at least now there is chance somebody will provide it. >why should I have to employ a monk looking through my bank statements to be able to get access to them? Sure that can be a basis for an idiotic hack Because the banks themselves are completely uninterested in providing API access to you and somebody with a legal team has to shoulder the liability for providing it.
    - zAy0LfpBZLC8mAC 9y ago
      > At least an API. If that's what customers really want, at least now there is chance somebody will provide it. But I don't want "an API"? I want a non-proprietary API! I wouldn't bother with locking myself into some proprietary startup crap of questionably reliability, then I can just as well scrape the web interface of my bank, that's also a proprietary API of sorts, and I at least don't have to pay yet another party and risk them abusing or leaking my data and myself being unable to figure out who is responsible for failures in the service. > Because the banks themselves are completely uninterested in providing API access to you and somebody with a legal team has to shoulder the liability for providing it. ... which is exactly why they should be legally obligated to, instead of some idiotic "you have to allow third parties to access your customers' data" laws?!
Angostura 9y ago
> What is open about a system that only very few organisations can use I'm sorry - as a consumer, I'm going to want the most stringent checks before giving a third party direct read/write access to my bank account. The biggest criticism people have of the scheme so far is that it 'sounds like a security nightmare' and who is liable if I give someone access and they do Bad Things. Is your criticism really that it is insufficiently open in that certification is stringent?
- zAy0LfpBZLC8mAC 9y ago
  ?! No, my criticism is that it is an interface for third parties only that locks out the first party!?
  - 21 9y ago
    How many people do you think will be able to secure their access? And what happens if their computer is hacked, the credentials stolen and the accounts emptied? It's not hard for me to imagine developers saying, "hey, we all know computers get hacked, it is the bank's job to know when its really me versus when someone stole my API keys. What a shitty bank. I'm expecting all my money back"
    - zAy0LfpBZLC8mAC 9y ago
      WTF? How is that any different with web interfaces? Or are you saying that people should just generally not be able to use their own computers for banking purposes?
      - jenscow 9y ago
        API keys are stored on the computer (even accidentally pushed to github, etc) Credentials for web interfaces are stored in our heads. People are still able to use their own computers - via the web interface, which is under the full control of the banks.
        9y ago

ErrantX 9y ago

Its a fair criticism in part; but you are a technologist and so want unfiltered access to play with that data. For the vast majority of people that's meaningless - so to be able to share that data with companies offering new and interesting services (AIS sign up is reasonably lightweight, certainly within trivial reach of any startup) is a big step forward. I think we should be encouraging! (Or in other words; your thinking of the limitations on the micro level and missing the benefits at the macro) FWIW GDPR is more interesting legislation for what your after - you will have the ability to get access to your own data. Unfortunately that legislation didn't push hard enough to promote the idea of digital access - we should level our criticism most harshly there to try and effect change :)

tialaramex 9y ago
Digital access to your data isn't likely to work out generally unless you're happy with "Here's a PDF sent to your email address" in which case, sure, that's going to happen. I look after a system that has loads of PII, as a mix of traditional SQL databases and RDF with a bunch of RESTful service layers keeping it all in neat boxes so it's not a sprawling unmanageable mess. Now, if you ask for Subject Access after our verification team is happy that you're who you say you are I can and will extract the data that's clearly about you from those sources, tart it up and reformat it, and shove that into a PDF you can have. What I can't realistically do, even if they tried to legislate for it, is make say the RDF data structures somehow understandable to the lay person who thinks "graph" means "chart" and "a triple" is when you win three things in a row. OpenBanking works because ultimately the banks are pretty interchangeable when it comes to ordinary personal accounts. Money comes in or out, there's some short half-arsed text saying why, an amount, it's a very regular structure. But imagine trying to build a single "digital access" that works for your Reddit posts, health records, grocery purchases, subscription to Playboy, and MetroCard account... what on Earth would the UX be for that? Google gives us an idea what the best we could hope for is - if you sign in and say you want all your data, Google will ZIP it all up for you. But it's not a coherent system, it's just like somebody's old PC backup, a bunch of unrelated files in different formats in a ZIP file.
- Y_Y 9y ago
  Just because plebs can't understand triples doesnt mean they should have the right to seem (and potentially show them to someone who does). It might even get people to learn or write software to make sense of whatever data structure. In any case it shouldn't be up to the data borrower.
zAy0LfpBZLC8mAC 9y ago
> For the vast majority of people that's meaningless Erm ... WTF?! I'm not sure how explain this as it just seems so obvious, but ... you can, like, use software that other people write on your own computer!? There is no need to have any clue whatsoever of software development nor to share your data with any third party in order to profit from open APIs. People can use Thunderbird to read and write email without any need to be able to write software because there are open POP3, IMAP, and SMTP specs and you can have POP3, IMAP, and SMTP credentials for your email provider ... how is that meaningless to the vast majority of people?! > I think we should be encouraging! Encouraging of what? More centralization of data processing? Less control for the consumer? > FWIW GDPR is more interesting legislation for what your after Not at all. That is about data protection, not about machine readable interfaces. First of all, being able to access my data does not in any way allow me to initiate transactions, which is a ciritical part of banking functionality. But also, being able to access data does not at all mean being able to process it using a computer. I can have access to all the data companies store about me now, and most of them will simply send a letter with a printout to fulfill their legal obligations.
- ErrantX 9y ago
  Thats what I mean; PSD2 has always been about B2B. GDPR is business to consumer and we should critique it to press for digital solutions that are meaningful for consumers. As to the desktop app business; well sure but my hope is we build to this sort of thing. No harm is starting somewhere!
  - zAy0LfpBZLC8mAC 9y ago
    > Thats what I mean; PSD2 has always been about B2B. Which is precisely why it is bad?! > GDPR is business to consumer and we should critique it to press for digital solutions that are meaningful for consumers. No, GDPR simply does not have anything to do with this. GDPR is about human rights, not about technological development. Machine readable access might still be a worthwhile goal in that area, but extending data protection to encompass the right to submit transactions to your bank via a machine readable standardized interface certainly would be a stretch. > As to the desktop app business; well sure but my hope is we build to this sort of thing. No harm is starting somewhere! But are we starting anywhere? Say I want to write free banking software for people who care about their privacy ... are we even the slightest bit closer to being able to do that? Or isn't this rather a step in the opposite direction in that it further cements the idea of having monks do all the reading and writing for your?

Vinnl 9y ago

Are you sure you can't? Besides the paper statements, I can download my transaction data in a variety of formats including CSV from every bank I've use in the Netherlands.

vidarh 9y ago
The problem is that for a lot of banks there is no easy way to automate that process. I think 90 percent of use cases would be addressed simply by providing a way of giving automated read only access to statements.
- zoltaan 9y ago
  Instead giving access to EVERYTHING seems a little overdrive then....
sambe 9y ago
Does the history go back more than a year or two?
- masklinn 9y ago
  I would expect they are, if only for legal reasons. According to my bank's website, I can get account statements up to 10 years back, except for closed accounts.
zAy0LfpBZLC8mAC 9y ago
Well, that was just an example for the sake of an analogy? Obviously, I want a fully machine-readable API to all of my bank's functionality. Which also "downloading transaction data as CSV" does not fit at all if I have to manually log in and download the data. Also, CSV lists of transactions usually are useless for synchronization as they usually don't provide any mechanism to reliably deduplicate transactions and to check for completeness.

crdoconnor 9y ago

If you wanted to run a startup that ran APIs which bank customers could use this bill would presumably make that possible.

zAy0LfpBZLC8mAC 9y ago
Which is supposed to solve the problem how? Now I as a customer am dependent on the proprietary API of some startup? Or do you expect startups to compete on a standardized API? And why should I have to employ a monk looking through my bank statements to be able to get access to them? Sure that can be a basis for an idiotic hack, but how does that make it a sensible approach?
- crdoconnor 9y ago
  >Or do you expect startups to compete on a standardized API? At least an API. If that's what customers really want, at least now there is chance somebody will provide it. >why should I have to employ a monk looking through my bank statements to be able to get access to them? Sure that can be a basis for an idiotic hack Because the banks themselves are completely uninterested in providing API access to you and somebody with a legal team has to shoulder the liability for providing it.
  - zAy0LfpBZLC8mAC 9y ago
    > At least an API. If that's what customers really want, at least now there is chance somebody will provide it. But I don't want "an API"? I want a non-proprietary API! I wouldn't bother with locking myself into some proprietary startup crap of questionably reliability, then I can just as well scrape the web interface of my bank, that's also a proprietary API of sorts, and I at least don't have to pay yet another party and risk them abusing or leaking my data and myself being unable to figure out who is responsible for failures in the service. > Because the banks themselves are completely uninterested in providing API access to you and somebody with a legal team has to shoulder the liability for providing it. ... which is exactly why they should be legally obligated to, instead of some idiotic "you have to allow third parties to access your customers' data" laws?!

Angostura 9y ago

> What is open about a system that only very few organisations can use I'm sorry - as a consumer, I'm going to want the most stringent checks before giving a third party direct read/write access to my bank account. The biggest criticism people have of the scheme so far is that it 'sounds like a security nightmare' and who is liable if I give someone access and they do Bad Things. Is your criticism really that it is insufficiently open in that certification is stringent?

zAy0LfpBZLC8mAC 9y ago
?! No, my criticism is that it is an interface for third parties only that locks out the first party!?
- 21 9y ago
  How many people do you think will be able to secure their access? And what happens if their computer is hacked, the credentials stolen and the accounts emptied? It's not hard for me to imagine developers saying, "hey, we all know computers get hacked, it is the bank's job to know when its really me versus when someone stole my API keys. What a shitty bank. I'm expecting all my money back"
  - zAy0LfpBZLC8mAC 9y ago
    WTF? How is that any different with web interfaces? Or are you saying that people should just generally not be able to use their own computers for banking purposes?
    - jenscow 9y ago
      API keys are stored on the computer (even accidentally pushed to github, etc) Credentials for web interfaces are stored in our heads. People are still able to use their own computers - via the web interface, which is under the full control of the banks.
      - 9y ago