3 ms·

That's how I must sound when I talk about something I really care about, but that people generally haven't heard about, like ever. And if they had, they wouldn'

by palata 9mo ago

That's how I must sound when I talk about something I really care about, but that people generally haven't heard about, like ever. And if they had, they wouldn't care. I guess I am not the target for the post, but it picked my curiosity. So "Open Banking" is... what? The hope that some banks would offer an open API to log in and... read data? So that one could write an app that pulls your banking data and does stuff with it? I guess a bank would never take the risk to offer an API that would be able to "write", as in initiate transactions, right? But even offering an open API to read the banking data in a third-party app... isn't that super risky? If someone told me "I found this great app, I just need to let it log itself into my bank" I would interrupt them and start screaming before the end of the sentence, I think... Or am I completely missing the point of the article?

iamnothere 9mo ago
It should be possible to use open source software to retrieve financial data to help with taxes, budgeting, record-keeping, etc. Or for companies to automate their own financial infrastructure without involving middlemen. I am less concerned about the potential for abuse here than I am concerned about middlemen like Plaid having all my data.
lemonaise 9mo ago
I was also surprised when I was researching - it is actually the standard for modern fintech companies (with PSD2 in Europe and the CMA Order in the UK). Regarding "write" access: It absolutely exists. Crazy right? Look up PISP (Payment Initiation). It allows apps to push payments, not just read balances (which is called AISP and is what I am trying to do). I guess they allow this the security model isn't "letting an app log in to your bank", it uses OAuth flows where you authenticate directly with the bank (often using something that they call Strong Customer Authentication), and the bank issues a restricted token to the app for only the specific things it's permitted to use. That's why they required the apps to have such high security standards. I assume it was just too costly and risky to run?

by palata 9mo ago

iamnothere 9mo ago

It should be possible to use open source software to retrieve financial data to help with taxes, budgeting, record-keeping, etc. Or for companies to automate their own financial infrastructure without involving middlemen. I am less concerned about the potential for abuse here than I am concerned about middlemen like Plaid having all my data.

lemonaise 9mo ago

I was also surprised when I was researching - it is actually the standard for modern fintech companies (with PSD2 in Europe and the CMA Order in the UK). Regarding "write" access: It absolutely exists. Crazy right? Look up PISP (Payment Initiation). It allows apps to push payments, not just read balances (which is called AISP and is what I am trying to do). I guess they allow this the security model isn't "letting an app log in to your bank", it uses OAuth flows where you authenticate directly with the bank (often using something that they call Strong Customer Authentication), and the bank issues a restricted token to the app for only the specific things it's permitted to use. That's why they required the apps to have such high security standards. I assume it was just too costly and risky to run?