4 ms·
The downside of such adversarial interoperability is that it reduces security, because the scrapping systems need the user's credentials to login. I'm not going
by cromwellian 7y ago
The downside of such adversarial interoperability is that it reduces security, because the scrapping systems need the user's credentials to login. I'm not going to give any third party my banking credentials, and I have 2FA turned on every site as well.
I suppose if the scrapping is done by the user's browser via say, a timed service worker or something, and the credentials never leave the user's browser, it would be ok, but the idea of a bank of headless (IE!) browsers with a database of millions of users bank credentials sends a shudder down my spine.
- singron 7y agoSimilarly, recaptcha prevents this as well. Recaptcha primarily checks that it's running on a real browser on the correct website using botguard. Then it might give you the CAPTCHA challenge to prove you are human. It's not possible to solve the CAPTCHA challenge without first passing botguard. A good example of this is discord. Alternative clients aren't very popular since you need to pass recaptcha to login. The currently available clients require you to copy cookies out of your browser.
- pabs3 7y agoThe Discord plugin for Pidgin doesn't require copying cookies: https://github.com/EionRobb/purple-discord/ https://github.com/EionRobb/purple-discord/
- matheusmoreira 7y agoScraping should be done client side. Like an automated browser. That way credentials never have to leave the user's computer or be shared with third parties.
- mantap 7y agoThat's still dangerous and a retrograde step security-wise. There should be no third party code that is running on your internet banking session, including browser extensions.