7 ms·

I don't know why OAuth tokens aren't the default solution to this. BoA recently added this as an option and it's way more straight forward than giving my login

I don't know why OAuth tokens aren't the default solution to this. BoA recently added this as an option and it's way more straight forward than giving my login credentials to Personal Capital or, god forbid, Intuit. edit: Of course it helps if the 3rd parties implement it as well. I revoked access to Intuit but Personal Capital only lets me use my userID and password.

javajosh 5y ago
One reason is that (fintech) implementors get freaked out by OAuth's ~15min window where your token can be revoked but you still have access to the RP. It's an issue but a minor one. The alternative, ad hoc per-request session management, is so much worse in almost every way.
- jon-wood 5y ago
  There’s nothing in OAuth that would make that a limitation. Many people decide to issue JWTs without any sort of blacklisting of revoked tokens, but that’s not really a problem with the OAuth spec.
  - javajosh 5y ago
    >blacklisting of revoked tokens Ah, so a blacklist eh? ...Checked by an ad hoc per-request session mechanism perhaps?
- varenc 5y ago
  It's been awhile since I've seen it done that way. I think you're referring to the situation where the API servers authenticate you just by checking signature of a timestamped access token and when the token expires the client fetches a new one. For all the OAuth API services I've worked on we'd just look up the access token in the database on each request, so a revoked token becomes useless immediately.
varenc 5y ago
Some speculation: - Banks like locking down your financial data since it makes it more likely you'll continue to uses the auxiliary services they provide. Every bank I've used always has a built in send-money-to-friends and budgeting tool. By locking in your data, they help promote these service. - But mainly, I suspect banks never lose customers because of a lack of an open banking data API. Consumers don't demand it. With no financial incentive, why would they make your data accessible? Also combine that with the increased risk exposure from providing API and it's easy to see why they don't exist. Funnily, I suspect banks tacitly prefer screen scraping solutions like Plaid since it doesn't require the bank create any new product surface area that needs to be audited and secured. No new API endpoints to create. And in the event of a credential breach, it's easy to point the finger at the user who clearly just gave their password over to Plaid.

javajosh 5y ago

One reason is that (fintech) implementors get freaked out by OAuth's ~15min window where your token can be revoked but you still have access to the RP. It's an issue but a minor one. The alternative, ad hoc per-request session management, is so much worse in almost every way.

jon-wood 5y ago
There’s nothing in OAuth that would make that a limitation. Many people decide to issue JWTs without any sort of blacklisting of revoked tokens, but that’s not really a problem with the OAuth spec.
- javajosh 5y ago
  >blacklisting of revoked tokens Ah, so a blacklist eh? ...Checked by an ad hoc per-request session mechanism perhaps?
varenc 5y ago
It's been awhile since I've seen it done that way. I think you're referring to the situation where the API servers authenticate you just by checking signature of a timestamped access token and when the token expires the client fetches a new one. For all the OAuth API services I've worked on we'd just look up the access token in the database on each request, so a revoked token becomes useless immediately.

varenc 5y ago

Some speculation: - Banks like locking down your financial data since it makes it more likely you'll continue to uses the auxiliary services they provide. Every bank I've used always has a built in send-money-to-friends and budgeting tool. By locking in your data, they help promote these service. - But mainly, I suspect banks never lose customers because of a lack of an open banking data API. Consumers don't demand it. With no financial incentive, why would they make your data accessible? Also combine that with the increased risk exposure from providing API and it's easy to see why they don't exist. Funnily, I suspect banks tacitly prefer screen scraping solutions like Plaid since it doesn't require the bank create any new product surface area that needs to be audited and secured. No new API endpoints to create. And in the event of a credential breach, it's easy to point the finger at the user who clearly just gave their password over to Plaid.