5 ms·

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously

by jez 6y ago

This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like that. Instead they'd want very specific permission like, only permission to deposit money, or only permission to read the balance, or only permission to read transactions, etc... It is so, so much worse than that. Most banks don’t even provide OAuth APIs, so to hack around this third parties just straight up ask for your bank username and bank password so that they can turn around and log into that site and scrape the HTML UIs that come back from logging in. “I think most people would be super scared of that.” No doubt these people exist (hello!) but like, there’s a whole industry built around this.[1] Possibly the banking example is not the best piece of supporting evidence for the article’s claim. [1] https://plaid.com/ https://plaid.com/

niij 6y ago
I came to the comments as soon as I read that part. It's funny they probably don't realize that's what FI aggregation at their bank is doing. Screen scraping is a necessary evil until we can get banks in America with APIs.
u801e 6y ago
I remember this topic coming up at work and I said something along the lines of why would anyone provide their online bank account credentials to another service in order for them to verify your account and other members of my team (all software developers and operations) didn't see a problem with it. It seems like there's a significant disconnect between what people believe is good security practice.
- deleted 6y ago
  [deleted]
- o-__-o 6y ago
  My wife: “I didn’t know it did that. Oh well” Bad cyber security is almost but not quite like sleeping around behind your partners back. If you get burned you both suffer.
garaetjjte 6y ago
I don't know how this insanity still exists. Sharing login data with third parties is likely violation of bank ToS and might deprive you of fraud protection (bank might argue that you were grossly negligent by sharing credentials). I guess acceptance of that crazy scheme is regional thing. Paypal tried to pull that over here but they backed out after a week of extensive backlash. And EU mandates that banks provide APIs in PSD2 directive.
- Spivak 6y ago
  I mean PayPal still right now today does it for the “verify your bank account” feature.
  - hnick 6y ago
    I don't think they do in Australia... how odd. As far as I recall this article is accurate. They send two small amounts and ask you to type it in to confirm it came through. https://www.paypal.com/au/smarthelp/article/how-do-i-confirm-my-bank-account-faq3045 https://www.paypal.com/au/smarthelp/article/how-do-i-confirm...
- asidiali 6y ago
  I recently needed to add a personal Chase account to a business Chase account to send a transfer. I kid you not, their own account linking flow used Plaid to collect my Chase(!) personal credentials and verify my Chase(!!!) personal account, within their own web UI while actively signed into my account. Granted, there is capability in that UI to link any external account, so you can sign into other banks. But I mean come on...at least implement something secure for your own damn accounts!
  - brazzledazzle 6y ago
    You can almost smell the internal bureaucracy and dysfunction.
  - viraptor 6y ago
    This may be a case of an external account in practice. There are many banks running the retail and business accounts under a similar corp name, but in practice they're separate entities which don't share infrastructure or processes. (I'd love to know the reason, I'm sure someone here knows the details)
technion 6y ago
Looking at their FAQ, mwave seem to have ceased this practice but they had a thriving online business at the time I wrote this: https://lolware.net/2016/11/17/requesting_bank_login.html https://lolware.net/2016/11/17/requesting_bank_login.html Everybody single person who provided feedback on this blog argued I was "being pedantic about nothing", "throwing your fedora at them", and even at American Express they took very seriously the "get your money back" angle but seemed confused as to why I didn't want to hand passwords out.
closeparen 6y ago
The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more money. People talk about this like your online banking password is protecting your money... it’s not. If someone adds an online bill pay recipient from the web portal it triggers loud and slow verifications and confirmations. If someone submits an ACH transaction for my account number in their nightly batch, the money just flies right out.
- cortesoft 6y ago
  > the money just flies right out. And then flies right back in once you report the fraud. The system works not by making it hard to steal money, but by making it easy to get back. This is like credit cards... yes, a shady store can steal money from you.... but then you get it back and they go to jail.
  - vosper 6y ago
    > The system works not by making it hard to steal money, but by making it easy to get back. In other countries the system works by making it hard to steal money: I'm in New Zealand, and you can't do really anything with my account number, except pay me. Direct debit does exist, but it's a lot harder to setup (I have to send the bank original signed documents if I want to setup a direct debit from my account) to the point that I think many people don't even use it.
    - deleted 6y ago
      [deleted]
    - cortesoft 6y ago
      Right, and that is why I kinda prefer the American system.... it is very easy to use and set up direct deposit and direct payments, and most of the time nothing bad happens. The few times something bad happens, it is fixed. I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money.
scubbo 6y ago
I, too, clicked through into the comments as soon as I read that bit, wondering whether someone else had the same reaction as me. As a UK citizen who's lived in the states for the last 4 years, the permissions that Venmo and other financial apps require is even more horrifying than the rest of the US financial system ("tell us what tax you think that you owe, and if you're wrong, you go to prison" // "you have to build up credit in order to be able to afford anything - but if you ever fail to pay it off, you'll be in debt for the rest of your life").
trwy99906 6y ago
It gets much worse. There are payment methods building upon this structure that fully analyze your bank account transaction history for income details to produce risk results and give back these raw results to merchants. https://developers.paywithmybank.com/api/#get-user-income https://developers.paywithmybank.com/api/#get-user-income
jeffbee 6y ago
It's even worse than the HTML scraping. Banks will do literally anything if the instructions arrive by fax or mail, assuming you get the account number correct. The practical security of banking is ridiculously bad.
stevehawk 6y ago
Banking is not secure. The bank industry is held together by strings of rules and regulations that, fortunately, very few people are willing to pull at.
spockz 6y ago
This is why we have PSD2 in Europe. Additionally, there was a ruling somewhere that until a bank allows for a proper machine interface like an API, it must not actively block scrapping but the details on that are fuzzy atm.
chimbosonic 6y ago
Its funnier when you know that banks are actually planning on sharing data via something similar to Oauth. Its called Open Banking PSD2.
- megous 6y ago
  Even better, banks in may country are banding together to create identity provider for the web. So basically you will be able to use their super-secure login to online banking based on the state of the art SMS second factor and localhost port probing via the web browser (/s), to identify yourself on the web (up to AML level), sign contracts, or access government services. https://bankovni-identita.cz/o-projektu/ https://bankovni-identita.cz/o-projektu/ Security of this project is anyone's guess. They certainly have a lot of flashy websites to lure people in, but actual documentation is behind a signup wall. Each bank will create its own independent IdP infrastructure, so this is gonna be a lot of fun for security researchers to be sure. After this is done, it seems like I'll already be registered with 6 online IdPs (not all of these are banks) that will be able to identify me enough to allow online communication with the government services. This proliferation of IdPs is getting quite scary...
pjungwir 6y ago
Let's not let that be an excuse to settle for poor security, either from Github or our banks. I agree the way Plaid/Yodlee/etc ask for passwords is insane. I've "closed the tab" several times when I hit that. Just the other day I got asked for my bank passwords for a mortgage refinance. I refused and they said I could send them bank statements instead. On the other hand, if I want to access a customer's CI pipeline there's no one at Semaphore I can email to find a more-secure workaround. I have to grant access to my whole Github account. As a freelancer with a lot of clients, that's a big problem for me.

by jez 6y ago

niij 6y ago

I came to the comments as soon as I read that part. It's funny they probably don't realize that's what FI aggregation at their bank is doing. Screen scraping is a necessary evil until we can get banks in America with APIs.

u801e 6y ago

I remember this topic coming up at work and I said something along the lines of why would anyone provide their online bank account credentials to another service in order for them to verify your account and other members of my team (all software developers and operations) didn't see a problem with it. It seems like there's a significant disconnect between what people believe is good security practice.

deleted 6y ago
[deleted]
o-__-o 6y ago
My wife: “I didn’t know it did that. Oh well” Bad cyber security is almost but not quite like sleeping around behind your partners back. If you get burned you both suffer.

garaetjjte 6y ago

I don't know how this insanity still exists. Sharing login data with third parties is likely violation of bank ToS and might deprive you of fraud protection (bank might argue that you were grossly negligent by sharing credentials). I guess acceptance of that crazy scheme is regional thing. Paypal tried to pull that over here but they backed out after a week of extensive backlash. And EU mandates that banks provide APIs in PSD2 directive.

Spivak 6y ago
I mean PayPal still right now today does it for the “verify your bank account” feature.
- hnick 6y ago
  I don't think they do in Australia... how odd. As far as I recall this article is accurate. They send two small amounts and ask you to type it in to confirm it came through. https://www.paypal.com/au/smarthelp/article/how-do-i-confirm-my-bank-account-faq3045 https://www.paypal.com/au/smarthelp/article/how-do-i-confirm...
asidiali 6y ago
I recently needed to add a personal Chase account to a business Chase account to send a transfer. I kid you not, their own account linking flow used Plaid to collect my Chase(!) personal credentials and verify my Chase(!!!) personal account, within their own web UI while actively signed into my account. Granted, there is capability in that UI to link any external account, so you can sign into other banks. But I mean come on...at least implement something secure for your own damn accounts!
- brazzledazzle 6y ago
  You can almost smell the internal bureaucracy and dysfunction.
- viraptor 6y ago
  This may be a case of an external account in practice. There are many banks running the retail and business accounts under a similar corp name, but in practice they're separate entities which don't share infrastructure or processes. (I'd love to know the reason, I'm sure someone here knows the details)

technion 6y ago

Looking at their FAQ, mwave seem to have ceased this practice but they had a thriving online business at the time I wrote this: https://lolware.net/2016/11/17/requesting_bank_login.html https://lolware.net/2016/11/17/requesting_bank_login.html Everybody single person who provided feedback on this blog argued I was "being pedantic about nothing", "throwing your fedora at them", and even at American Express they took very seriously the "get your money back" angle but seemed confused as to why I didn't want to hand passwords out.

closeparen 6y ago

The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more money. People talk about this like your online banking password is protecting your money... it’s not. If someone adds an online bill pay recipient from the web portal it triggers loud and slow verifications and confirmations. If someone submits an ACH transaction for my account number in their nightly batch, the money just flies right out.

cortesoft 6y ago
> the money just flies right out. And then flies right back in once you report the fraud. The system works not by making it hard to steal money, but by making it easy to get back. This is like credit cards... yes, a shady store can steal money from you.... but then you get it back and they go to jail.
- vosper 6y ago
  > The system works not by making it hard to steal money, but by making it easy to get back. In other countries the system works by making it hard to steal money: I'm in New Zealand, and you can't do really anything with my account number, except pay me. Direct debit does exist, but it's a lot harder to setup (I have to send the bank original signed documents if I want to setup a direct debit from my account) to the point that I think many people don't even use it.
  - deleted 6y ago
    [deleted]
  - cortesoft 6y ago
    Right, and that is why I kinda prefer the American system.... it is very easy to use and set up direct deposit and direct payments, and most of the time nothing bad happens. The few times something bad happens, it is fixed. I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money.

scubbo 6y ago

I, too, clicked through into the comments as soon as I read that bit, wondering whether someone else had the same reaction as me. As a UK citizen who's lived in the states for the last 4 years, the permissions that Venmo and other financial apps require is even more horrifying than the rest of the US financial system ("tell us what tax you think that you owe, and if you're wrong, you go to prison" // "you have to build up credit in order to be able to afford anything - but if you ever fail to pay it off, you'll be in debt for the rest of your life").

trwy99906 6y ago

It gets much worse. There are payment methods building upon this structure that fully analyze your bank account transaction history for income details to produce risk results and give back these raw results to merchants. https://developers.paywithmybank.com/api/#get-user-income https://developers.paywithmybank.com/api/#get-user-income

jeffbee 6y ago

It's even worse than the HTML scraping. Banks will do literally anything if the instructions arrive by fax or mail, assuming you get the account number correct. The practical security of banking is ridiculously bad.

stevehawk 6y ago

Banking is not secure. The bank industry is held together by strings of rules and regulations that, fortunately, very few people are willing to pull at.

spockz 6y ago

This is why we have PSD2 in Europe. Additionally, there was a ruling somewhere that until a bank allows for a proper machine interface like an API, it must not actively block scrapping but the details on that are fuzzy atm.

chimbosonic 6y ago

Its funnier when you know that banks are actually planning on sharing data via something similar to Oauth. Its called Open Banking PSD2.

megous 6y ago
Even better, banks in may country are banding together to create identity provider for the web. So basically you will be able to use their super-secure login to online banking based on the state of the art SMS second factor and localhost port probing via the web browser (/s), to identify yourself on the web (up to AML level), sign contracts, or access government services. https://bankovni-identita.cz/o-projektu/ https://bankovni-identita.cz/o-projektu/ Security of this project is anyone's guess. They certainly have a lot of flashy websites to lure people in, but actual documentation is behind a signup wall. Each bank will create its own independent IdP infrastructure, so this is gonna be a lot of fun for security researchers to be sure. After this is done, it seems like I'll already be registered with 6 online IdPs (not all of these are banks) that will be able to identify me enough to allow online communication with the government services. This proliferation of IdPs is getting quite scary...

pjungwir 6y ago

Let's not let that be an excuse to settle for poor security, either from Github or our banks. I agree the way Plaid/Yodlee/etc ask for passwords is insane. I've "closed the tab" several times when I hit that. Just the other day I got asked for my bank passwords for a mortgage refinance. I refused and they said I could send them bank statements instead. On the other hand, if I want to access a customer's CI pipeline there's no one at Semaphore I can email to find a more-secure workaround. I have to grant access to my whole Github account. As a freelancer with a lot of clients, that's a big problem for me.