9 ms·

The quiet battle raging around open banking

120 points by rmesters 5y ago

wdb 5y ago
Open Finance is quite possible without giving your user name and password, by using a similar approach as Open Banking API. Which platform require you to give your credentials?
- crooked-v 5y ago
  Plaid is the big one. They use app-specific passwords or other auth methods where available, but most of the integrations they offer are built on elaborate screen scraping because the banks they're pulling from don't offer any kind of APIs in the first place.
elzbardico 5y ago
I see no point in open banking for me as a customer. The supposed benefits are timid compared to the huge privacy implications. I pass
- fsflover 5y ago
  Which privacy implications?
  - danuker 5y ago
    The attack surface is larger if there are also third parties with access to your account data. Attackers will breach the weakest link. Right now there is only one link: your bank's website.
    - lazide 5y ago
      That is unfortunately not true. There are a great many additional surface areas, such as that time they linked TurboTax to their account, or the time they signed up for budgeting software - and gave it their bank credentials, etc. Most of these being done through screen scraping and by storing users bank credentials in some random 3rd parties database. Which is a huge and tempting target. It’s gotten somewhat better in some cases now as they are at least using SSO type setups, so it’s a track able and expirable token instead of raw credentials at least some of the time - but yikes.
- gjs278 5y ago
  ok well I do. mint is the easiest example. maybe get some money first and you’ll understand too.
- travoc 5y ago
  They're helpful if you use portfolio aggregation tools like Personal Capital or Mint. Tracking your overall portfolio balance when you have many different types of investment accounts with different banks is difficult to do by hand. Without open banking APIs, these tools have to collect your authentication information and impersonate you on your banks' websites to collect your account balance information.
- frosted-flakes 5y ago
  I use a budget app called YNAB (You Need A Budget). It's great, but if I want to connect it to my bank account so I don't forget to add a transaction, I need to literally give my bank account number and password to Plaid, a 3rd party service that logs into my online banking portal as me in order to screen-scrape my transaction data, because my bank does not offer an API. Do you not see a problem with this? Not only is it a terrible idea from a security stand-point, but it's also super brittle and error-prone, because whenever the bank updates its website it breaks the screenscraper.
  - hughrr 5y ago
    Gah I was looking into this sort of stuff. I'm sticking to Excel and manual reconciliation like I've been doing for 20 years now. Thanks for the heads up.
    - frosted-flakes 5y ago
      You don't need to connect your bank account to YNAB. It works fine without it; you just need to manually enter every transaction, which you should do anyway. Linking to your bank account is just to catch mistakes and to auto-add scheduled transactions. I would never go back to budgeting in Excel. Way too tedious.
fuckthebay321 5y ago
FUCK YOUR MASK MANDATE! KILL YOURSELF FUCKING FASCIST BITCH!
rendall 5y ago
I didn't understand that article. Maybe I don't have enough context. "share their bank data with other parties" What? Who wants to share their what now with whom? Why would they do that? "Fintechs like Plaid, TrueLayer and Tink have founded their businesses on providing access to regulated banking data for a fee.." What data? Aggregated? Individual banking? What regulated data? What regulations? "Under current banking regulation, raw data must be provided for free to consumers via an official application programming interface (or API). As a result, the apps pick up the cost on behalf of their users." What? My bank doesn't offer an API. I have no idea what that last sentance even means. What cost? It really seems like the article assumes a lot of background knowledge. Anybody have an ELI5 link?
- damagednoob 5y ago
  > What? Who wants to share their what now with whom? Why would they do that? Barclays will send banking data directly to FreeAgent[1] which allows you to categorize the transactions and upload receipts. FreeAgent uses this information to calculate how much VAT and Corporation tax I owe to the government. Couldn't be simpler. [1] https://support.freeagent.com/hc/en-gb/articles/360006470520-How-to-set-up-a-bank-feed https://support.freeagent.com/hc/en-gb/articles/360006470520...
- twic 5y ago
  This is all about PSD2: https://www.ukfinance.org.uk/guidance/payment-services-directive-2-and-open-banking https://www.ukfinance.org.uk/guidance/payment-services-direc...
- rojeee 5y ago
  All banks in the EU must offer a data and payments API. The APIs are standardised and must allow third party service providers - which themselves must be regulated - to be able to build services using these APIs. With a user's authorisation, said service provider can view transaction data or initiate a payment, for example. The specific regulation is called "payment services directive 2".
  - wrnr 5y ago
default-kramer 5y ago
I wish I could give my banks/FIs a token which allows the bank/FI to just drop my data (like transactions) into my Google Drive in some machine-readable format like CSV. Then I could use an offline tool of my choosing to analyze the data. Why can't it be this simple?
- Nextgrid 5y ago
  Use a modern bank like Monzo or Starling and they'll allow you to access their API directly without having either an AISP license or using a gatekeeper like TrueLayer.
  - samename 5y ago
    For people in the US: Monzo has a waitlist and Starling doesn’t seem available (yet)
  - zhte415 5y ago
    I've had a good experience with Monzo (never used Starling, though IIRC there's some history between the two). I'd recommend signing up to the waiting list if you haven't already.
reilly3000 5y ago
I yearn for better personal financial software with things like purchase queues, a simple “should I buy this?” UI, and a way to quickly calculate the downstream effects of financial decisions. Open banking, or at least clean, timely bank data is prerequisite to anything like that, but it’s been elusive for solo devs in the US. The UK and EU is far ahead in that regard.
Havoc 5y ago
Quite surprised to see a sponsored post make the front page of hn. I'm planning to utilize the UK version to aggregate my transactions via a read only interface. That seems relatively safe & think I can wrangle the half a dozen accounts with python into some sort of coherent view. Someone hacked together a bash version of it already: https://gitlab.com/emorrp1/accounts https://gitlab.com/emorrp1/accounts
londons_explore 5y ago
Open banking isn't what it sounds like... You would imagine that with open banking I could write my own code to pay my bills, send out birthday gifts, or pay my employees... I imagine I could enable a trusted third party to automatically switch my bank account from one that earns 0.1% interest to one that earns 1% interest... Or to detect that I was double billed for amazon prime and auto refund one. Or maybe it would let me create temporary bank accounts for a payment (so that I can't be overbilled). Yet it turns out that it's not really more than a csv dump of your statement. It's read only, and has barely any more data than the pdf files available from the bank. Pretty much all you can do with it is draw pretty graphs that anyone could draw in excel in 5 minutes. Oh, and some evil companies demand to have access to your bank statement via openbanking to check if you are 'worthy' of a job/loan/school.
- zhte415 5y ago
  There are two stages of regulatory licencing. One is the 'read only' as you state. The other allows transaction rules you have set up (or authorised) to be transacted on your behalf, and carries another layer of licence.
nuker 5y ago
The missing bit is IAM. User to create access keys, each key with a policy that allows specific actions. Much like AWS IAM works
- film42 5y ago
  The Financial Data Exchange (FDX) working group is pushing for this. They have a data spec and UX guides that encourage this exact thing. A user creates an access token for a specific app and that access token might can grant certain abilities to certain bank accounts. It's also adopted by the top US banks (live in production).
contingencies 5y ago
The #1 financial integration feature missing from ~all banks ~everywhere for most users is secure transaction notifications. Granted, this is significantly complicated by cancellation, deferred settlement, bank fees as an externally accounted figure, debit states and failed transactions with rollbacks or associated credits. But just a dumb integration would be enough for many uses and would allow firing a substantial number of accountants. It's not too tongue in cheek to suggest that the whole hosted-accounting world is largely playing off this one feature + pretty graphs. Thoughts on future settlement protocols: https://raw.githubusercontent.com/globalcitizen/ifex-protocol/master/draft-ifex-00.txt https://raw.githubusercontent.com/globalcitizen/ifex-protoco...
rahimnathwani 5y ago
This article is almost incoherent. I'm really surprised to see it rank here. It's useful neither to folks who know about open banking (because they would learn nothing new), nor to people new to open banking (because it doesn't explain even the basics of how it's meant to work). Open banking is meant to allow any third party to get your financial information if you agree, just like any app can implement social auth with Google/Twitter/GitHub. But (pasting a comment I wrote here 2 years ago): "By using Plaid or an Open Banking service from another party (e.g. Experian) you'll pay fees to get information you can get for free if you integrate directly with the banks. Even though the open banking APIs are uniform, any company wishing to use them still has to register with each and every bank, and test the integration works with each one. Until you've done it once, it's hard to know whether it will be easy (you write the code once, and it works flawlessly for all banks) or you have edge cases (e.g. some banks have funny timeout issues). So if you're a developer on a deadline, you will likely prefer to use a single API."
andreskytt 5y ago
The entire PSD2 directive laying the groundwork for open banking is a disaster, IMHO. It seeks to do the right things but then completely ignores identity and authorization as a problem. It kinda matters, which organizations you authorize to access your financial data and how do they know it’s you. All that given the eIDAS directive is in place laying at least groundwork for EU-wide identities. It has a glass ceiling to it: the more popular it gets the more fraud there is going to be the less popular it is.

120 points by rmesters 5y ago

wdb 5y ago

Open Finance is quite possible without giving your user name and password, by using a similar approach as Open Banking API. Which platform require you to give your credentials?

crooked-v 5y ago
Plaid is the big one. They use app-specific passwords or other auth methods where available, but most of the integrations they offer are built on elaborate screen scraping because the banks they're pulling from don't offer any kind of APIs in the first place.

elzbardico 5y ago

I see no point in open banking for me as a customer. The supposed benefits are timid compared to the huge privacy implications. I pass

fsflover 5y ago
Which privacy implications?
- danuker 5y ago
  The attack surface is larger if there are also third parties with access to your account data. Attackers will breach the weakest link. Right now there is only one link: your bank's website.
  - lazide 5y ago
    That is unfortunately not true. There are a great many additional surface areas, such as that time they linked TurboTax to their account, or the time they signed up for budgeting software - and gave it their bank credentials, etc. Most of these being done through screen scraping and by storing users bank credentials in some random 3rd parties database. Which is a huge and tempting target. It’s gotten somewhat better in some cases now as they are at least using SSO type setups, so it’s a track able and expirable token instead of raw credentials at least some of the time - but yikes.
gjs278 5y ago
ok well I do. mint is the easiest example. maybe get some money first and you’ll understand too.
travoc 5y ago
They're helpful if you use portfolio aggregation tools like Personal Capital or Mint. Tracking your overall portfolio balance when you have many different types of investment accounts with different banks is difficult to do by hand. Without open banking APIs, these tools have to collect your authentication information and impersonate you on your banks' websites to collect your account balance information.
frosted-flakes 5y ago
I use a budget app called YNAB (You Need A Budget). It's great, but if I want to connect it to my bank account so I don't forget to add a transaction, I need to literally give my bank account number and password to Plaid, a 3rd party service that logs into my online banking portal as me in order to screen-scrape my transaction data, because my bank does not offer an API. Do you not see a problem with this? Not only is it a terrible idea from a security stand-point, but it's also super brittle and error-prone, because whenever the bank updates its website it breaks the screenscraper.
- hughrr 5y ago
  Gah I was looking into this sort of stuff. I'm sticking to Excel and manual reconciliation like I've been doing for 20 years now. Thanks for the heads up.
  - frosted-flakes 5y ago
    You don't need to connect your bank account to YNAB. It works fine without it; you just need to manually enter every transaction, which you should do anyway. Linking to your bank account is just to catch mistakes and to auto-add scheduled transactions. I would never go back to budgeting in Excel. Way too tedious.

fuckthebay321 5y ago

FUCK YOUR MASK MANDATE! KILL YOURSELF FUCKING FASCIST BITCH!

rendall 5y ago

I didn't understand that article. Maybe I don't have enough context. "share their bank data with other parties" What? Who wants to share their what now with whom? Why would they do that? "Fintechs like Plaid, TrueLayer and Tink have founded their businesses on providing access to regulated banking data for a fee.." What data? Aggregated? Individual banking? What regulated data? What regulations? "Under current banking regulation, raw data must be provided for free to consumers via an official application programming interface (or API). As a result, the apps pick up the cost on behalf of their users." What? My bank doesn't offer an API. I have no idea what that last sentance even means. What cost? It really seems like the article assumes a lot of background knowledge. Anybody have an ELI5 link?

damagednoob 5y ago
> What? Who wants to share their what now with whom? Why would they do that? Barclays will send banking data directly to FreeAgent[1] which allows you to categorize the transactions and upload receipts. FreeAgent uses this information to calculate how much VAT and Corporation tax I owe to the government. Couldn't be simpler. [1] https://support.freeagent.com/hc/en-gb/articles/360006470520-How-to-set-up-a-bank-feed https://support.freeagent.com/hc/en-gb/articles/360006470520...
twic 5y ago
This is all about PSD2: https://www.ukfinance.org.uk/guidance/payment-services-directive-2-and-open-banking https://www.ukfinance.org.uk/guidance/payment-services-direc...
rojeee 5y ago
All banks in the EU must offer a data and payments API. The APIs are standardised and must allow third party service providers - which themselves must be regulated - to be able to build services using these APIs. With a user's authorisation, said service provider can view transaction data or initiate a payment, for example. The specific regulation is called "payment services directive 2".
- wrnr 5y ago

default-kramer 5y ago

I wish I could give my banks/FIs a token which allows the bank/FI to just drop my data (like transactions) into my Google Drive in some machine-readable format like CSV. Then I could use an offline tool of my choosing to analyze the data. Why can't it be this simple?

Nextgrid 5y ago
Use a modern bank like Monzo or Starling and they'll allow you to access their API directly without having either an AISP license or using a gatekeeper like TrueLayer.
- samename 5y ago
  For people in the US: Monzo has a waitlist and Starling doesn’t seem available (yet)
- zhte415 5y ago
  I've had a good experience with Monzo (never used Starling, though IIRC there's some history between the two). I'd recommend signing up to the waiting list if you haven't already.

reilly3000 5y ago

I yearn for better personal financial software with things like purchase queues, a simple “should I buy this?” UI, and a way to quickly calculate the downstream effects of financial decisions. Open banking, or at least clean, timely bank data is prerequisite to anything like that, but it’s been elusive for solo devs in the US. The UK and EU is far ahead in that regard.

Havoc 5y ago

Quite surprised to see a sponsored post make the front page of hn. I'm planning to utilize the UK version to aggregate my transactions via a read only interface. That seems relatively safe & think I can wrangle the half a dozen accounts with python into some sort of coherent view. Someone hacked together a bash version of it already: https://gitlab.com/emorrp1/accounts https://gitlab.com/emorrp1/accounts

londons_explore 5y ago

Open banking isn't what it sounds like... You would imagine that with open banking I could write my own code to pay my bills, send out birthday gifts, or pay my employees... I imagine I could enable a trusted third party to automatically switch my bank account from one that earns 0.1% interest to one that earns 1% interest... Or to detect that I was double billed for amazon prime and auto refund one. Or maybe it would let me create temporary bank accounts for a payment (so that I can't be overbilled). Yet it turns out that it's not really more than a csv dump of your statement. It's read only, and has barely any more data than the pdf files available from the bank. Pretty much all you can do with it is draw pretty graphs that anyone could draw in excel in 5 minutes. Oh, and some evil companies demand to have access to your bank statement via openbanking to check if you are 'worthy' of a job/loan/school.

zhte415 5y ago
There are two stages of regulatory licencing. One is the 'read only' as you state. The other allows transaction rules you have set up (or authorised) to be transacted on your behalf, and carries another layer of licence.

nuker 5y ago

The missing bit is IAM. User to create access keys, each key with a policy that allows specific actions. Much like AWS IAM works

film42 5y ago
The Financial Data Exchange (FDX) working group is pushing for this. They have a data spec and UX guides that encourage this exact thing. A user creates an access token for a specific app and that access token might can grant certain abilities to certain bank accounts. It's also adopted by the top US banks (live in production).

contingencies 5y ago

The #1 financial integration feature missing from ~all banks ~everywhere for most users is secure transaction notifications. Granted, this is significantly complicated by cancellation, deferred settlement, bank fees as an externally accounted figure, debit states and failed transactions with rollbacks or associated credits. But just a dumb integration would be enough for many uses and would allow firing a substantial number of accountants. It's not too tongue in cheek to suggest that the whole hosted-accounting world is largely playing off this one feature + pretty graphs. Thoughts on future settlement protocols: https://raw.githubusercontent.com/globalcitizen/ifex-protocol/master/draft-ifex-00.txt https://raw.githubusercontent.com/globalcitizen/ifex-protoco...

rahimnathwani 5y ago

This article is almost incoherent. I'm really surprised to see it rank here. It's useful neither to folks who know about open banking (because they would learn nothing new), nor to people new to open banking (because it doesn't explain even the basics of how it's meant to work). Open banking is meant to allow any third party to get your financial information if you agree, just like any app can implement social auth with Google/Twitter/GitHub. But (pasting a comment I wrote here 2 years ago): "By using Plaid or an Open Banking service from another party (e.g. Experian) you'll pay fees to get information you can get for free if you integrate directly with the banks. Even though the open banking APIs are uniform, any company wishing to use them still has to register with each and every bank, and test the integration works with each one. Until you've done it once, it's hard to know whether it will be easy (you write the code once, and it works flawlessly for all banks) or you have edge cases (e.g. some banks have funny timeout issues). So if you're a developer on a deadline, you will likely prefer to use a single API."

andreskytt 5y ago

The entire PSD2 directive laying the groundwork for open banking is a disaster, IMHO. It seeks to do the right things but then completely ignores identity and authorization as a problem. It kinda matters, which organizations you authorize to access your financial data and how do they know it’s you. All that given the eIDAS directive is in place laying at least groundwork for EU-wide identities. It has a glass ceiling to it: the more popular it gets the more fraud there is going to be the less popular it is.