18 ms·
Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
- version_five 5y agoI'm guessing from this that Canada's banks are upset about getting their grass cut and are looking to regulate new entrants out of business. That's usually what a "made in Canada" solution means.
- jpmoral 5y agoHow so? Giving your banking credentials to a third-party for it to login and screen-scrape is not secure. Mandating that banks provide an API instead for third-party apps to use won't necessarily 'regulate new entrants out of business'.
- neom 5y agoAs a Canadian, I'm strongly in favour of a heavily regulated banking sector[1][2]. The report[3] mostly just describes that banks need to figure out some kinda API that allows me to authorize apps to access everything I could access from the front end. Seems reasonable? The report is good, and the orignal recommendation report from 2019 is also quite good.[4] [1] https://cba.ca/global-banking-regulations-and-banks-in-canada https://cba.ca/global-banking-regulations-and-banks-in-canad... (I realize this is effectively banking regulator propaganda, nevertheless, facts are there) [2] https://www.brookings.edu/research/know-thy-neighbor-what-canada-can-tell-us-about-financial-regulation/ https://www.brookings.edu/research/know-thy-neighbor-what-ca... [3] https://www.canada.ca/en/department-finance/programs/consultations/2021/final-report-advisory-committee-open-banking.html https://www.canada.ca/en/department-finance/programs/consult... [4 ]https://www.canada.ca/en/department-finance/programs/consultations/2019/open-banking/report.html https://www.canada.ca/en/department-finance/programs/consult...
- deleted 5y ago[deleted]
- r00fus 5y agoNope. Canadian gov is just saying users need a way to authorize limited use to my banking data so we can use YNAB and other stuff without resorting to scraping like Plaid or Mint does. Some online banks have setup specific auth codes for these services but most do not. Would be nice to aggregate my data without giving them keys to my kingdom.
- SilverRed 5y agoThe small banks are almost always 10 years ahead of the big banks on apis and open systems.
- llbeansandrice 5y agoI don't know why OAuth tokens aren't the default solution to this. BoA recently added this as an option and it's way more straight forward than giving my login credentials to Personal Capital or, god forbid, Intuit. edit: Of course it helps if the 3rd parties implement it as well. I revoked access to Intuit but Personal Capital only lets me use my userID and password.
- javajosh 5y agoOne reason is that (fintech) implementors get freaked out by OAuth's ~15min window where your token can be revoked but you still have access to the RP. It's an issue but a minor one. The alternative, ad hoc per-request session management, is so much worse in almost every way.
- jon-wood 5y agoThere’s nothing in OAuth that would make that a limitation. Many people decide to issue JWTs without any sort of blacklisting of revoked tokens, but that’s not really a problem with the OAuth spec.
- javajosh 5y ago>blacklisting of revoked tokens Ah, so a blacklist eh? ...Checked by an ad hoc per-request session mechanism perhaps?
- varenc 5y agoIt's been awhile since I've seen it done that way. I think you're referring to the situation where the API servers authenticate you just by checking signature of a timestamped access token and when the token expires the client fetches a new one. For all the OAuth API services I've worked on we'd just look up the access token in the database on each request, so a revoked token becomes useless immediately.
- varenc 5y agoSome speculation: - Banks like locking down your financial data since it makes it more likely you'll continue to uses the auxiliary services they provide. Every bank I've used always has a built in send-money-to-friends and budgeting tool. By locking in your data, they help promote these service. - But mainly, I suspect banks never lose customers because of a lack of an open banking data API. Consumers don't demand it. With no financial incentive, why would they make your data accessible? Also combine that with the increased risk exposure from providing API and it's easy to see why they don't exist. Funnily, I suspect banks tacitly prefer screen scraping solutions like Plaid since it doesn't require the bank create any new product surface area that needs to be audited and secured. No new API endpoints to create. And in the event of a credential breach, it's easy to point the finger at the user who clearly just gave their password over to Plaid.
- barbazoo 5y agoThis sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.
- SevenSigs 5y ago> Tangerine At least they used to have decent interest rates... now what's the point? they don't even have physical banks.
- barbazoo 5y agoOverall it's a pretty good deal, no fee accounts, unlimited etransfers, decent credit card, good customer support, things like that. Back when I was shopping for no fee accounts this was the best deal there was.
- midasuni 5y agoThat’s all standard in the UK, why are US banks so different?
- james_pm 5y agoLow/no fees mostly. A standard bank account at the big banks gives you few Interac transactions, for example, unless you either pay $12.99 a month or have >$3,000 in your account at all times. Tangerine provides unlimited Interac payments on a chequing account with no monthly fee.
- deleted 5y ago[deleted]
- gregsadetsky 5y ago2FA is so seriously lacking here it's not funny. TD Bank has 2FA which has been SMS-based for a very long time, and they just introduced a 2FA app. FYI. But yes on Tangerine (and other banks) being so, so behind. Sending a wire online here is pretty much impossible..!
- jt2190 5y agoFor those outside of Canada: The Canadian banking industry is highly centralized. This looks like a way to keep more nimble upstarts from actually getting started. (Not directly related, but Revolut recently retreated from the Canadian market, for example.)
- version_five 5y agoAgreed. See the replies to my other comment in this thread. Open banking as a concept is a great idea, in Canada it will be a used strategically as a way to limit competition. Edit: I'd be happy to be wrong, you can let me know when Canada sees a flood of great new banking startups in the next couple years
- brailsafe 5y agoYa, but exactly what is your claim here beyond something like regulation kills the free market.
- deleted 5y ago[deleted]
- jonny_eh 5y agoWhat's open banking? What's the context?
- jpmoral 5y agoThird-party apps (e.g. budgeting apps) take users' credentials to login and scrape the screen. Open banking is about banks providing APIs instead.
- SilverRed 5y agoRequiring all banks provide an api to get your data out. The alternative is that 3rd party services ask for your actual bank login details and they log in as you to parse the banks html to get your details out.
- manishsharan 5y agoThis may be driven by TD's suit against Plaid From this source https://www.lexology.com/library/detail.aspx?g=8f56092c-ab40-4ed0-80c6-20a452fcd55d https://www.lexology.com/library/detail.aspx?g=8f56092c-ab40... "Users have complained that after connecting their bank accounts, Plaid stores their credentials and uses them to collect 5 years’ of transactional data and continues to track users’ data in future. Users further claim that the data-gathering scheme is not incidental to Plaid’s business model and is, in fact, its “very purpose.”
- neom 5y agoThis came out of a discovery and recommendation process that has been ongoing since 2018 - https://www.canada.ca/en/department-finance/news/2018/09/minister-morneau-launches-advisory-committee-on-open-banking.html https://www.canada.ca/en/department-finance/news/2018/09/min...
- vesinisa 5y agoHoly smokes, that is shady and scary.
- SilverRed 5y agoIt's not shady, its the explicit purpose of these apps, they collect your transaction data and show you more detailed analysis of it. Since there is no API to safely get the data in a read only way, the only option is to screen scrape the banks website.
- justusthane 5y agoIt is absolutely shady and scary that they store your banking credentials so that they can log in with them. The fact that there isn't a better option doesn't make it any less shady and scary.
- SilverRed 5y agoThey explicitly explain this to the user and apparently even encourage that you instead manually export files and upload them but also provide direct login as a feature. Yes its not perfect security which you may find scary but I struggle to find what about it is shady when they are very open about what happens.
- frosted-flakes 5y agoIt's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow, is there any recourse? Hopefully individuals will be able to use the Open Banking APIs to access their own data directly, but it looks like accreditation will be required, so probably not. Here's the full text of the report: https://www.canada.ca/en/department-finance/programs/consultations/2021/final-report-advisory-committee-open-banking.html https://www.canada.ca/en/department-finance/programs/consult...
- jamespullar 5y agoTo be fair, YNAB is rather explicit about how it connects to your accounts and also actively recommends against doing so in favor of manually entering your transactions. My experience with connecting the two is that I still need to manually validate every transaction because on occasion Plaid is either slow or just misses entries entirely. Also in the case of YNAB, Plaid is not posting transactions on your accounts. It's a screen scraping service transferring account data.
- frosted-flakes 5y agoI manually enter all of my transactions, but for correcting mistakes or for automatic payments, linking to my bank accounts is still very useful. Also, some accounts update faster than others for some reason. Usually YNAB will import them the same day. Plaid doesn't post transactions, but it does have my credentials which I said I would not share with anyone when I opened my bank account. Those credentials do allow posting transactions, and while it's not likely that anything will happen, if something does, I'm theoretically responsible. At the moment, I'm willing to take that risk.
- SilverRed 5y agoI think the future is that banks/bank apps will do the budgeting stuff themselves. Most bank apps will now break down your monthly spending by categories. My bank app shows me my weekly and monthly spend compared to previous periods, how much I spent in each category, how much I spent at each business, how much I have spent this month so far compared to the same time last month and etc.
- diogotozzi 5y agoBrazil started Open Banking at 2019 https://www.bcb.gov.br/en/financialstability/open_banking https://www.bcb.gov.br/en/financialstability/open_banking
- luisrudge 5y agoThe planning is there. The second phase started on august 18th and encompasses sharing your info with different parties (consensually). Next phase is actually hiring services and more interesting stuff.
- ohazi 5y agoTo everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about? I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to upstarts, because right now the only way to be an upstart is to literally ask your customers to violate their bank's terms of service.
- version_five 5y agoI guess you're talking to me. I'm not arguing for screen scraping. I'm stating my experience as a Canadian that our oligopolies use legislation like this as a way to discourage competition, under the guise of helping users. And they rely on people like you to talk about how great it is that we're all getting a made in Canada open banking solution when what we'll really get is something that makes new entry impossible and locks users in to the big 5 banks. Look at our vibrant telecommunications sector for a similar example. Edit: I see this is a losing battle, the comments responding to the parent seem to imply that he is championing open banking against a group that disagree with it. And the replies to me think that I don't want open banking. Enjoy your discussion
- brailsafe 5y agoWouldn't this more or less be a protocol for any bank to implement? How would this lock people in to anything?
- echlebek 5y agoSo to recap, Canada without open banking: 5 big banks, impossible to compete. Canada with open banking: 5 big banks, impossible to compete.
- 1123581321 5y agoI believe he’s saying that adding this flavor of open banking regulation, on top of the others, further entrenches the incumbents, meaning the situation is not identical as future unwinding of these defenses will have more work to do. In addition, the “open banking” would be implemented in a less than ideal way from the perspective of consumers and squander an opportunity to meaningfully improve retail banking and third party retail financial tools. So the situation would not be as patly identical as you present it.
- brailsafe 5y agoNice. Looking forward to 2023.
- kaolinite 5y agoIt’s interesting to me how quickly I’ve soured on the concept of open banking, which on paper sounds fantastic and originally I was very much in favour of. And which I’ve used personally to make it easier to extract my own data for my own use. However more often than not now I’m seeing it used for really invasive applications. Such as when I rented my most recent apartment and they asked to use open banking to verify our finances, which as far as I know would have given them access to every single transaction going back a decade or so. The agent was confused as to why I wouldn’t go ahead with it and ultimately let us opt out, but I do worry that at some point I won’t have much choice but to accept. I’ve also seen credit scoring companies that suggest you’ll get a better credit score if you use open banking to hand over your transactions. I have no need to use that but I suspect others who are desperate to increase their chances of getting a mortgage, etc, won’t have much of a choice.
- phil-martin 5y agoI feel the same. The convenience will likely outweigh the security concerns in the not too distant future. What I would like is some middle step - that instead of allowing open access to accounts, I get to choose how the data is summarised and presented. e.g. just show total income and outgoings, fortnightly, over the last 6 months. Things like that. Yes, I could export the transactions, do some Excel hand waving and make a report, then make a PDF and send it, then they would do data entry into their system summarising what they read. But automating that data sharing step would be fantastic. I am in the process of applying for a home loan at the moment, and the amount of documentation is significant. If I were able to automate 80% of it in a fairly anonymised data way, that would be really useful.
- abraae 5y ago> Such as when I rented my most recent apartment and they asked to use open banking to verify our finances There was a Launch HN recently that did just this, but for people like Uber drivers wanting to borrow money to buy their own car. They handed over their Uber credentials, and the service scraped their Uber history to determine whether they were a good risk or not. I'm not usually into slippery slope arguments but what your landlord asked of you is just that little bit worse than their service (worse as they have access to your bank account, not just your payroll data). I think the moral of the story is that as a provider (Uber, a bank), you should be proactive about providing read-only access to data, removing the need for screen scraping and providing better security to your drivers/customers.
- franga2000 5y agoAs a developer living in a country that has fully implemented "Open Banking", here's a quick setting of expectations for Canadian developers so they don't get too excited as I did when this was first being introduced. Open Banking is not, in fact, open in almost any sense of the world. It is standardised and the standards are freely available ("open"), but other than that, you still need to have an official "blessing" to actually access a production API endpoint (even for your own account), you need a legal entity that has some highly specific and entirely meaningless certificates that are hard (and potentially expensive) to get and even after all of that, you'll still need to negotiate access with each bank individually. What I imagined when I first heard of "Open Banking" was a public OAuth2 endpoint where I can grant my custom script access to just my bank balance and transaction history (possibly with a change webhook) and have it update my finance tracking database. The "open" part is only relevant to the banks, since they don't have to pay royalties for the standard implementing the APIs. For the rest of us, it might as well be SS7.
- jt2190 5y agoWhat country are you in?
- girvo 5y agoWhat they've described is basically exactly the case here in Australia, at least.
- ghostpepper 5y agoAs a Canadian who has been waiting for the hypothetical ideal situation you describe since Mint and YNAB launched in Canada, that is disappointing to hear. Perhaps there will be a startup that can jump through the hoops and then provide some sort of programmability / webhook access to end users.
- fy20 5y agoWhere I am in Europe there are quite a few services that act as gateways, but still the sales process is "talk to us" not just sign up and have instance access. I guess it makes sense in a way, as it would be easy for scammers to use this ("Oh I need to give access to my bank account to view this Facebook post? Oh sure, why not, moar cats plz"). There are also quite a few budgeting apps here that use open banking, so yes I expect those services will migrate to this when it's available in NA. My only complaint is it takes a few days for them to update the data. I have an accounting program (for my business) which uses open banking and also takes a while to update, so maybe it's a "feature" of open banking?
- oliyoung 5y ago2023? Australia's might be finished by then
- celticninja 5y agoThe UK mandated this, possibly the EU also, but it works very well. https://www.openbanking.org.uk/what-is-open-banking/ https://www.openbanking.org.uk/what-is-open-banking/
- phoenixy1 5y agoI have some issues with the wording in this article (I work at Plaid and I don't think everything it says about us is accurate) but the report is a good thing. Right now we really are dependent on screen scraping at many banks and we'd much rather use API-based connections to power our services, but so many banks just don't provide APIs. I'm optimistic for an open banking future in Canada and who knows, maybe even the US some day...
- kashkhan 5y agonot only screen scraping. Plaid also gets around 2FA by asking to forward the bank sms code to them. It happened when i tried using Expensify recently. That is unacceptable and goes against everything I know.
- phoenixy1 5y agoBy "forward" you mean that we ask people to submit a 2FA code during login? YMMV, but I would characterize that as "supporting users who have 2FA enabled" rather than "getting around 2FA". Like I said, I'm looking forward to a world where we don't have to ask for credentials at all, but in the current world, we either support 2FA or we don't, and if we didn't, many people would probably turn off 2FA altogether. At a number of institutions, we actually add a layer of 2FA protection and require a SMS-based code if the institution doesn't prompt the user with its own 2FA.
- canada_dry 5y agoGiven the tech savvy HN user base I'm surprised at all the "I'm surprised these 3rd party services are just impersonating me". I'd love it if there were API's to access my banking data directly, but failing that I rely on the meager "txn download via csv" my Canadian banks offer (at least).
- lostgame 5y agoAs a developer in Canadian Banking, I wonder how this will affect us. I work for a major bank relevant to this story, and I've honestly not heard anything about it internally.
- Helmut10001 5y agoThe Spectre Salt Edge API does the same. I thought I could use this in Firefly III to automcatically pull my banking data, until I found out they are screen scraping. This is a no go. Unfortunately, the official FinTS APIs available by most banks are incredibly flawed, too. Firstly, a lot of information is not available. Secondly, there is no way to have a "read-only" API key/connection. Why is that? I have no idea. There is an Open Banking project in Europe, but it it is far from being ready.
- gigatexal 5y agoThe EU has been moving in this direction with PSD2 and it’s been pretty good. Downside is there’s no defacto standard for APIs and each bank's development skills vary widely.
- rmesters 5y agoIt's true that the 6,000 banks in Europe have different standards, but the fact that the APIs exist and work and that the regulator is enforcing the use of real APIs (as opposed to screen scraping) is worth the effort to integrate each of the banks. I work at Nordigen and we integrated with 1,500+ banks in less than 8 months. Some APIs took hours to integrate, some took a few weeks, but the fact that it was possible at all is IMO gamechanging.
- gigatexal 5y agoYeah. I used to work for a Hamburg based fintech that was one of the first to get its PSD2 license. We still had to fall back to scraping at some points. Perhaps that’s different now.
- rmesters 5y agoThe great think about PSD2 is that it comes with a bunch of laws and regulators are generally good at making banks compliant. An API that's not working is a non-compliant API and banks get it. PSD2 came in to force in Sept, 2019 and 2 years later all the major retail banks in all EEA countries work have fully operational APIs. One major limitation is that PSD2 only regulates access to payment accounts, but doesn't mandate access to credit cards, investment accounts, savings accounts etc. This is why screen scraping (to everyone's dismay) is still used - to "expand" what's possible with real bank APIs.
- skrause 5y agoPSD2 is really bad. It doesn't actually allow you, the customer, to sign in to your banking account using your own application and an API. It only mandates that regulated thirdparty companies can access your banking account using some API. Here in Germany PSD2 was a big step back. Previously we had FinTS (https://en.wikipedia.org/wiki/FinTS https://en.wikipedia.org/wiki/FinTS), an open banking protocol used since the last 90s, and many programs supporting it. Then PSD2 came and broke some use cases of FinTS. Many banks didn't want to both fix FinTS and support new PSD2 APIs, so they just switched off FinTS. Now German bank customers are basically forced to use the banking website because PSD2 doesn't allow them to use an API and the API they had was taken from them by PSD2.
- softveda 5y agoAustralia is building Open Banking (and generically Consumer Data Standards) APIs on GitHub. https://github.com/ConsumerDataStandardsAustralia/standards https://github.com/ConsumerDataStandardsAustralia/standards This is a problem discussed here as well. Generally big banks are advocating getting rid of screen scraping and moving to API but most fintechs are smaller and they don't want to change and there is little appetite from Govt. to force them.
- themantra514 5y agoI built a shopping app with a headless browser 10 years ago. Fun project until any part of a vendor site changed :\
- bacan 5y agoSo glad to see this happening. Screen scraping is unsecure and imo a per account APIkey based solution with a read-only access is the way ahead.