11 ms·

With respect, why should I trust your API with my personal banking details? I can’t imagine that I have too many things that are more sensitive than my banking

With respect, why should I trust your API with my personal banking details? I can’t imagine that I have too many things that are more sensitive than my banking details, so how do you convince me that you keep this data safe and that it’s not possible for this information to leak anywhere or be stolen?

catchmeifyoucan 6y ago
It looks like it just takes an identifier and not your actual bank data. I’m not familiar with these identifiers, but I assume they’re somewhat generic per company maybe?
- bradknowles 6y ago
  Even if all it takes is the identifiers as shown in the example for Spotify, multiplied by all the hundreds or thousands of transactions per person, and all the thousands or millions of people, that’s still much too large of a honeypot. I don’t want anyone having that much information of that kind about me, unless they’re going to give me very strong guarantees about how hard they’re going to work to protect that data. And the name “catchmeifyoucan” definitely brings up vision of Frank Abagnale, and the kinds of crazy crimes that he managed to get away with for so long.....
  - rco8786 6y ago
    I'm curious what would be the negative ramifications of someone gaining access to these identifiers? AFAIK they are not considered PII or anything. Not saying they should or should not be protected, but I'm having a difficult time thinking of what the attack vector would be. I guess having a list of your recurring SaaS services coupled with maybe a leaked password database or something could give potential attackers a list of the places to attempt using your password?
  - catchmeifyoucan 6y ago
    I’m still not seeing it. It’s the equivalent of a logo api? From what I see, I don’t see you giving any personal data or identifiable information. Kinda like this api: https://clearbit.com/logo https://clearbit.com/logo And yup, I was inspired by the movie :)
Satam 6y ago
We've made this as isolated and private as possible. By design, we kept it separate from any bank-linking processes, and we don't ever keep track of who's the owner of the transactions (nor do we have a way of knowing). Even more, the free api does not require any authentication and you can remove anything you'd consider personally identifiable information before making the requests. Hope this answers it!

catchmeifyoucan 6y ago

It looks like it just takes an identifier and not your actual bank data. I’m not familiar with these identifiers, but I assume they’re somewhat generic per company maybe?

bradknowles 6y ago
Even if all it takes is the identifiers as shown in the example for Spotify, multiplied by all the hundreds or thousands of transactions per person, and all the thousands or millions of people, that’s still much too large of a honeypot. I don’t want anyone having that much information of that kind about me, unless they’re going to give me very strong guarantees about how hard they’re going to work to protect that data. And the name “catchmeifyoucan” definitely brings up vision of Frank Abagnale, and the kinds of crazy crimes that he managed to get away with for so long.....
- rco8786 6y ago
  I'm curious what would be the negative ramifications of someone gaining access to these identifiers? AFAIK they are not considered PII or anything. Not saying they should or should not be protected, but I'm having a difficult time thinking of what the attack vector would be. I guess having a list of your recurring SaaS services coupled with maybe a leaked password database or something could give potential attackers a list of the places to attempt using your password?
- catchmeifyoucan 6y ago
  I’m still not seeing it. It’s the equivalent of a logo api? From what I see, I don’t see you giving any personal data or identifiable information. Kinda like this api: https://clearbit.com/logo https://clearbit.com/logo And yup, I was inspired by the movie :)

Satam 6y ago

We've made this as isolated and private as possible. By design, we kept it separate from any bank-linking processes, and we don't ever keep track of who's the owner of the transactions (nor do we have a way of knowing). Even more, the free api does not require any authentication and you can remove anything you'd consider personally identifiable information before making the requests. Hope this answers it!