Forced SSL isn't a bad idea, nor is it hard. Many banks already do this. Most banks already offer an API, in the form of OFX. The security measures (like chall

Forced SSL isn't a bad idea, nor is it hard. Many banks already do this. Most banks already offer an API, in the form of OFX. The security measures (like challenge questions) are already circumvented, and I've seen some really bad security flaws in OFX implementations when I last played around. e.g., inter-customer money transfers without requiring anything but the password, no auth lockout making brute-forcing possible, ability to crash the OFX gateway, &c. (Yes, the newer OFX standards support multi-factor authentication, but I don't know of a single bank that uses the newer version.) Also, most FIs hate the idea of financial aggregation, being worried about other companies cross-selling to their customers. A sane REST API would be a wonderful step in the right direction, but I doubt it'll happen in the next ten years on a large-scale. Getting OFX to where it stands now took the combined market forces of Intuit and Microsoft many years, and didn't turn out well.