Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

First Open Banking API Sandbox in the UK

ukopenbanking.com

Post reply on HN
Print view View original

41–49 of 49 posts

Re: First Open Banking API Sandbox in the UK

#41

Post by icebraining »

insomniacity wrote: post #24
sjtgraham wrote: post #19

If you're in the UK and want a banking API (including payments and transfers), I'm building http://teller.io/ . It's been in private beta about 2.5 months and access will be opening more broadly soon. I couldn't wait for banks to get themselves into gear so I reverse engineered all of their mobile apps, took their private APIs and expose a single unified API through Teller. Here is a video of me cURL-ing my bank acco…

Do we have to give you the full login details? I'm somewhat impressed though - I was defeated by certificate pinning on one UK bank's mobile app. How did you get round that?

There's a BlackHat presentation on this: https://media.blackhat.com/bh-us-12/Turbo/Diquet/BH_US_12_Di...

Re: First Open Banking API Sandbox in the UK

#42

Post by seibelj »

sjtgraham wrote: post #19

If you're in the UK and want a banking API (including payments and transfers), I'm building http://teller.io/ . It's been in private beta about 2.5 months and access will be opening more broadly soon. I couldn't wait for banks to get themselves into gear so I reverse engineered all of their mobile apps, took their private APIs and expose a single unified API through Teller. Here is a video of me cURL-ing my bank acco…

Aren't there terms of service that prohibit you from reverse engineering their software and profiting from it? I want to build a mobile app on top of a private reverse engineered API and my lawyer says it could jeopardize my LLC's assets if we get sued

Re: First Open Banking API Sandbox in the UK

#43

Post by sjtgraham »

insomniacity wrote: post #24
sjtgraham wrote: post #19

If you're in the UK and want a banking API (including payments and transfers), I'm building http://teller.io/ . It's been in private beta about 2.5 months and access will be opening more broadly soon. I couldn't wait for banks to get themselves into gear so I reverse engineered all of their mobile apps, took their private APIs and expose a single unified API through Teller. Here is a video of me cURL-ing my bank acco…

Do we have to give you the full login details? I'm somewhat impressed though - I was defeated by certificate pinning on one UK bank's mobile app. How did you get round that?

Teller emulates the first party mobile client. So what you need to give Teller depends on what you need to enrol your mobile device.

I don't disable PKI pinning. I inject code at runtime to observe and change behaviour.

Re: First Open Banking API Sandbox in the UK

#44

Post by sjtgraham »

konradb wrote: post #21
sjtgraham wrote: post #19

If you're in the UK and want a banking API (including payments and transfers), I'm building http://teller.io/ . It's been in private beta about 2.5 months and access will be opening more broadly soon. I couldn't wait for banks to get themselves into gear so I reverse engineered all of their mobile apps, took their private APIs and expose a single unified API through Teller. Here is a video of me cURL-ing my bank acco…

An API for Natwest would be amazing, but won't this be against their TOS? Just wondering if they are aware of your work and OK with it.

It's not against their TOS for me as a customer to reverse engineer their mobile clients (AFAIK), it is against their TOS for you as a bank customer to give Teller any authentication details. This is nothing new, the incumbent aggregator Yodlee also causes users to violate the bank TOS in this way. But aggregators solve such a pain point that users are prepared to use these services.

Every UK bank is aware of Teller, even ones I have not interacted with directly. I've been up to Edinburgh and to the RBS London offices a bunch of times, I know them well. I hope to work with the banks and not against them.

Re: First Open Banking API Sandbox in the UK

#45

Post by sjtgraham »

neximo4 wrote: post #20
sjtgraham wrote: post #19

If you're in the UK and want a banking API (including payments and transfers), I'm building http://teller.io/ . It's been in private beta about 2.5 months and access will be opening more broadly soon. I couldn't wait for banks to get themselves into gear so I reverse engineered all of their mobile apps, took their private APIs and expose a single unified API through Teller. Here is a video of me cURL-ing my bank acco…

How did you reverse engineer the Natwest/Ulster/RBS app. It is my understanding they use certificate pinning?

They do pin certs. I don't disable pinning, I quite like the protection it gives me. I actually inject code at runtime to observe and modify behaviour.

Re: First Open Banking API Sandbox in the UK

#46

Post by shmapf »

"...require banks in the EU to open their payment and transaction systems to certified third parties" Does anyone know if this will mean that average Joe can't just write a script to access his account, because he isn't a "certified third party"?

Re: First Open Banking API Sandbox in the UK

#47

Post by edward »

sjtgraham wrote: post #19

If you're in the UK and want a banking API (including payments and transfers), I'm building http://teller.io/ . It's been in private beta about 2.5 months and access will be opening more broadly soon. I couldn't wait for banks to get themselves into gear so I reverse engineered all of their mobile apps, took their private APIs and expose a single unified API through Teller. Here is a video of me cURL-ing my bank acco…

Are you using polling to discover new transactions, or do they send a notification to the mobile app?

Re: First Open Banking API Sandbox in the UK

#48

Post by neximo4 »

sjtgraham wrote: post #45
neximo4 wrote: post #20

Earlier quoted context omitted.

How did you reverse engineer the Natwest/Ulster/RBS app. It is my understanding they use certificate pinning?

They do pin certs. I don't disable pinning, I quite like the protection it gives me. I actually inject code at runtime to observe and modify behaviour.

Interesting. I've sent you an email about using teller. Hopefully you give me a shot at it.

Re: First Open Banking API Sandbox in the UK

#49

Post by neximo4 »

alcari wrote: post #35
neximo4 wrote: post #33

Earlier quoted context omitted.

Doesn't exactly answer the question..

If you can run the app on a jailbroken/rooted device, it's fairly easy to beat certificate pinning in a few different ways. Two that come to mind are: * find the certificate file in the app and replace it with your own. * hook the function that verifies the certificate and make it return true.

If you tried reversing the app in question, none of these methods work as the app has a couple of protections against changing its code.
Post reply on HN