4 ms·

If you find this interesting you may find the work Knox is doing pretty cool - we're able to verify funds before we make payments (so there no NSFs), get and ve

If you find this interesting you may find the work Knox is doing pretty cool - we're able to verify funds before we make payments (so there no NSFs), get and verify account numbers without asking for the user to tell us them, and verify the identity of the payor all in one step - we just have them log into their online banking (like you do with Mint or Yodlee except faster). We've never had an ACH file returned ever, and all our payments are 100% guaranteed against everything but chargebacks as soon as they're made. It takes away just about all these problems. We don't store usernames or passwords so there's no fraud risk there, but it does require some trust from the user to do something they're not used to, but it's super fast and easy for the user. I hope we can help solve some of these problems for developers! (Plus it's only $0.18 a payment). If you want to try it you can donate to some cool non-profits using Knox on thesimpledifference.com - all three are worthy causes, but I think y'all will find HackCville particularly interesting. A note: the payment happens in an iFrame that is SSL secured, but thesimpledifference.com does not have SSL (currently pending). It doesn't matter really, but I know that can feel odd and 100% understand if that's offputting. Let me know if anyone has any questions!

richardwhiuk 12y ago
You should fix the lack of SSL security on thesimpledifference.com Why? iFrame SSL certificates aren't visible, and no, your VeriSign trusted doesn't count. This means users will find it offputting as you note. Why else? Someone could hijack the HTTP page and point the iframe location somewhere else where they then intercept bank details. Next knox only seems to support a limited number of banks, unlike ACH which I'm assuming supports alll banks. Finally 'log into their online banking' worries me. I'd never hand over my online banking details to a third party (I suspect doing so would violate the T&Cs on my account!).
- tomasien 12y ago
  Agreed on the SSL bit - we ask all our businesses to use it but we didn't put it on our test site. That's embarrassing I'm putting it up now. And yes, we serve the 30 banks that constitute 60% of banking volume in the US, and at least 60% of banking customers (although we suspect more, since many people who have a smaller account have a top 30 account too). We're increasing that number, but you can turn our system on so that when we don't integrate, you can still send account number and we do ACH the traditional way. As for you not wanting to login to your online banking - you may be right! You may never do it. However, I've heard that before from a lot of people who turn right around and use Knox 30 seconds later and then become customers - so I hope you're in that group! There are some people who will be cautious, but it's actually smaller % of people than I initially thought it would be.
  - napoleond 12y ago
    I don't have a US bank account so this doesn't affect me, but just speaking as "Joe Consumer" you may want to address parent's point about the bank's T&C, since that was the only part of his comment that jumped out at me and the only part you didn't address.
    - tomasien 12y ago
      It doesn't. Thank you for pointing that out. Mint did a lot of the work for us here to be honest, they made it really easy to get this stuff out of the way.
- tomasien 12y ago
  SSL is fixed on https://thesimpledifference.com https://thesimpledifference.com - don't have htaccess redirecting although I put the rule in. But ssl is up!
  - ersii 12y ago
    I would recommend running both https://thesimpledifference.com https://thesimpledifference.com and https://knoxpayments.com https://knoxpayments.com through Qualys excellent SSL Server Test at https://www.ssllabs.com/ssltest/index.html https://www.ssllabs.com/ssltest/index.html when you got a spare moment over. I would recommend configuring support for "Forward Secrecy" on both sites and enabling TLS 1.2 on thesimpledifference.com. Current score on both domains is "C".
    - tomasien 12y ago
      Great idea!
edawerd 12y ago
I'm curious, if you don't store usernames and passwords for banking credentials, how do know if the ACH transfer will NSF? Do you ask the account holder for their bank credentials each time you want to pull money from their account?
- tomasien 12y ago
  No - so we risk rate for recurring payments and get a bunch of info from online banking that helps us determine how large of a recurring payment and at what interval we can allow. We've never been wrong, but we will be someday I'm sure. Recurring payments right now are not fully guaranteed against NSF risk only the first one and all one time payments. So for ZenPayroll I suppose that's particularly relevant. Someday we hope to offer stored usernames and passwords as a service (making it super clear to the user that it's being authorized) but for now we only have really good security people - not "best in the world" people who would make me comfortable doing that.
  - simoncion 12y ago
    > Someday we hope to offer stored usernames and passwords as a service... Usernames and passwords are generally an all-or-nothing proposition, and will be for the foreseeable future. Is getting major banks to adopt a application-specific-password scheme [0] (maybe even with maybe-fine-grained permissions!) such a lost cause that it makes what you're proposing a vaguely reasonable thing to do? [0] https://support.google.com/accounts/answer/185833?rd=1 https://support.google.com/accounts/answer/185833?rd=1
- us0r 12y ago
  Basically scrape the account. Avg daily balance is probably the primary number. Low balance, high balance, NSFs, etc.
  - tomasien 12y ago
    Pretty close! We're not scraping anything which I'll clarify more for the connotation that this is web scraping - it's not.
pfg 12y ago
There's a payment provider doing something similar called "Sofortüberweisung" (translates to "instant (bank) transfer"). It is pretty popular in Germany, AFAIK they only support banks from Germany (and maybe some neighbouring countries). They go a step further and actually transfer the funds from your bank account via Online banking after you provide them with your login and TAN. Quite scary to be honest, to me at least. It's basically a scraper/bot that initiates the transfer for you, pretending to be you, without the bank's knowledge. While forwarding your login information and TANs to third parties is by most banks considered a violation of their ToS, they don't seem to be willing to do anything about it (probably because of Sofortüberweisung's popularity with their customers).
- tomasien 12y ago
  We initiate the transfer as well. It doesn't violate any of the banks we support's TOS. We're also not web scraping.
  - pfg 12y ago
    Sorry, edited my comment a bit to clarify. If I understood correctly, you use the login to verify the account information and to check whether funds are available. The transfer is initiated via ACH. Sofortüberweisung doesn't use ACH (or SEPA), they actually transfer the money via Online banking using a bot pretending to be the account owner.
    - tomasien 12y ago
      OHHHH that's messed up. Wow! That's a really weird thing to do, but the fact that it's popular anyway really says a lot. Still though - wow.
      - mike_hearn 12y ago
        It's popular because SEPA transfers are really cheap, compared to paying with credit cards. Last time I paid with SOFORT I noticed that they hadn't committed the wire transfer. KLM issued me with my flight tickets, but the wire transfer was sitting in the outbox and could have been cancelled. Not sure what happens if I cancel a payment like that - does the merchant get notified and cancel the flight tickets too?
tomasien 12y ago
Anybody who made a donation or started a donation on thesimpledifference and has feedback about UX (or otherwise) issues they had and could email me at tommy at knoxpayments dot com I would just love to hear from you so much you have no idea.

richardwhiuk 12y ago

You should fix the lack of SSL security on thesimpledifference.com Why? iFrame SSL certificates aren't visible, and no, your VeriSign trusted doesn't count. This means users will find it offputting as you note. Why else? Someone could hijack the HTTP page and point the iframe location somewhere else where they then intercept bank details. Next knox only seems to support a limited number of banks, unlike ACH which I'm assuming supports alll banks. Finally 'log into their online banking' worries me. I'd never hand over my online banking details to a third party (I suspect doing so would violate the T&Cs on my account!).

tomasien 12y ago
Agreed on the SSL bit - we ask all our businesses to use it but we didn't put it on our test site. That's embarrassing I'm putting it up now. And yes, we serve the 30 banks that constitute 60% of banking volume in the US, and at least 60% of banking customers (although we suspect more, since many people who have a smaller account have a top 30 account too). We're increasing that number, but you can turn our system on so that when we don't integrate, you can still send account number and we do ACH the traditional way. As for you not wanting to login to your online banking - you may be right! You may never do it. However, I've heard that before from a lot of people who turn right around and use Knox 30 seconds later and then become customers - so I hope you're in that group! There are some people who will be cautious, but it's actually smaller % of people than I initially thought it would be.
- napoleond 12y ago
  I don't have a US bank account so this doesn't affect me, but just speaking as "Joe Consumer" you may want to address parent's point about the bank's T&C, since that was the only part of his comment that jumped out at me and the only part you didn't address.
  - tomasien 12y ago
    It doesn't. Thank you for pointing that out. Mint did a lot of the work for us here to be honest, they made it really easy to get this stuff out of the way.
tomasien 12y ago
SSL is fixed on https://thesimpledifference.com https://thesimpledifference.com - don't have htaccess redirecting although I put the rule in. But ssl is up!
- ersii 12y ago
  I would recommend running both https://thesimpledifference.com https://thesimpledifference.com and https://knoxpayments.com https://knoxpayments.com through Qualys excellent SSL Server Test at https://www.ssllabs.com/ssltest/index.html https://www.ssllabs.com/ssltest/index.html when you got a spare moment over. I would recommend configuring support for "Forward Secrecy" on both sites and enabling TLS 1.2 on thesimpledifference.com. Current score on both domains is "C".
  - tomasien 12y ago
    Great idea!

edawerd 12y ago

I'm curious, if you don't store usernames and passwords for banking credentials, how do know if the ACH transfer will NSF? Do you ask the account holder for their bank credentials each time you want to pull money from their account?

tomasien 12y ago
No - so we risk rate for recurring payments and get a bunch of info from online banking that helps us determine how large of a recurring payment and at what interval we can allow. We've never been wrong, but we will be someday I'm sure. Recurring payments right now are not fully guaranteed against NSF risk only the first one and all one time payments. So for ZenPayroll I suppose that's particularly relevant. Someday we hope to offer stored usernames and passwords as a service (making it super clear to the user that it's being authorized) but for now we only have really good security people - not "best in the world" people who would make me comfortable doing that.
- simoncion 12y ago
  > Someday we hope to offer stored usernames and passwords as a service... Usernames and passwords are generally an all-or-nothing proposition, and will be for the foreseeable future. Is getting major banks to adopt a application-specific-password scheme [0] (maybe even with maybe-fine-grained permissions!) such a lost cause that it makes what you're proposing a vaguely reasonable thing to do? [0] https://support.google.com/accounts/answer/185833?rd=1 https://support.google.com/accounts/answer/185833?rd=1
us0r 12y ago
Basically scrape the account. Avg daily balance is probably the primary number. Low balance, high balance, NSFs, etc.
- tomasien 12y ago
  Pretty close! We're not scraping anything which I'll clarify more for the connotation that this is web scraping - it's not.

pfg 12y ago

There's a payment provider doing something similar called "Sofortüberweisung" (translates to "instant (bank) transfer"). It is pretty popular in Germany, AFAIK they only support banks from Germany (and maybe some neighbouring countries). They go a step further and actually transfer the funds from your bank account via Online banking after you provide them with your login and TAN. Quite scary to be honest, to me at least. It's basically a scraper/bot that initiates the transfer for you, pretending to be you, without the bank's knowledge. While forwarding your login information and TANs to third parties is by most banks considered a violation of their ToS, they don't seem to be willing to do anything about it (probably because of Sofortüberweisung's popularity with their customers).

tomasien 12y ago
We initiate the transfer as well. It doesn't violate any of the banks we support's TOS. We're also not web scraping.
- pfg 12y ago
  Sorry, edited my comment a bit to clarify. If I understood correctly, you use the login to verify the account information and to check whether funds are available. The transfer is initiated via ACH. Sofortüberweisung doesn't use ACH (or SEPA), they actually transfer the money via Online banking using a bot pretending to be the account owner.
  - tomasien 12y ago
    OHHHH that's messed up. Wow! That's a really weird thing to do, but the fact that it's popular anyway really says a lot. Still though - wow.
    - mike_hearn 12y ago
      It's popular because SEPA transfers are really cheap, compared to paying with credit cards. Last time I paid with SOFORT I noticed that they hadn't committed the wire transfer. KLM issued me with my flight tickets, but the wire transfer was sitting in the outbox and could have been cancelled. Not sure what happens if I cancel a payment like that - does the merchant get notified and cancel the flight tickets too?

tomasien 12y ago

Anybody who made a donation or started a donation on thesimpledifference and has feedback about UX (or otherwise) issues they had and could email me at tommy at knoxpayments dot com I would just love to hear from you so much you have no idea.