Because they use OFX for read-only transactions and an HSM to store the passwords:
http://money.stackexchange.com/questions/15392/are-there-any...
Ask HN: Why would people trust their banking credentials to a service like Mint?
11–20 of 62 posts
Re: Ask HN: Why would people trust their banking credentials to a service like Mint?
#12If I remember correctly, a number of banks specify that providing credentials to a third party isn't allowed. If your credentials actually got stolen, the banks could deny assistance.
I use Mint though and I find it really helpful for monitoring my finances.
Re: Ask HN: Why would people trust their banking credentials to a service like Mint?
#13I'm currently doing the same thing for my own personal use. My bank has recently redone their mobile app and it's actually very nice, but I still don't have the insight I'd like without breaking out my calculator.
Where I'm from the banks run on ancient software (we're talking COBOL in most cases) and when an ATM breaks, you see it briefly boot through Windows 98.
Web scrapers could be feasible for an e-commerce service (that's mostly what Yodlee is, the service that powers Mint) the hard part is the regulatory issues surrounding banking web scrapers. It's a very very grey area.
In my opinion with this stuff, if there's demand, it's better to ask for forgiveness than permission and third party banking apps could/can provide endless functionality and insight.
Re: Ask HN: Why would people trust their banking credentials to a service like Mint?
#14I already use TurboTax, so it's not like Mint is really giving Intuit a whole lot more data than I'm already giving them. Aside from debt-consolidation loans and credit card offers, there's isn't really any advertising that I see there, and I'm less worried about them selling off information about my transactions the way Google probably would to targeted advertisers.
Really, I would think that this data would in some sense be the holy grail for targeted marketing, short of the databases that Amazon has on its customers.
Re: Ask HN: Why would people trust their banking credentials to a service like Mint?
#15SOFORT(.com) has built a strong market presence in Germany and is expanding throughout Europe. They basically do the same thing you are talking about: provide an easy "check-out" experience using customers' banking credentials and custom crawlers.
The solution is well-liked by merchants. Banks generally don't like it (for obvious security/privacy reasons), but are cautious in actually preventing it. SOFORT actually used to be the only payment method to buy german train tickets online without a surcharge. In a recent ruling, a court deemed this to be an inacceptable intrusion to privacy, forcing the train operator to offer another free means of payment.
Pending EU legislation (PSD II) will force banks to offer some sort of limited API access that'll allow users to sensibly share access with services like Mint or SOFORT.
Re: Ask HN: Why would people trust their banking credentials to a service like Mint?
#16I’ve been using Mint for several years. But there actually was a point two years ago where I got concerned about them having all my credentials. I deleted my account and changed all my passwords.
Fast-forward a few months later and I’m using them again. Whatever concerns I had about data security did not outweigh having immediate information to all my accounts and reports that would take me too long to generate myself. I don’t worry so much about Mint abusing my data as someone hacking their services. I wouldn’t have the same trust level with a startup or smaller company though.
Re: Ask HN: Why would people trust their banking credentials to a service like Mint?
#17I'm actually looking for a bank feed/API service for banks in Australia. Does anyone know of one?
http://getpocketbook.com is not a feed/api but offers a similar service of what Mint does.
Re: Ask HN: Why would people trust their banking credentials to a service like Mint?
#18It's a bad idea, but if you want automated access it's the best we've got. Ideally banks would provide a nice API, but without a good enough reason they're just not interested.
Hell, I wish everyone would provide a nice API.
Re: Ask HN: Why would people trust their banking credentials to a service like Mint?
#19I don't use Mint, but to me, the main question is whether I perceive the company to have more to lose by abusing the power I grant them than they would gain from doing so. A small fly-by-night company might make a quick buck by embezzling people and then disappearing, but a bigger company has much more value tied up in its brand and customer base, so they would have too much to lose. It's not a bulletproof approach (as some high profile Ponzi schemes have shown) but it's managed to keep me out of trouble so far.
Re: Ask HN: Why would people trust their banking credentials to a service like Mint?
#20I’ve been using Mint for several years. But there actually was a point two years ago where I got concerned about them having all my credentials. I deleted my account and changed all my passwords. Fast-forward a few months later and I’m using them again. Whatever concerns I had about data security did not outweigh having immediate information to all my accounts and reports that would take me too long to generate mysel…
That's a huge tell: the convenience and value of having all your accounts aggregated far outweighs the security concerns, and frankly even the myriad and difficult and frankly frightening methods of connecting your accounts.
That's why people do it, and there's clearly an opportunity for a better experience...