Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Big Banks Lock Horns with Personal-Finance Web Portals

on.wsj.com

Post reply on HN
Print view View original

71–80 of 108 posts

Re: Big Banks Lock Horns with Personal-Finance Web Portals

#71

Post by comrh »

sanderjd wrote: post #58
shawkinaw wrote: post #52

I used Mint for a long time, but eventually decided I didn't like them having all my bank login information, including security questions. So I switched to a setup where I download OFX data directly from my banks using a Python script [1], and use Ledger [2] to track spending, balances, etc. A big bonus of this approach is that I have complete control over the data, so if an import get screwed up somehow I can fix it…

I have a very similar setup, except using YNAB[0]. I never felt like I really used Mint, besides just going and looking at my balances and (infrequently) thinking, "huh, looks like I'm over-budget again". With this setup, I feel like I'm taking matters into my own hands, which has had a noticeable impact on my spending and planning discipline. Thanks for the link to your project, looks really useful! [0]: https://www…

YNAB recommends the manual entry of purchases to better understand the relationship between the things you buy and your money. This has helped me be much less impulsive and more aware of the large money sinks in my life (lunch!). Whatever setup works for you to help you budget though, it is great software.

Re: Big Banks Lock Horns with Personal-Finance Web Portals

#72

Post by lsaferite »

cdnsteve wrote: post #45

I agree with the banks in part. Giving your online account credentials to access your banking information is complete madness. It's a giant security risk that neither company would likely cover if someone got a hold of your login details. This is the reason I purposely never signed up for Mint. On the second half of the argument. Banks need address the fact that users needs are changing and they want access to their…

Isn't that the basic idea behind OFX though?

I mean, role specific credentials with limited rights seems like it would work perfectly fine with the existing OFX spec.

Re: Big Banks Lock Horns with Personal-Finance Web Portals

#73

Post by superuser2 »

cdnsteve wrote: post #45

I agree with the banks in part. Giving your online account credentials to access your banking information is complete madness. It's a giant security risk that neither company would likely cover if someone got a hold of your login details. This is the reason I purposely never signed up for Mint. On the second half of the argument. Banks need address the fact that users needs are changing and they want access to their…

> Giving your online account credentials to access your banking information is complete madness. It's a giant security risk

Is it? My bank requires multi-factor confirmation to set up a new payee for electronic transfers and sends several emails for any transfer. You couldn't actually steal any money just by having online banking credentials.

Re: Big Banks Lock Horns with Personal-Finance Web Portals

#74

Post by shawkinaw »

pspeter3 wrote: post #69
shawkinaw wrote: post #52

I used Mint for a long time, but eventually decided I didn't like them having all my bank login information, including security questions. So I switched to a setup where I download OFX data directly from my banks using a Python script [1], and use Ledger [2] to track spending, balances, etc. A big bonus of this approach is that I have complete control over the data, so if an import get screwed up somehow I can fix it…

Do you pay for the OFX access?

No, all my banks/CC companies have free access. I think most if not all banks (at least major ones) do, you can check this site [1].

[1] http://www.ofxhome.com/index.php/home/directory

Re: Big Banks Lock Horns with Personal-Finance Web Portals

#75

Post by shawkinaw »

mey wrote: post #56
shawkinaw wrote: post #52

I used Mint for a long time, but eventually decided I didn't like them having all my bank login information, including security questions. So I switched to a setup where I download OFX data directly from my banks using a Python script [1], and use Ledger [2] to track spending, balances, etc. A big bonus of this approach is that I have complete control over the data, so if an import get screwed up somehow I can fix it…

The advantage I see Mint has is they don't require OFX as they appear willing to scrape sites for content.

Yeah, but the advantage of OFX is that it is read-only and can use different credentials for authentication (depending on the bank.) Another advantage I forgot to mention is that I couldn't use my bank's 2FA with Mint.

Re: Big Banks Lock Horns with Personal-Finance Web Portals

#76

Post by shawkinaw »

sanderjd wrote: post #58
shawkinaw wrote: post #52

I used Mint for a long time, but eventually decided I didn't like them having all my bank login information, including security questions. So I switched to a setup where I download OFX data directly from my banks using a Python script [1], and use Ledger [2] to track spending, balances, etc. A big bonus of this approach is that I have complete control over the data, so if an import get screwed up somehow I can fix it…

I have a very similar setup, except using YNAB[0]. I never felt like I really used Mint, besides just going and looking at my balances and (infrequently) thinking, "huh, looks like I'm over-budget again". With this setup, I feel like I'm taking matters into my own hands, which has had a noticeable impact on my spending and planning discipline. Thanks for the link to your project, looks really useful! [0]: https://www…

Yeah. I actually really liked Mint, before it I had no idea where my money was going. But the security stuff started to bug me, and there were mounting frustrations with Mint's inflexibility that finally pushed me to go a different direction.

Also, the first link I posted isn't my work, just a nice utility I found. I did roll my own Python for converting OFX to Ledger though, been meaning to clean that up and post it but haven't gotten around to it yet.

Re: Big Banks Lock Horns with Personal-Finance Web Portals

#77

Post by ska »

KirinDave wrote: post #50
cdnsteve wrote: post #45

I agree with the banks in part. Giving your online account credentials to access your banking information is complete madness. It's a giant security risk that neither company would likely cover if someone got a hold of your login details. This is the reason I purposely never signed up for Mint. On the second half of the argument. Banks need address the fact that users needs are changing and they want access to their…

> I agree with the banks in part. Giving your online account credentials to access your banking information is complete madness. It's a giant security risk that neither company would likely cover if someone got a hold of your login details. This is the reason I purposely never signed up for Mint. As someone who collects these daily; I'd rather not collect them. The lengths I have to go to to ensure that they're not a…

In my experience (just as a client) Chase is very happy to act unilaterally and without communication. On the other hand, as an ex-client I have the option of just never dealing with them again.

Re: Big Banks Lock Horns with Personal-Finance Web Portals

#78

Post by balls187 »

yvesmh wrote: post #62
balls187 wrote: post #41

Earlier quoted context omitted.

Why does Mint have to store your bank password in plain text?

Because there's no API, so they have to scrape your transactions off the bank's sites, and they have to log-in using your credentials for that.

Okay. So they have to store your password, but it doesn't have to be plain text. They can encrypt it.

Re: Big Banks Lock Horns with Personal-Finance Web Portals

#79

Post by balls187 »

breischl wrote: post #49
balls187 wrote: post #41

Earlier quoted context omitted.

Why does Mint have to store your bank password in plain text?

They don't have to store it in plain text, but they do need to store it with reversible encryption (as opposed to hashing) so that they can use it to login to the bank's website.

Right, that's my point. There is no technical requirement to be stored as plain-text.

Though I would imagine that encryption, by definition, is two-way (encrypt, decrypt).

As an aside, do merchant account API services provide a secure-token service to store credit card information? That is, I enter in my VISA credit-card, click "save" and Amazon.com gets a unique token back that identifies this credit card. When I later go to purchase an item, Amazon uses this token to with VISA to charge my card? IIRC, that is how Stripe works, but I wonder if each credit card manufacturer now supports this, as part of PCI compliance.

Re: Big Banks Lock Horns with Personal-Finance Web Portals

#80

Post by shawkinaw »

lsaferite wrote: post #72
cdnsteve wrote: post #45

I agree with the banks in part. Giving your online account credentials to access your banking information is complete madness. It's a giant security risk that neither company would likely cover if someone got a hold of your login details. This is the reason I purposely never signed up for Mint. On the second half of the argument. Banks need address the fact that users needs are changing and they want access to their…

Isn't that the basic idea behind OFX though? I mean, role specific credentials with limited rights seems like it would work perfectly fine with the existing OFX spec.

My bank already does this, to a limited extent anyway. I use (slightly) different credentials for OFX login than if I go to the website.
Post reply on HN