12 ms·

Build your own Mint

380 points by meagher 8y ago

temp 8y ago
Regarding this part, connect to your financial institutions to generate access tokens Are these generally offered across EU? I know I haven't found a way to get access for a couple of my local (EU-based) banks I checked with, but unsure about the rest of the continent.
- narak 8y ago
  Plaid is US only at the moment. The closest equivalent I've found in the EU are Token (https://token.io https://token.io) and Teller (https://teller.io https://teller.io) p.s. notably, the author of Build your own Mint project is also the creator of Vuejs
  - bake 8y ago
    Plaid also supports Canadian institutions as of this year, with coverage continuing to expand.
- spockz 8y ago
  In Europe PSD II will come in effect in Q4 this year. By then all banks need to offer account information and payment initiation functionality to psd registered parties. This has spurred banks to implement more than just the required apis and most of them use some form of oauth/accesstoken for authentication. It is only a matter of time before there will be an aggregator site where you will be able to see data from all banks. There are even banks that already show accounts from other banks as well.
reificator 8y ago
> Credentials are stored in lib/credentials.json. This is checked into the repo, so USE A PRIVATE REPO. Do not use a public fork and accidentally push your tokens to it! I will not take responsibility for any potential leak of sensitive information. It seems like using your CI provider to manage the credentials would be significantly more safe than checking them into even a private repository. For instance, there are several services that will scan or otherwise access your private repos for some purpose or another, and you wouldn't want to accidentally connect them while this is also in the mix. A pre build step that templates the credentials into a file would be pretty easy to set up in most CI systems I've used, but I have no experience in CircleCI. (maybe 10 minutes of tinkering but that's it) Finally I should note, I am not advising anyone to store their financial credentials with any third party. But if you've already made up your mind to do so, at least consider one that's meant to handle secrets in a secure manner.
- GregorStocks 8y ago
  It looks like the credentials in credentials.json are your Plaid access key/secret/etc, not your bank account username/password. If an attacker gets them, they'd have read-only access to your bank account until you rotate your Plaid creds, but they wouldn't be able to do anything as simple as logging into your bank account and transferring all your money out. EDIT: It's actually worse than that, see comment from erichurkman below.
  - reificator 8y ago
    Thanks for the clarification, that's a little better. Still... EDIT: See the other response to this comment by erichurkman, this is still a potential vector for unauthorized payments, transfers, and withdrawals.
  - erichurkman 8y ago
    Careful, because Plaid also gives you access to your account's routing and account numbers [0]. I'm not sure if the way this library works gives access to those, but with a routing & account number a thief _can_ write checks, debit your account, etc. [0] https://plaid.com/products/auth/ https://plaid.com/products/auth/
    - GregorStocks 8y ago
      Yeah, good point - I figured Auth wouldn't be enabled on a free developer account, but it looks like it actually is these days: https://plaid.com/pricing https://plaid.com/pricing.
    - rflrob 8y ago
      Are routing and account numbers considered “secret”? Potentially any one of the handful of people I still write checks to could be unscrupulous and write checks, debit my account, etc., right?
      - erichurkman 8y ago
        Correct; that's why Knuth started issuing fake checks instead of real checks for people that found mistakes in his works: https://en.wikipedia.org/wiki/Knuth_reward_check https://en.wikipedia.org/wiki/Knuth_reward_check
brianzelip 8y ago
FYI - author of this lib also wrote Vue.js.
elliottcarlson 8y ago
This is great -- I'll be tying this in to my budget calendar spreadsheet that I've been using for the last few months to have a solid grasp of how purchases I make will impact me in the future; I have a template with some example usage of it available at https://docs.google.com/spreadsheets/d/12mkQzq22eM8HHdJVJ_JmcvaRJlKf--f9oKKp1uEEYxo/edit?usp=sharing https://docs.google.com/spreadsheets/d/12mkQzq22eM8HHdJVJ_Jm... if anyone is interested.
tazard 8y ago
It's interesting to me that the front end is using jQuery considering the author is the vuejs creator. It looks interesting though, I have been meaning to make a little budgeting app for myself recently so this will be a good start at the least!
vinceguidry 8y ago
I'd be enormously hesitant in relying on a B2B product for such an important part of my life. Forget the security concerns, my concern is the company cutting off access for spurious reasons. If they could sell me access at a price less than $500+ a month, I'd be more inclined to trust them.
aakilfernandes 8y ago
Do passwords get shared with Plaid?
- lol768 8y ago
  Pretty sure they do, because AFAIK there's not much choice in the US. I think it's therefore forced to use screen scraping (or other APIs not intended for public consumption). In line with the rest of the US's financial technology (EMV adoption, 3-D Secure) which is pretty immature, I don't think there's a concept of Open Banking enforced by regulators. Hence, no OAuth based flow to use and no standardised transactions API. Open Banking isn't ideal and has its own issues. It's not anywhere near as revolutionary as some 'thought leaders' make it out to be. But it's better than nothing.
dh-g 8y ago
I'm doing something similar to power an e-ink based display in my house. I see about 24 hours of delay on the transaction API using the free tier which is the only shortcoming of this approach. The Plaid API is very nice. Does anyone know if the production (non-free) level reduces the delay?
- GregorStocks 8y ago
  In production, the delay I'd expect is about six hours, but for certain institutions it'll be much higher. Pending transaction support doesn't exist for all institutions, so in the worst case you could swipe your card on a Friday afternoon and not see it in Plaid until the transaction actually clears early Monday morning.
akerro 8y ago
Or instead using spreadsheets just use a self-hosted free software that is dedicate to personal finance analytics https://github.com/firefly-iii/firefly-iii https://github.com/firefly-iii/firefly-iii
- yclept 8y ago
  I don't know why I never looked for something like this before, but thanks for the link!
iamzenitraM 8y ago
If you want more data that what you can probably get from Google Sheets easily, an alternative could be modifying this script to make it output a Beancount[0]-formatted ledger text file. The format is pretty readable plain-text (and so you could store it on Git to track changes easily) and you can generate nice reports out of it with the Beancount CLIs and a web interface with Fava[1]. Also adds another additional level of self-hosted :) Also Beancount has some nice support for implementing importer scripts inside it if need be, although I haven't played with those yet. [0] http://furius.ca/beancount/ http://furius.ca/beancount/ [1] https://beancount.github.io/fava/ https://beancount.github.io/fava/
- seltzered_ 8y ago
  Yep, fava is a very nice base for viewing finances. Currently trying to see how to extend it further for custom reports, though just using its custom links feature can go a decent way. Also, have heard of some folks using services like tillerhq.com then exporting to a plaintextaccounting tool to presumably help with dealing with messy data that comes from financial institutions. I just download and parse the csvs, using a mix of browser bookmarks and katalon scripts to aid in the process. Personally think the goal isn’t to have a mint-like experience of constant updates, but to have a habit where you sit down once a month, update things and go through a checklist of actions / write down improvements.
- chrislloyd 8y ago
  I highly recommend Beancount and Ledger-likes[0] too. Mint-style net-worth trackers have limited usefulness. Once you have visibility into your assets, you'll likely want to take more active management of them. Modelling that with spreadsheets is possible but can become complicated quickly and you'll likely end up re-inventing a lot of established accounting practices. A disclaimer: Ledger-like systems are described as whole "all bran" of personal finance - there's steep learning curve but once you get through that you'll have a powerful, life-long tool. [0] https://plaintextaccounting.org https://plaintextaccounting.org
  - ryanmarsh 8y ago
    Are you able to find book keepers and CPA's who can deal with this easily? How do you sync data with them and control access? I have a contractor that helps me with invoicing, a book keeper, a CPA, and a partner. Not sure how this would work.
derefnull 8y ago
https://gnucash.org/ https://gnucash.org/ is a mature project that allows you to manage expenses & assets, perform analytics, and doesn't require supplying personal information to third parties (plaid in this case)
- fiddlerwoaroof 8y ago
  I haven’t managed to get gnucash to download transactions from my bank. Do you do that? Or do you just manually record everything?
  - jms 8y ago
    Download an export and import it into gnucash. It remembers previously processed items. It's a manual process, but much easier to do a monthly export than record items one by one.
pmarreck 8y ago
> Credentials are stored in lib/credentials.json Isn’t best-practice these days to store these in the ENV?
- ezekg 8y ago
  Not sure why this is downvoted. Storing credentials should pretty much always be in the ENV and not in files that are checked into a repo.
snowwrestler 8y ago
> Credentials are stored in lib/credentials.json. This is checked into the repo, so USE A PRIVATE REPO. It's called a "private" repo, not a "secure" repo. The point of a private repo is to give you control over your collaborators. It is not to provide information security. To my knowledge, Github makes no special promises about the security of private repos. The data is not encrypted on disk at Github, and Github staff can access the content of your repo. I WOULD NOT UPLOAD SECRETS INTO A GITHUB PRIVATE REPO.
- andrewstuart2 8y ago
  Or at least unencrypted secrets. If you've properly encrypted the data, then it really shouldn't matter where it ends up as long as you keep the key appropriately private.
  - dharmab 8y ago
    As long as the encryption isn't broken for the lifetime of the secret. This is enough of a sufficiently hard condition to guarantee that it should not be a general recommended practice.
    - freedomben 8y ago
      You should be rotating your secrets regularly. As long as you do that and use an industry standard encryption implementation (never roll your own!) you should be gtg. Everyone differs on how often to rotate secrets. some people say every 10 minutes (projects like vault make this easier) some say 6 months, some say a year.
- deleted 8y ago
  [deleted]
- mooreds 8y ago
  Would you put secrets into a circleci environment variable? https://circleci.com/docs/2.0/env-vars/ https://circleci.com/docs/2.0/env-vars/ That might be an improvement over checking in the json file, as I suspect (from a very brief look) that that is why the json file is checked in.
agentdrtran 8y ago
Tiller is a good alternative to mint to people who don't want to do all of this work.
lxe 8y ago
Was thinking of doing the same thing but without involving any third-party services and relying on good old-fashioned web scraping.
- tantalor 8y ago
  Who's going to write this hypothetical web scraper? And update it when the bank website changes? There's a reason the service costs money. Is there reputable FOSS bank website scraper?
  - lxe 8y ago
    Me. That's the point: I just write the scrapers for the sites only I need, which isn't a lot. And if they change, I simply fix it. I'm willing to bet Mint and others have done exactly this (or are doing it now) as well.
    - bewuethr 8y ago
      Mint does this for some banks and uses proper APIs for others (Wealthsimple, for example).
    - jjeaff 8y ago
      All my banking sites are constantly wanting to send me a text to verify a code before I can login. Do you have that problem?
- skhavari 8y ago
  Here ya go: https://github.com/skhavari/cheddardog https://github.com/skhavari/cheddardog
lucb1e 8y ago
And here I thought it would be about Linux Mint the distribution, or the Mint box the hardware. But it's about Mint the financial software.
- Drakim 8y ago
  Even worse, since it used "build" instead of "compile" I opened it expecting to find a story about pressing your own coins.
zbruhnke 8y ago
It's worth noting here (though many people have in different ways already) that the reason you should not put credentials in any git repo (private or public) is that inevitably when you share repos with third party services (A CI for instance) you are also giving them credentials as a result and exposing one more vulnerability in the case that they get hacked or otherwise don't store things in an encrypted manner. Because Github makes it so easy to give developers read access to repos this happens more often that you would realize, and having your most sensitive credentials (banking username and password) exposed in a repo to several different vendors is NEVER a good practice. It's fine if you're going to use this but at least properly encrypt the secrets, or add your creds in a different file and gitignore it at the least if you're too lazy to use something like vault, credstash etc. The reality is you're only as strong as your weakest link and there is just no use in having your weakest link be a relative unknown Source: I built a Plaid competitor once upon a time (that obviously did not work out as well for me as it did for them) and I am currently building a bank, so I know a few things about security and vulnerabilities
- jjeaff 8y ago
  >currently building a bank I'm curious about this. I assume you are building banking software? Like a full stack?
  - zbruhnke 8y ago
    haha boy is it a long story ... but yes both banking software and buying part of an actual bank so we can build a full-stack bank for the next 100 years
    - jjeaff 8y ago
      Interesting. Have you done any write-ups or have any more information out there? As a developer with a degree in finance, this kind of stuff interests me.
      - zbruhnke 8y ago
swsieber 8y ago
If you are using Google sheets to store your budget, checkout https://byobudget.com https://byobudget.com It lets you record purchases in your spreadsheet via SMS. I should be launching it in the next month or so. It's geared towards people who want just a little more realtime ability for their current budget without switching what they use. If all goes well, I'll be expanding to other integrations (private firefly III instances, YNAB, alternative input methods, etc). Disclaimer: I'm the author. Second disclaimer: Idea shamelessly stolen from a comment on here months ago about what one person does for themself. Also, I'd be interested in finding a couple of beta testers. Edit: Aslo, I'm sorry that it looks atrocious on mobile. Should load pretty quick though ...
- crescentfresh 8y ago
  This is Awesome!! Is the first word after the price the category, the latter description? Can you quote multi-word categories or something, if you had those? Eg "Store Credit"?
  - swsieber 8y ago
    I have to fiddle with it, but I'm planning on multi word categories. I'm not sure how ios handles intentional newlines. I might just change it to "category amount description" instead of "amount category description" to remove any questions of how to parse things. Edit: Yeah, category then description. Quotes are definitely another option. I realized I got caught up and just ignored part of your post while replying...
    - quickthrower2 8y ago
      just normalize all whitespace i.e. s/\s+/ /g then try to match one word, two words etc.. until you hit a category name.
- cryptozeus 8y ago
  great idea, joined the list
- 8y ago
clairity 8y ago
does google really need all your financial info too? could you not do this in https://ethercalc.net/ https://ethercalc.net/ or even just a csv that you could import/export to a spreadsheet app of your choice? the appeal of a personal mint is to not share all my financial info with third-party companies, not to keep from paying a few bucks for a useful service.
ryanmarsh 8y ago
This is a nice kickstart for something that has been on my todo list for a while. Cashflow forecasting is important for my family budget and my small business. My cashflow fluctuates quite a bit. Some months I'll bring in 90k, some months nothing. I have really high expenses for such a small business because I travel and pay contractors. So far I've been doing this by hand, and trying to use features in Xero, plus a few expensive tools online that integrate with Xero (which do not deserve a free advertisement so I won't name them). I finally figured out if I want cash flow forecasting done right for me I'm going to have to do it myself.
trjordan 8y ago
> Build you own Mint > Fancy interface is out of scope for this demo. OK.
cmer 8y ago
Not sure if it's the right place/occasion to ask... I'd love a web application that gives me a one page financial dashboard with: - bank account balance - credit card balance. Due date - list of unusual transactions I should review - all my bills in one place, with amounts due and possibility to click through to see details - list of upcoming schedule payment (ie mortgage, gym membership, phone service) with alert/notification of one will bounce (ie: funds insufficient so I can transfer money to the right account) - upcoming financial obligations Is there such a thing? Ideally self hosted.
- infinite8s 8y ago
  This would be a perfect application built on top of sandstorm.io (which has the model of individual user run apps where there is no possibility of leakage between users).
- justinhj 8y ago
  If it’s self hosted do you see it as being free software or you’d pay an upfront cost for a license? Would you use a hosted web application if none of your data was uploaded?
  - cmer 8y ago
    I'd rather pay a monthly fee for something I get value from daily. I would consider using a hosted service depending who the company is. I still don't fully trust Intuit with Mint.
- EADGBE 8y ago
  Current assets/valuation as well. Kinda hack this together in Google Sheets currently with Zillow, 401K, assets, liabilities, investment accounts, etc.
sschueller 8y ago
Reminder that Plaid doesn't know what their doing when it comes to security: https://github.com/plaid/link/issues/68 https://github.com/plaid/link/issues/68
- SmirkingRevenge 8y ago
  This is a bit unfair, isn't it? Not in the sense that these practices arent awful and inexcusable from a security standpoint, but in the sense that plaid isn't doing anything that isn't standard practice in the finance industry. Every 3rd party tool that does something with your finances (mint, personal capital, ynab, and even online banks that pull info from other banks) require you to submit login credentials in this manner. The industry needs changing - and really some rather punitive regulation IMHO - but this isn't a Plaid specific problem per se.
  - prplhaz4 8y ago
    The finance industry mainly uses OFX as the standard for online access to statements/transaction downloads (as does quicken, QuickBooks and gnucash...etc). Some banks do not support it and others go through aggregators to provide access. You are doing people a huge disservice by identifying the companies you listed as "the finance industry". They are scraping data (in most cases against TOS) and exposing it as a paid API service. It's a terrible state of affairs that easy access to ownership of this critical data is so hard to come by and has essentially forced people to give up their most valuable credentials to in a lot of cases unknown or untrustworthy parties. At least mint has partnered with some banks that actually provide supported APIs for transaction data (Chase), but that is so far from the norm right now it makes me queasy.
    - SmirkingRevenge 8y ago
      Quicken asks me for my login credentials to my bank and in their policies, says they store my credentials in their infrastructure. How does QFX actually help here?
      - 8y ago
kotrunga 8y ago
I would recommend against letting Google know anything about your finances. Maybe try self-hosted solutions that are open source, like Firefly III. https://github.com/firefly-iii/firefly-iii https://github.com/firefly-iii/firefly-iii
floatingatoll 8y ago
Note that asking people not to commit credentials.json doesn’t work very well in practice: https://github.com/search?o=desc&q="credentials.json"&s=committer-date&type=Commits https://github.com/search?o=desc&q="credentials.json"&s=comm...
choward 8y ago
> You will first need to sign up for Plaid and apply for the development plan. I guess I'm not the target audience. The only reason I would even consider building something like this is so that I'm in full control. I have no idea what Plaid is. All I know for sure is that I don't want to sign up for it and also introduce a major dependency. I don't understand what the advantage is over Mint. I get to do more work and not be in control. Usually you can only get one of those.
- Jemaclus 8y ago
  Plaid is an API for banks, basically: https://plaid.com https://plaid.com. It's pretty fantastic (especially compared to the way you used to have to go about it.) As for advantages over Mint, I'm sure Mint has updated recently, but as of ~2 years ago, if you had a bank that didn't expose an API, Mint would take your credentials and more or less scrape the bank websites to get your information into their systems to do their voodoo magic to show you your stats. Plaid has done most of that legwork for you (interfacing with banks) and exposed the data via a nicer API, so you don't really have to worry about anything being wrong because of scraped data -- it's coming directly from the source. That's my understanding, anyway. As for how is this better than Mint? No idea. It's just a demo that shows that you could, if you wanted to. And Plaid is more or less the new standard for interacting with bank data, at least in the US.
cascom 8y ago
http://www.gnucash.org http://www.gnucash.org Is pretty solid
EvanYou 8y ago
Author here - this was just a weekend hack and didn't really expect it to show up here, but thanks for the security related feedback. The setup now uses environment variables.
- koheripbal 8y ago
  Have you considered merging your functionality with a package like gnucash which works as an open source account/budget program for families/small businesses? I think it would be a good match.
apearson 8y ago
https://www.tillerhq.com/ https://www.tillerhq.com/ This is another service like this. I've been using them for around 6 months and haven't had any trouble with them.
mirimir 8y ago
My first thought, seeing the title: the Liberty Dollar.[0] tl;dr - In the US, it's illegal to mint your own money. 0) http://libertydollar.org/ http://libertydollar.org/
skhavari 8y ago
If you want to do this without giving your data to any third party (plaid will store your data) or you have 2FA enabled on your FI accounts, try this: https://github.com/skhavari/cheddardog https://github.com/skhavari/cheddardog. It supports a few institutions. If you're a developer, its pretty easy to add more. It generates spending and balance reports, and pretty easy to slap an app (E2E encrypted of course) or local only web UI on top of it. Enjoy
vlucas 8y ago
If you are looking for a more "packaged" integration with Google Sheets, check out BudgetSheet: https://www.budgetsheet.net https://www.budgetsheet.net It is a Google Sheets Add-on found in the G Suite Marketplace. Disclaimer: I am the author. It is currently under review by Google and awaiting publication. There is an email sign at the bottom of the page if you want to be notified at launch. :)

380 points by meagher 8y ago

temp 8y ago

Regarding this part, connect to your financial institutions to generate access tokens Are these generally offered across EU? I know I haven't found a way to get access for a couple of my local (EU-based) banks I checked with, but unsure about the rest of the continent.

narak 8y ago
Plaid is US only at the moment. The closest equivalent I've found in the EU are Token (https://token.io https://token.io) and Teller (https://teller.io https://teller.io) p.s. notably, the author of Build your own Mint project is also the creator of Vuejs
- bake 8y ago
  Plaid also supports Canadian institutions as of this year, with coverage continuing to expand.
spockz 8y ago
In Europe PSD II will come in effect in Q4 this year. By then all banks need to offer account information and payment initiation functionality to psd registered parties. This has spurred banks to implement more than just the required apis and most of them use some form of oauth/accesstoken for authentication. It is only a matter of time before there will be an aggregator site where you will be able to see data from all banks. There are even banks that already show accounts from other banks as well.

reificator 8y ago

> Credentials are stored in lib/credentials.json. This is checked into the repo, so USE A PRIVATE REPO. Do not use a public fork and accidentally push your tokens to it! I will not take responsibility for any potential leak of sensitive information. It seems like using your CI provider to manage the credentials would be significantly more safe than checking them into even a private repository. For instance, there are several services that will scan or otherwise access your private repos for some purpose or another, and you wouldn't want to accidentally connect them while this is also in the mix. A pre build step that templates the credentials into a file would be pretty easy to set up in most CI systems I've used, but I have no experience in CircleCI. (maybe 10 minutes of tinkering but that's it) Finally I should note, I am not advising anyone to store their financial credentials with any third party. But if you've already made up your mind to do so, at least consider one that's meant to handle secrets in a secure manner.

GregorStocks 8y ago
It looks like the credentials in credentials.json are your Plaid access key/secret/etc, not your bank account username/password. If an attacker gets them, they'd have read-only access to your bank account until you rotate your Plaid creds, but they wouldn't be able to do anything as simple as logging into your bank account and transferring all your money out. EDIT: It's actually worse than that, see comment from erichurkman below.
- reificator 8y ago
  Thanks for the clarification, that's a little better. Still... EDIT: See the other response to this comment by erichurkman, this is still a potential vector for unauthorized payments, transfers, and withdrawals.
- erichurkman 8y ago
  Careful, because Plaid also gives you access to your account's routing and account numbers [0]. I'm not sure if the way this library works gives access to those, but with a routing & account number a thief _can_ write checks, debit your account, etc. [0] https://plaid.com/products/auth/ https://plaid.com/products/auth/
  - GregorStocks 8y ago
    Yeah, good point - I figured Auth wouldn't be enabled on a free developer account, but it looks like it actually is these days: https://plaid.com/pricing https://plaid.com/pricing.
  - rflrob 8y ago
    Are routing and account numbers considered “secret”? Potentially any one of the handful of people I still write checks to could be unscrupulous and write checks, debit my account, etc., right?
    - erichurkman 8y ago
      Correct; that's why Knuth started issuing fake checks instead of real checks for people that found mistakes in his works: https://en.wikipedia.org/wiki/Knuth_reward_check https://en.wikipedia.org/wiki/Knuth_reward_check

brianzelip 8y ago

FYI - author of this lib also wrote Vue.js.

elliottcarlson 8y ago

This is great -- I'll be tying this in to my budget calendar spreadsheet that I've been using for the last few months to have a solid grasp of how purchases I make will impact me in the future; I have a template with some example usage of it available at https://docs.google.com/spreadsheets/d/12mkQzq22eM8HHdJVJ_JmcvaRJlKf--f9oKKp1uEEYxo/edit?usp=sharing https://docs.google.com/spreadsheets/d/12mkQzq22eM8HHdJVJ_Jm... if anyone is interested.

tazard 8y ago

It's interesting to me that the front end is using jQuery considering the author is the vuejs creator. It looks interesting though, I have been meaning to make a little budgeting app for myself recently so this will be a good start at the least!

vinceguidry 8y ago

I'd be enormously hesitant in relying on a B2B product for such an important part of my life. Forget the security concerns, my concern is the company cutting off access for spurious reasons. If they could sell me access at a price less than $500+ a month, I'd be more inclined to trust them.

aakilfernandes 8y ago

Do passwords get shared with Plaid?

lol768 8y ago
Pretty sure they do, because AFAIK there's not much choice in the US. I think it's therefore forced to use screen scraping (or other APIs not intended for public consumption). In line with the rest of the US's financial technology (EMV adoption, 3-D Secure) which is pretty immature, I don't think there's a concept of Open Banking enforced by regulators. Hence, no OAuth based flow to use and no standardised transactions API. Open Banking isn't ideal and has its own issues. It's not anywhere near as revolutionary as some 'thought leaders' make it out to be. But it's better than nothing.

dh-g 8y ago

I'm doing something similar to power an e-ink based display in my house. I see about 24 hours of delay on the transaction API using the free tier which is the only shortcoming of this approach. The Plaid API is very nice. Does anyone know if the production (non-free) level reduces the delay?

GregorStocks 8y ago
In production, the delay I'd expect is about six hours, but for certain institutions it'll be much higher. Pending transaction support doesn't exist for all institutions, so in the worst case you could swipe your card on a Friday afternoon and not see it in Plaid until the transaction actually clears early Monday morning.

akerro 8y ago

Or instead using spreadsheets just use a self-hosted free software that is dedicate to personal finance analytics https://github.com/firefly-iii/firefly-iii https://github.com/firefly-iii/firefly-iii

yclept 8y ago
I don't know why I never looked for something like this before, but thanks for the link!

iamzenitraM 8y ago

If you want more data that what you can probably get from Google Sheets easily, an alternative could be modifying this script to make it output a Beancount[0]-formatted ledger text file. The format is pretty readable plain-text (and so you could store it on Git to track changes easily) and you can generate nice reports out of it with the Beancount CLIs and a web interface with Fava[1]. Also adds another additional level of self-hosted :) Also Beancount has some nice support for implementing importer scripts inside it if need be, although I haven't played with those yet. [0] http://furius.ca/beancount/ http://furius.ca/beancount/ [1] https://beancount.github.io/fava/ https://beancount.github.io/fava/

seltzered_ 8y ago
Yep, fava is a very nice base for viewing finances. Currently trying to see how to extend it further for custom reports, though just using its custom links feature can go a decent way. Also, have heard of some folks using services like tillerhq.com then exporting to a plaintextaccounting tool to presumably help with dealing with messy data that comes from financial institutions. I just download and parse the csvs, using a mix of browser bookmarks and katalon scripts to aid in the process. Personally think the goal isn’t to have a mint-like experience of constant updates, but to have a habit where you sit down once a month, update things and go through a checklist of actions / write down improvements.
chrislloyd 8y ago
I highly recommend Beancount and Ledger-likes[0] too. Mint-style net-worth trackers have limited usefulness. Once you have visibility into your assets, you'll likely want to take more active management of them. Modelling that with spreadsheets is possible but can become complicated quickly and you'll likely end up re-inventing a lot of established accounting practices. A disclaimer: Ledger-like systems are described as whole "all bran" of personal finance - there's steep learning curve but once you get through that you'll have a powerful, life-long tool. [0] https://plaintextaccounting.org https://plaintextaccounting.org
- ryanmarsh 8y ago
  Are you able to find book keepers and CPA's who can deal with this easily? How do you sync data with them and control access? I have a contractor that helps me with invoicing, a book keeper, a CPA, and a partner. Not sure how this would work.

derefnull 8y ago

https://gnucash.org/ https://gnucash.org/ is a mature project that allows you to manage expenses & assets, perform analytics, and doesn't require supplying personal information to third parties (plaid in this case)

fiddlerwoaroof 8y ago
I haven’t managed to get gnucash to download transactions from my bank. Do you do that? Or do you just manually record everything?
- jms 8y ago
  Download an export and import it into gnucash. It remembers previously processed items. It's a manual process, but much easier to do a monthly export than record items one by one.

pmarreck 8y ago

> Credentials are stored in lib/credentials.json Isn’t best-practice these days to store these in the ENV?

ezekg 8y ago
Not sure why this is downvoted. Storing credentials should pretty much always be in the ENV and not in files that are checked into a repo.

snowwrestler 8y ago

> Credentials are stored in lib/credentials.json. This is checked into the repo, so USE A PRIVATE REPO. It's called a "private" repo, not a "secure" repo. The point of a private repo is to give you control over your collaborators. It is not to provide information security. To my knowledge, Github makes no special promises about the security of private repos. The data is not encrypted on disk at Github, and Github staff can access the content of your repo. I WOULD NOT UPLOAD SECRETS INTO A GITHUB PRIVATE REPO.

andrewstuart2 8y ago
Or at least unencrypted secrets. If you've properly encrypted the data, then it really shouldn't matter where it ends up as long as you keep the key appropriately private.
- dharmab 8y ago
  As long as the encryption isn't broken for the lifetime of the secret. This is enough of a sufficiently hard condition to guarantee that it should not be a general recommended practice.
  - freedomben 8y ago
    You should be rotating your secrets regularly. As long as you do that and use an industry standard encryption implementation (never roll your own!) you should be gtg. Everyone differs on how often to rotate secrets. some people say every 10 minutes (projects like vault make this easier) some say 6 months, some say a year.
deleted 8y ago
[deleted]
mooreds 8y ago
Would you put secrets into a circleci environment variable? https://circleci.com/docs/2.0/env-vars/ https://circleci.com/docs/2.0/env-vars/ That might be an improvement over checking in the json file, as I suspect (from a very brief look) that that is why the json file is checked in.

agentdrtran 8y ago

Tiller is a good alternative to mint to people who don't want to do all of this work.

lxe 8y ago

Was thinking of doing the same thing but without involving any third-party services and relying on good old-fashioned web scraping.

tantalor 8y ago
Who's going to write this hypothetical web scraper? And update it when the bank website changes? There's a reason the service costs money. Is there reputable FOSS bank website scraper?
- lxe 8y ago
  Me. That's the point: I just write the scrapers for the sites only I need, which isn't a lot. And if they change, I simply fix it. I'm willing to bet Mint and others have done exactly this (or are doing it now) as well.
  - bewuethr 8y ago
    Mint does this for some banks and uses proper APIs for others (Wealthsimple, for example).
  - jjeaff 8y ago
    All my banking sites are constantly wanting to send me a text to verify a code before I can login. Do you have that problem?
skhavari 8y ago
Here ya go: https://github.com/skhavari/cheddardog https://github.com/skhavari/cheddardog

lucb1e 8y ago

And here I thought it would be about Linux Mint the distribution, or the Mint box the hardware. But it's about Mint the financial software.

Drakim 8y ago
Even worse, since it used "build" instead of "compile" I opened it expecting to find a story about pressing your own coins.

zbruhnke 8y ago

It's worth noting here (though many people have in different ways already) that the reason you should not put credentials in any git repo (private or public) is that inevitably when you share repos with third party services (A CI for instance) you are also giving them credentials as a result and exposing one more vulnerability in the case that they get hacked or otherwise don't store things in an encrypted manner. Because Github makes it so easy to give developers read access to repos this happens more often that you would realize, and having your most sensitive credentials (banking username and password) exposed in a repo to several different vendors is NEVER a good practice. It's fine if you're going to use this but at least properly encrypt the secrets, or add your creds in a different file and gitignore it at the least if you're too lazy to use something like vault, credstash etc. The reality is you're only as strong as your weakest link and there is just no use in having your weakest link be a relative unknown Source: I built a Plaid competitor once upon a time (that obviously did not work out as well for me as it did for them) and I am currently building a bank, so I know a few things about security and vulnerabilities

jjeaff 8y ago
>currently building a bank I'm curious about this. I assume you are building banking software? Like a full stack?
- zbruhnke 8y ago
  haha boy is it a long story ... but yes both banking software and buying part of an actual bank so we can build a full-stack bank for the next 100 years
  - jjeaff 8y ago
    Interesting. Have you done any write-ups or have any more information out there? As a developer with a degree in finance, this kind of stuff interests me.
    - zbruhnke 8y ago

swsieber 8y ago

If you are using Google sheets to store your budget, checkout https://byobudget.com https://byobudget.com It lets you record purchases in your spreadsheet via SMS. I should be launching it in the next month or so. It's geared towards people who want just a little more realtime ability for their current budget without switching what they use. If all goes well, I'll be expanding to other integrations (private firefly III instances, YNAB, alternative input methods, etc). Disclaimer: I'm the author. Second disclaimer: Idea shamelessly stolen from a comment on here months ago about what one person does for themself. Also, I'd be interested in finding a couple of beta testers. Edit: Aslo, I'm sorry that it looks atrocious on mobile. Should load pretty quick though ...

crescentfresh 8y ago
This is Awesome!! Is the first word after the price the category, the latter description? Can you quote multi-word categories or something, if you had those? Eg "Store Credit"?
- swsieber 8y ago
  I have to fiddle with it, but I'm planning on multi word categories. I'm not sure how ios handles intentional newlines. I might just change it to "category amount description" instead of "amount category description" to remove any questions of how to parse things. Edit: Yeah, category then description. Quotes are definitely another option. I realized I got caught up and just ignored part of your post while replying...
  - quickthrower2 8y ago
    just normalize all whitespace i.e. s/\s+/ /g then try to match one word, two words etc.. until you hit a category name.
cryptozeus 8y ago
great idea, joined the list
8y ago

clairity 8y ago

does google really need all your financial info too? could you not do this in https://ethercalc.net/ https://ethercalc.net/ or even just a csv that you could import/export to a spreadsheet app of your choice? the appeal of a personal mint is to not share all my financial info with third-party companies, not to keep from paying a few bucks for a useful service.

ryanmarsh 8y ago

This is a nice kickstart for something that has been on my todo list for a while. Cashflow forecasting is important for my family budget and my small business. My cashflow fluctuates quite a bit. Some months I'll bring in 90k, some months nothing. I have really high expenses for such a small business because I travel and pay contractors. So far I've been doing this by hand, and trying to use features in Xero, plus a few expensive tools online that integrate with Xero (which do not deserve a free advertisement so I won't name them). I finally figured out if I want cash flow forecasting done right for me I'm going to have to do it myself.

trjordan 8y ago

> Build you own Mint > Fancy interface is out of scope for this demo. OK.

cmer 8y ago

Not sure if it's the right place/occasion to ask... I'd love a web application that gives me a one page financial dashboard with: - bank account balance - credit card balance. Due date - list of unusual transactions I should review - all my bills in one place, with amounts due and possibility to click through to see details - list of upcoming schedule payment (ie mortgage, gym membership, phone service) with alert/notification of one will bounce (ie: funds insufficient so I can transfer money to the right account) - upcoming financial obligations Is there such a thing? Ideally self hosted.

infinite8s 8y ago
This would be a perfect application built on top of sandstorm.io (which has the model of individual user run apps where there is no possibility of leakage between users).
justinhj 8y ago
If it’s self hosted do you see it as being free software or you’d pay an upfront cost for a license? Would you use a hosted web application if none of your data was uploaded?
- cmer 8y ago
  I'd rather pay a monthly fee for something I get value from daily. I would consider using a hosted service depending who the company is. I still don't fully trust Intuit with Mint.
EADGBE 8y ago
Current assets/valuation as well. Kinda hack this together in Google Sheets currently with Zillow, 401K, assets, liabilities, investment accounts, etc.

sschueller 8y ago

Reminder that Plaid doesn't know what their doing when it comes to security: https://github.com/plaid/link/issues/68 https://github.com/plaid/link/issues/68

SmirkingRevenge 8y ago
This is a bit unfair, isn't it? Not in the sense that these practices arent awful and inexcusable from a security standpoint, but in the sense that plaid isn't doing anything that isn't standard practice in the finance industry. Every 3rd party tool that does something with your finances (mint, personal capital, ynab, and even online banks that pull info from other banks) require you to submit login credentials in this manner. The industry needs changing - and really some rather punitive regulation IMHO - but this isn't a Plaid specific problem per se.
- prplhaz4 8y ago
  The finance industry mainly uses OFX as the standard for online access to statements/transaction downloads (as does quicken, QuickBooks and gnucash...etc). Some banks do not support it and others go through aggregators to provide access. You are doing people a huge disservice by identifying the companies you listed as "the finance industry". They are scraping data (in most cases against TOS) and exposing it as a paid API service. It's a terrible state of affairs that easy access to ownership of this critical data is so hard to come by and has essentially forced people to give up their most valuable credentials to in a lot of cases unknown or untrustworthy parties. At least mint has partnered with some banks that actually provide supported APIs for transaction data (Chase), but that is so far from the norm right now it makes me queasy.
  - SmirkingRevenge 8y ago
    Quicken asks me for my login credentials to my bank and in their policies, says they store my credentials in their infrastructure. How does QFX actually help here?
    - 8y ago

kotrunga 8y ago

I would recommend against letting Google know anything about your finances. Maybe try self-hosted solutions that are open source, like Firefly III. https://github.com/firefly-iii/firefly-iii https://github.com/firefly-iii/firefly-iii

floatingatoll 8y ago

Note that asking people not to commit credentials.json doesn’t work very well in practice: https://github.com/search?o=desc&q="credentials.json"&s=committer-date&type=Commits https://github.com/search?o=desc&q="credentials.json"&s=comm...

choward 8y ago

> You will first need to sign up for Plaid and apply for the development plan. I guess I'm not the target audience. The only reason I would even consider building something like this is so that I'm in full control. I have no idea what Plaid is. All I know for sure is that I don't want to sign up for it and also introduce a major dependency. I don't understand what the advantage is over Mint. I get to do more work and not be in control. Usually you can only get one of those.

Jemaclus 8y ago
Plaid is an API for banks, basically: https://plaid.com https://plaid.com. It's pretty fantastic (especially compared to the way you used to have to go about it.) As for advantages over Mint, I'm sure Mint has updated recently, but as of ~2 years ago, if you had a bank that didn't expose an API, Mint would take your credentials and more or less scrape the bank websites to get your information into their systems to do their voodoo magic to show you your stats. Plaid has done most of that legwork for you (interfacing with banks) and exposed the data via a nicer API, so you don't really have to worry about anything being wrong because of scraped data -- it's coming directly from the source. That's my understanding, anyway. As for how is this better than Mint? No idea. It's just a demo that shows that you could, if you wanted to. And Plaid is more or less the new standard for interacting with bank data, at least in the US.

cascom 8y ago

http://www.gnucash.org http://www.gnucash.org Is pretty solid

EvanYou 8y ago

Author here - this was just a weekend hack and didn't really expect it to show up here, but thanks for the security related feedback. The setup now uses environment variables.

koheripbal 8y ago
Have you considered merging your functionality with a package like gnucash which works as an open source account/budget program for families/small businesses? I think it would be a good match.

apearson 8y ago

https://www.tillerhq.com/ https://www.tillerhq.com/ This is another service like this. I've been using them for around 6 months and haven't had any trouble with them.

mirimir 8y ago

My first thought, seeing the title: the Liberty Dollar.[0] tl;dr - In the US, it's illegal to mint your own money. 0) http://libertydollar.org/ http://libertydollar.org/

skhavari 8y ago

If you want to do this without giving your data to any third party (plaid will store your data) or you have 2FA enabled on your FI accounts, try this: https://github.com/skhavari/cheddardog https://github.com/skhavari/cheddardog. It supports a few institutions. If you're a developer, its pretty easy to add more. It generates spending and balance reports, and pretty easy to slap an app (E2E encrypted of course) or local only web UI on top of it. Enjoy

vlucas 8y ago

If you are looking for a more "packaged" integration with Google Sheets, check out BudgetSheet: https://www.budgetsheet.net https://www.budgetsheet.net It is a Google Sheets Add-on found in the G Suite Marketplace. Disclaimer: I am the author. It is currently under review by Google and awaiting publication. There is an email sign at the bottom of the page if you want to be notified at launch. :)