4 ms·

?! No, my criticism is that it is an interface for third parties only that locks out the first party!?

21 9y ago
How many people do you think will be able to secure their access? And what happens if their computer is hacked, the credentials stolen and the accounts emptied? It's not hard for me to imagine developers saying, "hey, we all know computers get hacked, it is the bank's job to know when its really me versus when someone stole my API keys. What a shitty bank. I'm expecting all my money back"
- zAy0LfpBZLC8mAC 9y ago
  WTF? How is that any different with web interfaces? Or are you saying that people should just generally not be able to use their own computers for banking purposes?
  - jenscow 9y ago
    API keys are stored on the computer (even accidentally pushed to github, etc) Credentials for web interfaces are stored in our heads. People are still able to use their own computers - via the web interface, which is under the full control of the banks.
    - zAy0LfpBZLC8mAC 9y ago
      > API keys are stored on the computer (even accidentally pushed to github, etc) Then ... create an API without "API keys"?! > Credentials for web interfaces are stored in our heads. So ... store the credentials for the API in your head then?! > People are still able to use their own computers - via the web interface, which is under the full control of the banks. Erm ... no, it's not? The bank sends me IP packets, what happens with those IP packets is completely under my control (or under the control of anyone who happens to have compromised my computer, for that matter). I select what web browser I use. I could write my own web browser. Or modify an existing one. Or run it under a debugger. Or just not use a browser at all. What my computer does with the IP packets my bank sends me is completely out of the bank's control.
pmuk 9y ago
If you want to download your own data you can do so, to an extent, through the midata format which was launched in 2011. It lets you download the last 12 months transactions from your current accounts in a file. https://www.gov.uk/government/news/the-midata-vision-of-consumer-empowerment https://www.gov.uk/government/news/the-midata-vision-of-cons... https://www.hsbc.co.uk/1/2/midata-faqs https://www.hsbc.co.uk/1/2/midata-faqs https://www.santander.co.uk/uk/current-accounts/midata https://www.santander.co.uk/uk/current-accounts/midata
- zAy0LfpBZLC8mAC 9y ago
  Having to manually press a download button is not a machine readable interface. Also, this does not allow me to submit transactions.
Angostura 9y ago
It's a tool specifically designed to allow the first party to open access to a third party. It doesn't lock anyone out of anything.

21 9y ago

How many people do you think will be able to secure their access? And what happens if their computer is hacked, the credentials stolen and the accounts emptied? It's not hard for me to imagine developers saying, "hey, we all know computers get hacked, it is the bank's job to know when its really me versus when someone stole my API keys. What a shitty bank. I'm expecting all my money back"

zAy0LfpBZLC8mAC 9y ago
WTF? How is that any different with web interfaces? Or are you saying that people should just generally not be able to use their own computers for banking purposes?
- jenscow 9y ago
  API keys are stored on the computer (even accidentally pushed to github, etc) Credentials for web interfaces are stored in our heads. People are still able to use their own computers - via the web interface, which is under the full control of the banks.
  - zAy0LfpBZLC8mAC 9y ago
    > API keys are stored on the computer (even accidentally pushed to github, etc) Then ... create an API without "API keys"?! > Credentials for web interfaces are stored in our heads. So ... store the credentials for the API in your head then?! > People are still able to use their own computers - via the web interface, which is under the full control of the banks. Erm ... no, it's not? The bank sends me IP packets, what happens with those IP packets is completely under my control (or under the control of anyone who happens to have compromised my computer, for that matter). I select what web browser I use. I could write my own web browser. Or modify an existing one. Or run it under a debugger. Or just not use a browser at all. What my computer does with the IP packets my bank sends me is completely out of the bank's control.

pmuk 9y ago

If you want to download your own data you can do so, to an extent, through the midata format which was launched in 2011. It lets you download the last 12 months transactions from your current accounts in a file. https://www.gov.uk/government/news/the-midata-vision-of-consumer-empowerment https://www.gov.uk/government/news/the-midata-vision-of-cons... https://www.hsbc.co.uk/1/2/midata-faqs https://www.hsbc.co.uk/1/2/midata-faqs https://www.santander.co.uk/uk/current-accounts/midata https://www.santander.co.uk/uk/current-accounts/midata

zAy0LfpBZLC8mAC 9y ago
Having to manually press a download button is not a machine readable interface. Also, this does not allow me to submit transactions.

Angostura 9y ago

It's a tool specifically designed to allow the first party to open access to a third party. It doesn't lock anyone out of anything.