10 ms·

That's what I was wondering. It's a ton of work, but would love the auto importing / screen scraping features that Mint.com had. For a local desktop tool it eve

That's what I was wondering. It's a ton of work, but would love the auto importing / screen scraping features that Mint.com had. For a local desktop tool it even has the potential to support every possible service because they can't do IP blocking on end-users (versus the server-to-server model that Mint.com had, caused many services to IP block Mint's servers). Unfortunately, depending on an open-source tool to do this is a double edged sword if it had these features, because we would be opening the risk of supply-chain attacks -- malicious actors getting commits into the repository code which cause the program to send your data elsewhere -- or worse, deplete accounts' funds.

diggan 2y ago
> but would love the auto importing / screen scraping features that Mint.com had I never used it, but didn't that ask you for the username/password in order to do its job? If so, I wouldn't touch it with a ten-foot pole. > cause the program to send your data elsewhere -- or worse, deplete accounts' funds. Again, seemingly because their shitty architecture would that even be possible. There are modern (possibly only European?) standards nowadays that forces the banks to expose proper APIs for doing things like that. Would require a business entity to deploy to production (I think that's one of the requirements?) but otherwise wouldn't be a huge task compared to manually scraping stuff.
- nightski 2y ago
  Some banks allow you to create separate limited read only credentials at least that can be revoked at any time. But not all of them allow this.
  - al_borland 2y ago
    I used Every Dollar for budgeting for a while. It seemed mixed. Some banks used auth through the bank that would create a token for the site/app, which could be revoked through my account when the bank. Others used a 3rd party service which required the user enter their bank creds, and seemingly trust them. I was in the market for a new bank, so I ended up coming up with my short list of banks I’d look at moving to, then went to Every Dollar to try adding accounts to see what kind of prompt I was met with. Anything that required the 3rd party to store my creds was out of the running. I ended up ending a 20+ year relationship with a bank of this. There were other things too, but this was the straw that got me to actually cut ties. I assume Mint was similar. I used it a long time ago, probably when I was more trusting in my youth.
- j-a-a-p 2y ago
  I suppose you mean PSD2. That is mandatory for EU banks that do payments. I don't think your stock and crypto trading services need to comply.
jfdjkfdhjds 2y ago
only if there were regulations for consumer banking having the bare minimum for application security as is for everything else banks themselves depend on.
mulmen 2y ago
> Unfortunately, depending on an open-source tool to do this is a double edged sword if it had these features, because we would be opening the risk of supply-chain attacks -- malicious actors getting commits into the repository code which cause the program to send your data elsewhere -- or worse, deplete accounts' funds. This is FUD. You’re describing open-commit, which I don’t think anyone does. Open source is not more susceptible to supply chain attacks than closed source software.

diggan 2y ago

> but would love the auto importing / screen scraping features that Mint.com had I never used it, but didn't that ask you for the username/password in order to do its job? If so, I wouldn't touch it with a ten-foot pole. > cause the program to send your data elsewhere -- or worse, deplete accounts' funds. Again, seemingly because their shitty architecture would that even be possible. There are modern (possibly only European?) standards nowadays that forces the banks to expose proper APIs for doing things like that. Would require a business entity to deploy to production (I think that's one of the requirements?) but otherwise wouldn't be a huge task compared to manually scraping stuff.

nightski 2y ago
Some banks allow you to create separate limited read only credentials at least that can be revoked at any time. But not all of them allow this.
- al_borland 2y ago
  I used Every Dollar for budgeting for a while. It seemed mixed. Some banks used auth through the bank that would create a token for the site/app, which could be revoked through my account when the bank. Others used a 3rd party service which required the user enter their bank creds, and seemingly trust them. I was in the market for a new bank, so I ended up coming up with my short list of banks I’d look at moving to, then went to Every Dollar to try adding accounts to see what kind of prompt I was met with. Anything that required the 3rd party to store my creds was out of the running. I ended up ending a 20+ year relationship with a bank of this. There were other things too, but this was the straw that got me to actually cut ties. I assume Mint was similar. I used it a long time ago, probably when I was more trusting in my youth.
j-a-a-p 2y ago
I suppose you mean PSD2. That is mandatory for EU banks that do payments. I don't think your stock and crypto trading services need to comply.

jfdjkfdhjds 2y ago

only if there were regulations for consumer banking having the bare minimum for application security as is for everything else banks themselves depend on.

mulmen 2y ago

> Unfortunately, depending on an open-source tool to do this is a double edged sword if it had these features, because we would be opening the risk of supply-chain attacks -- malicious actors getting commits into the repository code which cause the program to send your data elsewhere -- or worse, deplete accounts' funds. This is FUD. You’re describing open-commit, which I don’t think anyone does. Open source is not more susceptible to supply chain attacks than closed source software.