4 ms·

Why would anyone ever want to let a 3rd party company manage their bank account? I barely trust my bank yo do that... I'm afraid that some companies will try t

by tjoff 9y ago

Why would anyone ever want to let a 3rd party company manage their bank account? I barely trust my bank yo do that... I'm afraid that some companies will try to force it upon customers as well. Starting with: "If you allow us to manage your purchase it will get even faster (oh and we get access to all of your financial info), and you also get a useless gadget!"

blowski 9y ago
People said the said the same about ATMs. They were wrong.
- tjoff 9y ago
  How is ATMs remotely similar?
  - xxpor 9y ago
    You give a 3rd party ATMs permission to withdraw money every time you use them. If they wanted to, they could store the data on the stripe of the card and your pin, and steal all of your money.
    - tjoff 9y ago
      That's not worse than doing any purchase at all. If anything ATMs are the safest and best option available, well, aside from malicious hardware modifications done to them. Having access to my bank account with all the history is another thing entirely.
      - xxpor 9y ago
        I guess our threat models are different. I'm not worried about transaction history as much as being able to drain the account.
        tjoff 9y ago
        Even so, ATMs are much safer than trusting the store clerk and whatever device they use to read your card. I know some magnetic stripe readers actually imitates a keyboard and just "write" the card info. So if you gave focus to notepad.exe instead all the card info would be dumped in cleartext. "Oh, seems it didn't register, could you swipe your card again?"
deleted 9y ago
[deleted]
mjburgess 9y ago
A bank is a third party company which manages your money. Illegal things are illegal. It's a risk vs. convenience calculation people make, as with banks themselves.
wallacoloo 9y ago
I once tried to open a personal investing account with Fidelity. When it came time to fund it, they wanted me to give them the username and password for my bank account so that they could log in on my behalf and verify that the account was owned by me. Obviously, I didn't follow through with that, because that's a terrible sign of how Fidelity treats security and when it comes to entrusting large sums of money with an investment firm, I'd prefer one that's demonstrated a better security policy all around. Anyway, this article was hilariously scant of technical details, but if the API they're creating allows different privileges to be associated with each API user, it's possible that I could use it to provide a company like Fidelty read-only access to only the information they need to verify that I am the account owner, and nothing more.

by tjoff 9y ago

blowski 9y ago

People said the said the same about ATMs. They were wrong.

tjoff 9y ago
How is ATMs remotely similar?
- xxpor 9y ago
  You give a 3rd party ATMs permission to withdraw money every time you use them. If they wanted to, they could store the data on the stripe of the card and your pin, and steal all of your money.
  - tjoff 9y ago
    That's not worse than doing any purchase at all. If anything ATMs are the safest and best option available, well, aside from malicious hardware modifications done to them. Having access to my bank account with all the history is another thing entirely.
    - xxpor 9y ago
      I guess our threat models are different. I'm not worried about transaction history as much as being able to drain the account.
      - tjoff 9y ago
        Even so, ATMs are much safer than trusting the store clerk and whatever device they use to read your card. I know some magnetic stripe readers actually imitates a keyboard and just "write" the card info. So if you gave focus to notepad.exe instead all the card info would be dumped in cleartext. "Oh, seems it didn't register, could you swipe your card again?"

deleted 9y ago

[deleted]

mjburgess 9y ago

A bank is a third party company which manages your money. Illegal things are illegal. It's a risk vs. convenience calculation people make, as with banks themselves.

wallacoloo 9y ago

I once tried to open a personal investing account with Fidelity. When it came time to fund it, they wanted me to give them the username and password for my bank account so that they could log in on my behalf and verify that the account was owned by me. Obviously, I didn't follow through with that, because that's a terrible sign of how Fidelity treats security and when it comes to entrusting large sums of money with an investment firm, I'd prefer one that's demonstrated a better security policy all around. Anyway, this article was hilariously scant of technical details, but if the API they're creating allows different privileges to be associated with each API user, it's possible that I could use it to provide a company like Fidelty read-only access to only the information they need to verify that I am the account owner, and nothing more.