3 ms·

Hi, I founded Level Money, was one of Intuit's earliest aggcat customers and one of their last customers, and did this for a lot of people until Capital One bou

Hi, I founded Level Money, was one of Intuit's earliest aggcat customers and one of their last customers, and did this for a lot of people until Capital One bought my company and we did it for them. AMA, I guess. But to answer the implicit question: shutting that off can be harder than it sounds. And because it's a mobile API and iOS's store has fairly slow update cycles, it can be very hard to simply rotate your API spec fast enough without interrupting customer service: a difficult thing for a bank to get away with (lol, I'm joking they're down all the time).

ikeboy 8y ago
Why is shutting it difficult? Any IP that logs into more than 5 accounts within a day gets a ban. They can use proxies but eventually will run out. You can also use your own canary accounts, provide them to the service you want to block, and ban any IP that tries to log in
- KirinDave 8y ago
  You've just banned every client coming from a workplace with a private network, every client on a commercial VPN service, and every client using Starbucks wifi. Enjoy your customer service costs. On the plus side, bank have really good customer retention once they capture a customer.
  - ikeboy 8y ago
    Doubt over 5 people log in to a single bank from most starbucks over a 24 hour period. If it's a big enough bank, the threshold should be higher. But they can easily pull the data and set a threshold that cuts off only the peak of the distribution
    - KirinDave 8y ago
      You'd certainly better hope so. A national bank going down is national news. You're gonna end up sending some muckety muck out to the press to bob their heads and apologize. They'd don't take kindly to that. My prior investigations suggest that this strategy is ineffective. You suss out a ratelimit then pick a CSP and start spawning instances. Bonus points if it's a CSP that has a contract with that bank, they'll be petrified to try blocking you. Even well run consumer orgs can get tripped up with that. But you're also suggesting that banks can use that data in that way or that that the relevant parties had the necessary capability at the time in question. Both are propositions you can make your own judgement on. Here's another question: what happens when customers complain that you're cutting off their aggregtion service? You have your customer service reps say, "Sorry we locked you out of getting your own data?" Sounds like if you do that enough we have another press row. Thank goodness the CFPB was gutted, they loved 3rd party resale-to-consumer aggregtion services.
      - ikeboy 8y ago
        They better be tracking logins or how do they investigate fraud? If they don't have a database of every login tied to an IP, I would assert they're negligent with regard to blocking fraud. A lot of the measures taken to prevent fraud also block proxies and the like. Re customer service: they say "here's how you can download your statements in pdf format", or for many banks in quickbooks/excel/etc format as well I don't know how many of them had mandatory 2FA then, but I think many more have now. It would be far less risky to invalidate cookies on those high-volume IPs and force a new 2FA validation. Then legitimate users could reverify.
        KirinDave 8y ago
        > They better be tracking logins or how do they investigate fraud? If they don't have a database of every login tied to an IP, I would assert they're negligent with regard to blocking fraud. Look there are limits to what I'm able to talk about, but consider that a fraud subsystem functioning in transaction-time is running much more slowly than something running in request time. > A lot of the measures taken to prevent fraud also block proxies and the like. When was the last time you couldn't use your banking website over a proxy? Only a few mobile apps actually make the decision to do this (mine did) and it's not popular. > I don't know how many of them had mandatory 2FA then, but I think many more have now. Which national bank has mandatory 2fa? Not that this would matter. We dealt with 2FA at level via Intuit, that wasn't great at it. Plaid got incredibly good at it. It became pedestrian when we experimented with Plaid.
        ikeboy 8y ago
        >Look there are limits to what I'm able to talk about, but consider that a fraud subsystem functioning in transaction-time is running much more slowly than something running in request time. I was suggesting checking one day snapshots of access counts by IP to see what the distribution looks like to then determine what to block. 2fa: I know that chase asks me for 2fa every time I change IP, and I don't think there's a way to stop that. Should be easy for them to require 2fa on every login for any IP with a high rate of requests.
      - 8y ago

ikeboy 8y ago

Why is shutting it difficult? Any IP that logs into more than 5 accounts within a day gets a ban. They can use proxies but eventually will run out. You can also use your own canary accounts, provide them to the service you want to block, and ban any IP that tries to log in

KirinDave 8y ago
You've just banned every client coming from a workplace with a private network, every client on a commercial VPN service, and every client using Starbucks wifi. Enjoy your customer service costs. On the plus side, bank have really good customer retention once they capture a customer.
- ikeboy 8y ago
  Doubt over 5 people log in to a single bank from most starbucks over a 24 hour period. If it's a big enough bank, the threshold should be higher. But they can easily pull the data and set a threshold that cuts off only the peak of the distribution
  - KirinDave 8y ago
    You'd certainly better hope so. A national bank going down is national news. You're gonna end up sending some muckety muck out to the press to bob their heads and apologize. They'd don't take kindly to that. My prior investigations suggest that this strategy is ineffective. You suss out a ratelimit then pick a CSP and start spawning instances. Bonus points if it's a CSP that has a contract with that bank, they'll be petrified to try blocking you. Even well run consumer orgs can get tripped up with that. But you're also suggesting that banks can use that data in that way or that that the relevant parties had the necessary capability at the time in question. Both are propositions you can make your own judgement on. Here's another question: what happens when customers complain that you're cutting off their aggregtion service? You have your customer service reps say, "Sorry we locked you out of getting your own data?" Sounds like if you do that enough we have another press row. Thank goodness the CFPB was gutted, they loved 3rd party resale-to-consumer aggregtion services.
    - ikeboy 8y ago
      They better be tracking logins or how do they investigate fraud? If they don't have a database of every login tied to an IP, I would assert they're negligent with regard to blocking fraud. A lot of the measures taken to prevent fraud also block proxies and the like. Re customer service: they say "here's how you can download your statements in pdf format", or for many banks in quickbooks/excel/etc format as well I don't know how many of them had mandatory 2FA then, but I think many more have now. It would be far less risky to invalidate cookies on those high-volume IPs and force a new 2FA validation. Then legitimate users could reverify.
      - KirinDave 8y ago
        > They better be tracking logins or how do they investigate fraud? If they don't have a database of every login tied to an IP, I would assert they're negligent with regard to blocking fraud. Look there are limits to what I'm able to talk about, but consider that a fraud subsystem functioning in transaction-time is running much more slowly than something running in request time. > A lot of the measures taken to prevent fraud also block proxies and the like. When was the last time you couldn't use your banking website over a proxy? Only a few mobile apps actually make the decision to do this (mine did) and it's not popular. > I don't know how many of them had mandatory 2FA then, but I think many more have now. Which national bank has mandatory 2fa? Not that this would matter. We dealt with 2FA at level via Intuit, that wasn't great at it. Plaid got incredibly good at it. It became pedestrian when we experimented with Plaid.
        ikeboy 8y ago
        >Look there are limits to what I'm able to talk about, but consider that a fraud subsystem functioning in transaction-time is running much more slowly than something running in request time. I was suggesting checking one day snapshots of access counts by IP to see what the distribution looks like to then determine what to block. 2fa: I know that chase asks me for 2fa every time I change IP, and I don't think there's a way to stop that. Should be easy for them to require 2fa on every login for any IP with a high rate of requests.
    - 8y ago