3 ms·

Well, your expectations were clearly wrong. “Open” in this case means open standards and access for accredited entities. Because if you grant access to just a

by Nursie 5y ago

Well, your expectations were clearly wrong. “Open” in this case means open standards and access for accredited entities. Because if you grant access to just anyone, then you’ve created an instant fraudster’s paradise. The legal requirements in the UK (which you may be talking about, unsure) are not meaningless, they are there to ensure that known parties and known good practice are in use. Open Banking the company is working on ways to help small businesses gain accreditation and may already be able to offer assistance, and while accreditation is not free, it’s only a few £k, hardly enough to break the bank. As a non-accredited actor, if you have a limited company you can register as a technical service provider for free and develop your product against the sandbox environment. Oh and you don’t have to negotiate access with each bank either. The whole point is to pre-vet and establish trust ahead of time. That’s as open as anyone with half a brain should want it to be, given what we know about people’s ability to protect their own finances.

pbasista 5y ago
> if you grant access to just anyone, then you’ve created an instant fraudster’s paradise. I believe that everyone might get access to their own data and to performing actions on their own account. Could you clarify how is that supposed to create a fraudsters' paradise?
- Nursie 5y ago
  Yep, the moment you allow that sort of access people will let the arseholes in one way or another, because people in general don't have a clue about what permissions should be given to people who call up claiming to be, for instance, from the tax office. Even read only, fraudsters will find ways to exfiltrate private data that's useful for identity theft, blackmail or any number of criminal acts. People are not security-savvy enough to be given this access safely. You might be, my parents and millions like them aren't.
  - pbasista 5y ago
    Getting access to a regular web app would be sufficient to perform that kind of abuse. It just would be more difficult to automate. It seems to me that the difficulty of getting the victim to grant access to the attacker remains the same for both the web app access and the API access. The advantage for the attacker of getting the API access is that they can more easily automate the performing of subtle frauds over a longer period of time, thereby avoiding the detection. But a determined attacker can automate that via the web app as well. That is why it seems to me that the difference in fraud capabilities over both channels is, in principle, negligible.
    - Nursie 5y ago
      Yes, making attacks more difficult is often the point of security. Further, with an accredited intermediary, they have more responsibility to ensure their stuff isn’t compromised, and to stick to good practice. With free for all API access the world is wide open to fraud.

by Nursie 5y ago

pbasista 5y ago

> if you grant access to just anyone, then you’ve created an instant fraudster’s paradise. I believe that everyone might get access to their own data and to performing actions on their own account. Could you clarify how is that supposed to create a fraudsters' paradise?

Nursie 5y ago
Yep, the moment you allow that sort of access people will let the arseholes in one way or another, because people in general don't have a clue about what permissions should be given to people who call up claiming to be, for instance, from the tax office. Even read only, fraudsters will find ways to exfiltrate private data that's useful for identity theft, blackmail or any number of criminal acts. People are not security-savvy enough to be given this access safely. You might be, my parents and millions like them aren't.
- pbasista 5y ago
  Getting access to a regular web app would be sufficient to perform that kind of abuse. It just would be more difficult to automate. It seems to me that the difficulty of getting the victim to grant access to the attacker remains the same for both the web app access and the API access. The advantage for the attacker of getting the API access is that they can more easily automate the performing of subtle frauds over a longer period of time, thereby avoiding the detection. But a determined attacker can automate that via the web app as well. That is why it seems to me that the difference in fraud capabilities over both channels is, in principle, negligible.
  - Nursie 5y ago
    Yes, making attacks more difficult is often the point of security. Further, with an accredited intermediary, they have more responsibility to ensure their stuff isn’t compromised, and to stick to good practice. With free for all API access the world is wide open to fraud.