81–90 of 108 posts
Earlier quoted context omitted.
Do you pay for the OFX access?
No, all my banks/CC companies have free access. I think most if not all banks (at least major ones) do, you can check this site [1]. [1] http://www.ofxhome.com/index.php/home/directory
Earlier quoted context omitted.
Because there's no API, so they have to scrape your transactions off the bank's sites, and they have to log-in using your credentials for that.
Okay. So they have to store your password, but it doesn't have to be plain text. They can encrypt it.
When a website stores the hash of your password on their servers for you to authenticate against they have no way to recover your plaintext password without brute-forcing the hash. They can verify that the password you sent them is correct but they can't tell you your password.
If, Mint say, encrypts your password on their servers with their own key then they still have the plaintext password because the process is reversible to them.
To do this right, Mint would be given a piece of information, say an OAuth token, which would allow them to authenticate to your bank without them knowing the password you use to log in.
Earlier quoted context omitted.
Okay. So they have to store your password, but it doesn't have to be plain text. They can encrypt it.
Translatable to plaintext without user provided information is still plaintext. When a website stores the hash of your password on their servers for you to authenticate against they have no way to recover your plaintext password without brute-forcing the hash. They can verify that the password you sent them is correct but they can't tell you your password. If, Mint say, encrypts your password on their servers with th…
They're not storing "plaintext." They're storing the "ciphertext." The fact that you can decrypt ciphertext to obtain plaintext, does not mean you are storing plaintext. You can certainly derive plaintext from it, but the actual plaintext, that is, the input to an encryption algorithm, is not stored.
If an attacker gets a database, but does not have access to the encryption key, they do not have your plaintext password.
-----
I agree, a more preferred way would be for MINT to use OAuth type data delegation. However, they're beholden to what the banks themselves support, and most do not support anything other than account impersonation via username/password.
I'm leaving SF to travel around the US for 6-12 months, which means I need to switch off the local credit union that I'm currently using. I may as well choose something that will work for the indefinite future, including whereever I land next (it will be in the US). Any recommendations? I'd prefer an organization that was less culpable for the financial crisis.
Why do you have to switch off the local credit union?
Earlier quoted context omitted.
Why do you have to switch off the local credit union?
The cards generally don't work overseas.
I read "SF" to mean San Francisco.
Also, I usually have better luck overseas with my credit union visa card than I do with my credit card (since I know the PIN for my checkcard).
I used Mint for a long time, but eventually decided I didn't like them having all my bank login information, including security questions. So I switched to a setup where I download OFX data directly from my banks using a Python script [1], and use Ledger [2] to track spending, balances, etc. A big bonus of this approach is that I have complete control over the data, so if an import get screwed up somehow I can fix it…
I'm pretty sure that doing that in the UK instantly nullifies any protection you have against fraud etc.
I'm working on setting up my own 'mint' for the purpose of working with my expenses, and this is the service I'm looking into using.
Earlier quoted context omitted.
The difficultly, strike that. The complexity occurs when you have setup auto payments. One just has to handle it like any other transitional period. You open a new account with a new bank or credit union and start funding it. You watch your existing bank account for recurring or auto payments coming out and work to switch them over to the new bank account. You have to maintain some money in the old bank account and p…
I don't do automatic payments. I won't do automatic payments. It doesn't benefit me so I don't do it. They day after payday, I sit down and determine which bills are due and I pay them electronically. It doesn't matter which bank account I use because I handle them individually, every payday. I could switch banks today and my process wouldn't be interrupted at all.
The disadvantage is "An outside entity can remove an arbitrary amount of money from my account at any time, keep it for an indeterminate amount of time, then return it without penalty."
I could see have a charge automatically applied to a credit card (where you're able to dispute it, if necessary). I cannot imagine why anyone would ever want to set up direct withdrawals.
Earlier quoted context omitted.
I don't do automatic payments. I won't do automatic payments. It doesn't benefit me so I don't do it. They day after payday, I sit down and determine which bills are due and I pay them electronically. It doesn't matter which bank account I use because I handle them individually, every payday. I could switch banks today and my process wouldn't be interrupted at all.
If by "automatic payments" you mean ACH direct withdrawals, the benefit is "I don't have to remember to pay my bill." The disadvantage is "An outside entity can remove an arbitrary amount of money from my account at any time, keep it for an indeterminate amount of time, then return it without penalty." I could see have a charge automatically applied to a credit card (where you're able to dispute it, if necessary). I…