7 ms·
It's worth noting here (though many people have in different ways already) that the reason you should not put credentials in any git repo (private or public) is
by zbruhnke 8y ago
It's worth noting here (though many people have in different ways already) that the reason you should not put credentials in any git repo (private or public) is that inevitably when you share repos with third party services (A CI for instance) you are also giving them credentials as a result and exposing one more vulnerability in the case that they get hacked or otherwise don't store things in an encrypted manner.
Because Github makes it so easy to give developers read access to repos this happens more often that you would realize, and having your most sensitive credentials (banking username and password) exposed in a repo to several different vendors is NEVER a good practice.
It's fine if you're going to use this but at least properly encrypt the secrets, or add your creds in a different file and gitignore it at the least if you're too lazy to use something like vault, credstash etc.
The reality is you're only as strong as your weakest link and there is just no use in having your weakest link be a relative unknown
Source: I built a Plaid competitor once upon a time (that obviously did not work out as well for me as it did for them) and I am currently building a bank, so I know a few things about security and vulnerabilities
- jjeaff 8y ago>currently building a bank I'm curious about this. I assume you are building banking software? Like a full stack?
- zbruhnke 8y agohaha boy is it a long story ... but yes both banking software and buying part of an actual bank so we can build a full-stack bank for the next 100 years
- jjeaff 8y agoInteresting. Have you done any write-ups or have any more information out there? As a developer with a degree in finance, this kind of stuff interests me.
- zbruhnke 8y agoWe don't have a ton out there because we're still mostly pre-investment, but we have about 9k people signed up for the landing page we built - https://launch.trycrux.com https://launch.trycrux.com and we should be able to start opening real accounts in the next few weeks
- JungleGymSam 8y agoPlease allow me to create a read only account so that services like Mint and YNAB don't have full access.
- zbruhnke 8y agoYES ... I completely plan on having a read only/API account login and more explicit permissions where you see exactly what you're giving access to but that's again a story for another day, can talk about this for hours!
- edraferi 8y agoMan I would LOVE to have this. I’m terrified/outraged by the abysmal state of data access at American banks. Just horrified that state of the art is giving your primary credentials to a third party.
- softawre 8y agoSome companies are coming away from the dark side here. I have like 10 accounts on Mint and I think 3 of them are read-only. Coinbase is one for sure, and maybe Capital One?
- moeamaya 8y agoJust signed up! Really compelling product. Random, but you using the Harry's Rails app by chance?
- 8y ago
- Fogest 8y agoI assume this will be for just American's?