5 ms·

There's a huge difference between supplying an account number and giving a service the login credentials for your bank account. As far as I can remember, PayPa

There's a huge difference between supplying an account number and giving a service the login credentials for your bank account. As far as I can remember, PayPal has never asked me for my bank account login details.

Retric 14y ago
Looks like Paypal will also asks for your bank username and password for instant verification and has the same fallback option of 2 Random deposits. http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/1235839118.html http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/12... PS: That or that blog's part of a great phishing scam.
- saraid216 14y ago
  > Looks like Paypal will also asks for your bank username and password for instant verification and has the same fallback option of 2 Random deposits. That has not been my experience; the 2 random deposits are the first option, not the last resort. Paypal has never asked me for a user/pass.
- drivebyacct2 14y ago
  What the hell? Seriously, what. Why? Why not use a token? Oh if only there were already protocols written to handle identity and access auth.
  - seandougall 14y ago
    On the financial system's technological timeline, those protocols won't happen for another 20-30 years yet.
nym 14y ago
So, I originally signed up with a local bank, which takes 2-3 days (unfortunately). This is the same model that Paypal follows. Since there is clearly a demand for buying bitcoins _quickly_, I believe Brian is providing both a good UX for those who want to just use their account / routing numbers, while also allowing people to get bitcoins in LESS THAN 10 MINUTES (I bought 1BTC today with coinbase / wells fargo). I should note that Mint did the same thing in order to get access to transaction history, and they had 5 million registered users as of 2011 (source: http://qr.ae/8QB9G http://qr.ae/8QB9G). If the big banks addressed the need for APIs, startups like Mint and Coinbase could do this in a more sane way, but we're talking about big banks, and in the case of Wells Fargo they actually charge users a monthly fee for using Quicken to talk to their backend. tl;dr- Mint asked users for bank passwords and got 5 million registrations. Likewise, Coinbase is just providing a "quick" ux path for the people who want to act quickly.
- tptacek 14y ago
  Mint was a read-only consumer of banking information. Nevertheless, the access Mint required from banks was so unusual that they were written up all over the news media for doing that, and apparently operated their own secure data center to hold that information. Further, Mint attested to doing quarterly external audits. I'm not trying to militate against using Coinbase; I'm just saying, Coinbase and Mint aren't directly comparable for more than one reason.
  - MatthewElvey 14y ago
    "Mint attested to doing quarterly external audits?" Really? It seems they didn't, or at least I can't find evidence or mention of it, and Mint support doesn't know about it. A Hackersafe pen test is not a security audit. A public company SEC-required annual audit is not a security audit either. There is no audit if there is no public audit statement from the auditor. Without one, whatever security measures were taken cannot be called an audit. Perhaps some reporters (like the ones that reported on the WMD-based justification for going to war against Iraq) didn't do their jobs properly.
    - deleted 14y ago
      [deleted]

Retric 14y ago

Looks like Paypal will also asks for your bank username and password for instant verification and has the same fallback option of 2 Random deposits. http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/1235839118.html http://www.ecommercebytes.com/C/abblog/blog.pl?/pl/2009/2/12... PS: That or that blog's part of a great phishing scam.

saraid216 14y ago
> Looks like Paypal will also asks for your bank username and password for instant verification and has the same fallback option of 2 Random deposits. That has not been my experience; the 2 random deposits are the first option, not the last resort. Paypal has never asked me for a user/pass.
drivebyacct2 14y ago
What the hell? Seriously, what. Why? Why not use a token? Oh if only there were already protocols written to handle identity and access auth.
- seandougall 14y ago
  On the financial system's technological timeline, those protocols won't happen for another 20-30 years yet.

nym 14y ago

So, I originally signed up with a local bank, which takes 2-3 days (unfortunately). This is the same model that Paypal follows. Since there is clearly a demand for buying bitcoins _quickly_, I believe Brian is providing both a good UX for those who want to just use their account / routing numbers, while also allowing people to get bitcoins in LESS THAN 10 MINUTES (I bought 1BTC today with coinbase / wells fargo). I should note that Mint did the same thing in order to get access to transaction history, and they had 5 million registered users as of 2011 (source: http://qr.ae/8QB9G http://qr.ae/8QB9G). If the big banks addressed the need for APIs, startups like Mint and Coinbase could do this in a more sane way, but we're talking about big banks, and in the case of Wells Fargo they actually charge users a monthly fee for using Quicken to talk to their backend. tl;dr- Mint asked users for bank passwords and got 5 million registrations. Likewise, Coinbase is just providing a "quick" ux path for the people who want to act quickly.

tptacek 14y ago
Mint was a read-only consumer of banking information. Nevertheless, the access Mint required from banks was so unusual that they were written up all over the news media for doing that, and apparently operated their own secure data center to hold that information. Further, Mint attested to doing quarterly external audits. I'm not trying to militate against using Coinbase; I'm just saying, Coinbase and Mint aren't directly comparable for more than one reason.
- MatthewElvey 14y ago
  "Mint attested to doing quarterly external audits?" Really? It seems they didn't, or at least I can't find evidence or mention of it, and Mint support doesn't know about it. A Hackersafe pen test is not a security audit. A public company SEC-required annual audit is not a security audit either. There is no audit if there is no public audit statement from the auditor. Without one, whatever security measures were taken cannot be called an audit. Perhaps some reporters (like the ones that reported on the WMD-based justification for going to war against Iraq) didn't do their jobs properly.
  - deleted 14y ago
    [deleted]