4 ms·

Mint legitmatized that authorization flow years before Plaid came around and the banks decided that was the best way to move forward instead of adopting somethi

Mint legitmatized that authorization flow years before Plaid came around and the banks decided that was the best way to move forward instead of adopting something like an oauth2 flow.

VoiceOfWisdom 8y ago
I remember Quicken doing it back in the early 2000s.
- anoncake 8y ago
  That is a program though, not a website.
  - AnthonyMouse 8y ago
    That's the problem now though. We've made it so apps have to be approved by gatekeepers, and are highly discouraged by the gatekeepers from sharing state with other apps on the same device. Then the recommendation if that's a problem for you is to use the web. But sometimes the web doesn't work, as is the case here, because it requires the user to trust third party code in real time and give sensitive data to third party servers they don't control. So we have everything pushing the user to put their most sensitive information into some third party service that should be an app, but isn't, because cloud.
    - tantalor 8y ago
      > highly discouraged by the gatekeepers from sharing state Source? My understanding is the app permission model never asks for network access, so all "apps" are effectively web clients with a fancy UI.
      - icebraining 8y ago
        > My understanding is the app permission model never asks for network access, so all "apps" are effectively web clients with a fancy UI. At least for Android, not exactly: they still have to require network access (android.permission.INTERNET), and you can check if they have done that in the Play Store (description → Read More → App permissions). What changed is that the Store won't explicitly ask you to confirm you're OK with it when installing. In any case, typical native applications didn't have to ask for network access either, that didn't make them all effectively web clients. Many of the mobile apps I have installed don't rely on a central service.
      - AnthonyMouse 8y ago
        > Source? Example: https://news.ycombinator.com/item?id=19521211 https://news.ycombinator.com/item?id=19521211 I'm not talking about sharing state with your webserver, I'm talking about two apps on your phone sharing state directly with each other without ever leaving the device or becoming accessible to a third party. Desktop operating systems have a slew of ways to facilitate this, and the mobile gatekeepers keep eroding them. They're also terrible at dependency management (a completely solved problem in real package managers), which discourages creating apps that depend on other apps. There are still ways to do any given thing, but if you make it harder then you make it rarer.
  - tantalor 8y ago
    Point being?
dylan604 8y ago
I remember when Mint first came around, and a coworker was telling me about how cool it was. I started completing the the signup process, but I stopped cold once I realized they needed to be provided account credentials from my bank. Never completed it, and never went back to it. I never thought it would last as long as it had. I guess I gave the public too much credit.
- newnewpdro 8y ago
  The general public is extremely myopic and lazy. They will hand over anything you ask for if it means they have to do less work in the short-term. Convenience trumps all. It's how we've ended up with people voluntarily purchasing, maintaining, carrying around at all times, keeping charged and powered on, their own personal surveillance devices running heaps of software they have no control over.
  - csallen 8y ago
    Counterpoint: Many people of the "general public" are at least vaguely aware of the fact that they're making risky decisions, but proceed regardless in order to reap the short-term rewards that you mention, calculating that the benefits are worth the hypothetical costs, and many of them will live and die having been right about making that tradeoff.
    - UweSchmidt 8y ago
      You would use an old bridge, trusting that someone somewhere is responsible for inspecting that bridge and guaranteeing that it holds. In the same way, "we" are responsible that our software fundamentally works to a certain standard so that other people can trust using it.
    - Loughla 8y ago
      Counterpoint to your counterpoint: Living in flyover country surrounded by people with at best a high school education has taught me MANY things about how the public consumes tech. They have no idea what is possible with technology. They literally do not and cannot comprehend what can be done with their information online. To the folks I interact with, it's almost magical how it works. They trust, as another comment points out here, that someone is taking care of whatever trail they leave (if they even understand that's a thing). They trust that tech companies are acting in their best interests. Maybe that's just anecdotal data from my experience, but it's my experience.
matz1 8y ago
I've been using mint for years，it's been very useful for me. Adopting other mechanism like oauth will be slow they wouldn't be able to support that many financial institution. Its all boil down to risk vs benefit.
ramraj07 8y ago
I use mint even now. I'm generally technically paranoid, and have just concluded mint is not actually that risky. Here's why: 1. Most banking companies seem to have a much better security landscape than other places, including tracking where you're logging in from. Even with a password it won't be easy for a hacker to do stuff with my accounts. Almost any change or transaction triggers an email and sms alert too. 2. The main bank I have my money in, doesn't let you do transactions larger than 2000 in a day online, and even that is insured against fraud. 3. For credit card accounts, I have noticed that you actually can't do much with just an online account, except to pay the bill. 4. Mint is owned by Intuit and they know my tax details, most of which are far more important and guard-worthy anyways. 5. Also till now I've been a fairly poor guy with not much in my bank accounts. So I didn't worry too much about losing my cash since I didn't have much. If you have a lot of it, perhaps you need to be careful with such services.
- propogandist 8y ago
  Mints privacy policy includes this language "we may prepare and share information about our customers with third parties, such as advertisers or partners, for research, academic, marketing and/or promotional purposes." - where any usage of "may" can be substituted with "will". They say they will anonymize data, but advertisers have no interest in data if they can't action on it -- i.e. use the data they buy for targeted advertising.
  - astura 8y ago
    To some of us (me) the service Mint provides is well worth letting some marketer know I spent $50 at Walmart yesterday, that's not sensitive information to me, and if it were I'd be paying in cash. I even gave the transaction history of all my credit cards directly to Drop (https://www.earnwithdrop.com https://www.earnwithdrop.com) in exchange for a few dollars, that's how little it means to me. (So far around $30)
hopler 8y ago
Mint was a copy of Yodlee. This stuff is old.

Mint legitmatized that authorization flow years before Plaid came around and the banks decided that was the best way to move forward instead of adopting something like an oauth2 flow.

VoiceOfWisdom 8y ago

I remember Quicken doing it back in the early 2000s.

anoncake 8y ago
That is a program though, not a website.
- AnthonyMouse 8y ago
  That's the problem now though. We've made it so apps have to be approved by gatekeepers, and are highly discouraged by the gatekeepers from sharing state with other apps on the same device. Then the recommendation if that's a problem for you is to use the web. But sometimes the web doesn't work, as is the case here, because it requires the user to trust third party code in real time and give sensitive data to third party servers they don't control. So we have everything pushing the user to put their most sensitive information into some third party service that should be an app, but isn't, because cloud.
  - tantalor 8y ago
    > highly discouraged by the gatekeepers from sharing state Source? My understanding is the app permission model never asks for network access, so all "apps" are effectively web clients with a fancy UI.
    - icebraining 8y ago
      > My understanding is the app permission model never asks for network access, so all "apps" are effectively web clients with a fancy UI. At least for Android, not exactly: they still have to require network access (android.permission.INTERNET), and you can check if they have done that in the Play Store (description → Read More → App permissions). What changed is that the Store won't explicitly ask you to confirm you're OK with it when installing. In any case, typical native applications didn't have to ask for network access either, that didn't make them all effectively web clients. Many of the mobile apps I have installed don't rely on a central service.
    - AnthonyMouse 8y ago
      > Source? Example: https://news.ycombinator.com/item?id=19521211 https://news.ycombinator.com/item?id=19521211 I'm not talking about sharing state with your webserver, I'm talking about two apps on your phone sharing state directly with each other without ever leaving the device or becoming accessible to a third party. Desktop operating systems have a slew of ways to facilitate this, and the mobile gatekeepers keep eroding them. They're also terrible at dependency management (a completely solved problem in real package managers), which discourages creating apps that depend on other apps. There are still ways to do any given thing, but if you make it harder then you make it rarer.
- tantalor 8y ago
  Point being?

dylan604 8y ago

I remember when Mint first came around, and a coworker was telling me about how cool it was. I started completing the the signup process, but I stopped cold once I realized they needed to be provided account credentials from my bank. Never completed it, and never went back to it. I never thought it would last as long as it had. I guess I gave the public too much credit.

newnewpdro 8y ago
The general public is extremely myopic and lazy. They will hand over anything you ask for if it means they have to do less work in the short-term. Convenience trumps all. It's how we've ended up with people voluntarily purchasing, maintaining, carrying around at all times, keeping charged and powered on, their own personal surveillance devices running heaps of software they have no control over.
- csallen 8y ago
  Counterpoint: Many people of the "general public" are at least vaguely aware of the fact that they're making risky decisions, but proceed regardless in order to reap the short-term rewards that you mention, calculating that the benefits are worth the hypothetical costs, and many of them will live and die having been right about making that tradeoff.
  - UweSchmidt 8y ago
    You would use an old bridge, trusting that someone somewhere is responsible for inspecting that bridge and guaranteeing that it holds. In the same way, "we" are responsible that our software fundamentally works to a certain standard so that other people can trust using it.
  - Loughla 8y ago
    Counterpoint to your counterpoint: Living in flyover country surrounded by people with at best a high school education has taught me MANY things about how the public consumes tech. They have no idea what is possible with technology. They literally do not and cannot comprehend what can be done with their information online. To the folks I interact with, it's almost magical how it works. They trust, as another comment points out here, that someone is taking care of whatever trail they leave (if they even understand that's a thing). They trust that tech companies are acting in their best interests. Maybe that's just anecdotal data from my experience, but it's my experience.

matz1 8y ago

I've been using mint for years，it's been very useful for me. Adopting other mechanism like oauth will be slow they wouldn't be able to support that many financial institution. Its all boil down to risk vs benefit.

ramraj07 8y ago

I use mint even now. I'm generally technically paranoid, and have just concluded mint is not actually that risky. Here's why: 1. Most banking companies seem to have a much better security landscape than other places, including tracking where you're logging in from. Even with a password it won't be easy for a hacker to do stuff with my accounts. Almost any change or transaction triggers an email and sms alert too. 2. The main bank I have my money in, doesn't let you do transactions larger than 2000 in a day online, and even that is insured against fraud. 3. For credit card accounts, I have noticed that you actually can't do much with just an online account, except to pay the bill. 4. Mint is owned by Intuit and they know my tax details, most of which are far more important and guard-worthy anyways. 5. Also till now I've been a fairly poor guy with not much in my bank accounts. So I didn't worry too much about losing my cash since I didn't have much. If you have a lot of it, perhaps you need to be careful with such services.

propogandist 8y ago
Mints privacy policy includes this language "we may prepare and share information about our customers with third parties, such as advertisers or partners, for research, academic, marketing and/or promotional purposes." - where any usage of "may" can be substituted with "will". They say they will anonymize data, but advertisers have no interest in data if they can't action on it -- i.e. use the data they buy for targeted advertising.
- astura 8y ago
  To some of us (me) the service Mint provides is well worth letting some marketer know I spent $50 at Walmart yesterday, that's not sensitive information to me, and if it were I'd be paying in cash. I even gave the transaction history of all my credit cards directly to Drop (https://www.earnwithdrop.com https://www.earnwithdrop.com) in exchange for a few dollars, that's how little it means to me. (So far around $30)

hopler 8y ago

Mint was a copy of Yodlee. This stuff is old.