Live data from Hacker News

Ask HN: Is there any US bank with a sandbox or API?

news.ycombinator.com

31–40 of 61 posts

Re: Ask HN: Is there any US bank with a sandbox or API?

#31
post #26

Earlier quoted context omitted.

This is great! I too am working behind the scenes (nothing on Github yet) on a set of scrapers that pull in data from various financial institutions (my bank, a credit union, a CC account, ect.) along with a 'manager' application that recieves results from these scrapers and displays the data to me. That's step 1. Next I'd like to fully automate the paying of my bills and setting up arbitrary actions based on certain…

You may want to check out https://github.com/bankbotsbank/bankbotsbank

I learned about Nightmare, which apparently runs headless chromium. this is exactly what I needed. Thanks.

Re: Ask HN: Is there any US bank with a sandbox or API?

#32
US Bank has a hackathon site: http://thinkbighacksmall.com or http://usbinnovationsd.apiportal.akana.com/

US Bank's Elavon: https://developer.elavon.com/#/home/landing

Barclays: https://developer.barclays.com/static/landing/landing.html

Capital One: https://developer.capitalone.com

Re: Ask HN: Is there any US bank with a sandbox or API?

#33

Capital One provides this toy API: http://api.reimaginebanking.com If you want to create an app or startup that does anything involving banking, look elsewhere. The chances you will get approval from banks and regulators are zero. To have a halfway decent shot, you would need years, significant industry connections, expensive lawyers on retainer in New York and Washington, and the ability to prove you have cash on ha…

Yeah, basically banks don't want a public api because security concerns.

So people get around it by logging into the user's bank and scraping. Which is much less secure than just providing a secure api to begin with...

All good intentions have consequences.

Re: Ask HN: Is there any US bank with a sandbox or API?

#34
In Germany i do not know any bank that does not support [0]FinTS when using online banking with your account. I would consider that a documented API for external use.

However, you asked for american banks and i haven't seen options to get a sandboxed variant albeit i am sure these exist. Another option would be to open accounts at some Banks....

[0] https://en.wikipedia.org/wiki/FinTS

Re: Ask HN: Is there any US bank with a sandbox or API?

#35

Capital One provides this toy API: http://api.reimaginebanking.com If you want to create an app or startup that does anything involving banking, look elsewhere. The chances you will get approval from banks and regulators are zero. To have a halfway decent shot, you would need years, significant industry connections, expensive lawyers on retainer in New York and Washington, and the ability to prove you have cash on ha…

Yeah, basically banks don't want a public api because security concerns. So people get around it by logging into the user's bank and scraping. Which is much less secure than just providing a secure api to begin with... All good intentions have consequences.

Which is what mint.com does right? That service was terrifying; storing all those usernames and passwords. I'm very surprise there haven't been more security break-ins with that site.

Re: Ask HN: Is there any US bank with a sandbox or API?

#36

Earlier quoted context omitted.

Yeah, basically banks don't want a public api because security concerns. So people get around it by logging into the user's bank and scraping. Which is much less secure than just providing a secure api to begin with... All good intentions have consequences.

Which is what mint.com does right? That service was terrifying; storing all those usernames and passwords. I'm very surprise there haven't been more security break-ins with that site.

To my knowledge, that is what Mint is doing.

I'm curious how they handle two factor authentication?

Re: Ask HN: Is there any US bank with a sandbox or API?

#38
We are a young unfounded company and work with most of the major us investment banks and the answer is there is no sandbox or API that they will share with you. Our experience is that the banks won't waste their time on anything that feels beta so you have to invest in having a solution built out and people using it (a catch 22). The exception to this rule however is that banks work for their clients (this pertains to investment banks not retail) and they will use a new tool in the context of an engagement when asked by the issuer, investor or firm they are representing. Not sure what you're planning to build but go to their customers first (issuers or large investors) who are much more agile. Once you're in the system you can navigate through the onboarding. Happy to share our experiences further if you want to discuss - reach out directly.

Re: Ask HN: Is there any US bank with a sandbox or API?

#39

Capital One provides this toy API: http://api.reimaginebanking.com If you want to create an app or startup that does anything involving banking, look elsewhere. The chances you will get approval from banks and regulators are zero. To have a halfway decent shot, you would need years, significant industry connections, expensive lawyers on retainer in New York and Washington, and the ability to prove you have cash on ha…

> The chances you will get approval from banks and regulators are zero. To have a halfway decent shot, you would need years, significant industry connections, expensive lawyers on retainer in New York and Washington, and the ability to prove you have cash on hand in the high 7 figures.

Full disclosure, I work for Capital One now. So... C1 has stated publicly it's interested in this space and some of its prominent employees are in prominent public technical groups trying to make it happen. The liability and fraud stories are really unimaginably complicated.

For people looking to make a product today, I've decided to add a quick primer:

Finicity, FinancialServices, and Plaid are all financial aggregators that you can use in combination with novel (read: quasi-legal) mechanisms you can use to provide financial services within the confines of the beleaguered law.

In general a financial product's engineering cycle looks like this:

1. Find a data aggregator you can partner with and give most of your profits to. 2. Work very hard on experience driven products. 3. Find a good lawyer who can help you produce a novel interpretation of the law that works with a specific financial product. 4. Still have limited success because fintech products have linear adoption curves (even Mint).

Examples in this space of novel mechanisms that use existing payment services, data aggregation products and very clever lawyers: Acorns, Digit, Tally.

I was one of the founders and the founding engineer of Level, and worked on Simple. My general observation is that most of the challenge is around data quality and aggregation on the technical side of things.

A lot of the challenge of making these apps work is balancing your fraud risk with your customer experience. Customers are apathetic and inclined to ignore the space, fraudsters are diabolically clever and very engaged.

Re: Ask HN: Is there any US bank with a sandbox or API?

#40

Earlier quoted context omitted.

Yeah, basically banks don't want a public api because security concerns. So people get around it by logging into the user's bank and scraping. Which is much less secure than just providing a secure api to begin with... All good intentions have consequences.

Which is what mint.com does right? That service was terrifying; storing all those usernames and passwords. I'm very surprise there haven't been more security break-ins with that site.

David K Michaels, VP Engineering, Mint.com 27.2k Views For passwords to Mint itself, we compute a secure hash of the user's chosen password and store only the hash (the hash is also salted - see http://en.wikipedia.org/wiki/Sal... ). Hashing is a one-way function and cannot be reversed. It is not possible to ever see or recover the password itself. When the user tries to login, we compute the hash of the password they are attempting to use and compare it to the hashed value on record. (This is a standard technique which every site should use).

For banking credentials, we generally must use reversible encryption for which we have special procedures and secure hardware kept in our secure and guarded datacenter. The decryption keys never leave the hardware device (which is built to destroy the key material if the tamper protection is attacked). This device will only decrypt after it is activated by a quorum of other keys, each of which is stored on a smartcard and also encrypted by a password known to only one person. Furthermore the device requires a time-limited cryptographically-signed permission token for each decryption. The system (which I designed and patented) also has facilities for secure remote auditing of each decryption.

https://www.quora.com/How-do-mint-com-and-similar-websites-a...

Post reply on HN