4 ms·

> Rate limiting per user is mostly a thing of the past Someone please tell this to fidelity. After 3 wrong password attempts they lock your account.

dpkirchner 3y ago
And they convert usernames to sets of digits so they can be entered more easily on phones. Naturally this results in a lot of collisions.
k8svet 3y ago
Fidelity are clowns. They've spent an impressive effort breaking every god damn third party integration AND using Akamai to block scraping. I can scrape Ameriprise fine, but no matter how creative I get Fidelity gives back a weird error on login. (This is on top of them not sending any actionable email when changing my contributions to 0 in between pay periods) I'm rolling my 401k out as often and fast as possible. I hate American banks so much.
- mananaysiempre 3y ago
  > us[e] Akamai to block scraping Would https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate help? Haven’t tried with Akamai, but did help with another widely used CDN that shall remain unnamed (but has successfully infused me with burning hate for their products after a couple of years’ worth of using an always-on VPN to bypass Internet censorship and/or a slightly unusual browser).
  - k8svet 3y ago
    I'm using this to fill forms interactively and emulate a user. https://github.com/rust-headless-chrome/rust-headless-chrome https://github.com/rust-headless-chrome/rust-headless-chrome Afaict, it drives a stock Chromium instance. I'm not sure how Fidelity is detecting it, but they detect it even in normal headful mode. Idk if there's some JS that notices there's no mouse-move movements. It's just not worth the headache. I despise bending over backwards for companies like this. But obviously I have no choice since they're my 401k plan facilitator.
- ryandrake 3y ago
  > Fidelity are clowns. They've spent an impressive effort breaking every god damn third party integration AND using Akamai to block scraping. What’s funny/sad is they probably pat themselves on their back thinking their security is so advanced and awesome. Financial services web integrations are all total clown shows.
  - EasyMark 3y ago
    but can't you buy API access? I would assume that's more of a business decision to promote paid for API access, rather than "security" against scraping.

dpkirchner 3y ago

And they convert usernames to sets of digits so they can be entered more easily on phones. Naturally this results in a lot of collisions.

k8svet 3y ago

Fidelity are clowns. They've spent an impressive effort breaking every god damn third party integration AND using Akamai to block scraping. I can scrape Ameriprise fine, but no matter how creative I get Fidelity gives back a weird error on login. (This is on top of them not sending any actionable email when changing my contributions to 0 in between pay periods) I'm rolling my 401k out as often and fast as possible. I hate American banks so much.

mananaysiempre 3y ago
> us[e] Akamai to block scraping Would https://github.com/lwthiker/curl-impersonate https://github.com/lwthiker/curl-impersonate help? Haven’t tried with Akamai, but did help with another widely used CDN that shall remain unnamed (but has successfully infused me with burning hate for their products after a couple of years’ worth of using an always-on VPN to bypass Internet censorship and/or a slightly unusual browser).
- k8svet 3y ago
  I'm using this to fill forms interactively and emulate a user. https://github.com/rust-headless-chrome/rust-headless-chrome https://github.com/rust-headless-chrome/rust-headless-chrome Afaict, it drives a stock Chromium instance. I'm not sure how Fidelity is detecting it, but they detect it even in normal headful mode. Idk if there's some JS that notices there's no mouse-move movements. It's just not worth the headache. I despise bending over backwards for companies like this. But obviously I have no choice since they're my 401k plan facilitator.
ryandrake 3y ago
> Fidelity are clowns. They've spent an impressive effort breaking every god damn third party integration AND using Akamai to block scraping. What’s funny/sad is they probably pat themselves on their back thinking their security is so advanced and awesome. Financial services web integrations are all total clown shows.
- EasyMark 3y ago
  but can't you buy API access? I would assume that's more of a business decision to promote paid for API access, rather than "security" against scraping.