This looks really cool, but I'm nervous about trying it. Can they provide any guarantees?
Teller – API for your bank account
81–90 of 282 posts
Re: Teller – API for your bank account
#82I emailed a bit with sjtgraham on this a while back.
It was my understanding back then that even when Teller does more advanced authentication with the bank, eg EMV CAP, that that does still grant them the rights to move money, even though Teller doesn't yet support it.
To me that paints a big target on Teller's back - all those juicy downstream credentials.
sjtgraham's point was that setting up new payees typically (always?) requires additional authentication. But I can think of a number of scenarios where a hacker might send all my money to all my existing payees just to mess with me/Teller/my bank... causing fees and stress.
Obviously it's going down the route that Teller won't need your full credentials, you will grant them access via something like EMV CAP, which I applaud.
But I would call on Teller to publicly commit to not integrate more 'advanced' auth methods if they don't include the ability to grant read-only access, if the user wishes!
Re: Teller – API for your bank account
#83Earlier quoted context omitted.
Not without pushing out an update to all of their clients. Which presumably they would know about.
Sure they might find out an App Update was issued in the App Store... but they cannot possibly know what API changes were made without reverse-engineering the API's all over again. Not to mention, once they discover what changed, now this service has to go make the changes on their system... meanwhile that bank doesn't work with this service anymore. So the App is broken for some undefined period of time.
The bank has to deploy their client code to all of their users before they can depreciate the old API. That should give them plenty of buffer time to reverse engineer the changes.
Re: Teller – API for your bank account
#84As a German it is hard to believe that such things do not exist yet in other countries. We have a standardized protocol called FinTS which is implemented by most banks. This results in a huge amount of desktop and mobile applications for banking.
FinTS (formerly known as HBCI) is horrible and serves as a great example of how not to design a API. The non-machine-readable german-language-only API specification consist of >800 pages spread across various PDFs[1] full of gibberish. There are no official client libraries, no minimal examples, different banks only support certain versions etc. etc. etc. [1] https://www.hbci-zka.de/dokumente/spezifikation_deutsch/fi…
Enterprisey APIs with adoption beat nicely designed APIs without adoption anytime.
Besides, that does not explain, why none of the other banks can get their act together. If FinTS is too difficult to implement, how come they are not offering something simpler?
Re: Teller – API for your bank account
#85UK banks don't accept any liability if you give your online banking credentials to a third party. If some fraud was to come about as a result of someone using Teller then they would be out of pocket or has Teller got agreements with the compatible banks to overcome this situation (either by Teller reimbursing the customer or the bank)?
I believe this is true for most US banks also. I can't even count how many promising-looking Fintech products I had to pass over because the only auth mechanism they offered was through sharing online banking credentials. Until bank policies regarding credentials-sharing actually change, I think it's really irresponsible for products to even ask for credentials at all, let alone offer it as the default/only auth opti…
Users could be unwittingly putting their entire life savings at risk.
Is this a realistic concern? I thought the point of a bank was that situations like that can be reversed 100% of the time.
Re: Teller – API for your bank account
#86Earlier quoted context omitted.
Not only does this sound potentially illegal but how can you be confident that you will recognize the breaking changes in time to fix them? What if you begin supporting a large number of banks and you can't keep up? Also, will your reverse-engineered use of the mobile API's have any detrimental effect on the user? I imagine the user will be the one authenticated with the API, what if the bank starts to see an influx…
The EU Computer Programs Directive 2009 provides an exemption for reverse-engineering for the purposes of creating inter-operable systems. This directive has been harmonized into UK law (where Teller is domiciled and operates) and Teller satisfies the requirements to be protected by the exemption. We have also developed many novel techniques that do not meet the UK legal definition of reverse-engineering so we have t…
Seems pretty sensible.
I hope banks will realise that open APIs are a good thing, and if they don't start getting their shit together, they'll be left behind. Our whole financial infrastructure is so needlessly complicated. Why can't it all be JSON APIs?
Re: Teller – API for your bank account
#87Earlier quoted context omitted.
Not without pushing out an update to all of their clients. Which presumably they would know about.
It seems like they would only find out after the update has been pushed, though - ie, after the app has been broken. Unless they have relationships with the banks now, and would be given a heads-up. Perhaps that's the case. It sounds like it may be.
Apps won't be updated instantaneously on devices, though. There'll have to be some backwards compatibility for a good while if the banks want to change their APIs drastically. You can't just shut down access to your customers apps.
Re: Teller – API for your bank account
#88People: Only do it with an extra bankaccount. Without any credit functionality and without your primary money.
Everything else would be very naiv.
Re: Teller – API for your bank account
#89I emailed a bit with sjtgraham on this a while back. It was my understanding back then that even when Teller does more advanced authentication with the bank, eg EMV CAP, that that does still grant them the rights to move money, even though Teller doesn't yet support it. To me that paints a big target on Teller's back - all those juicy downstream credentials. sjtgraham's point was that setting up new payees typically…
Incidentally, if Teller start to get an appreciable proportion of the UK population (remember, users will be using Teller without realising, through other apps and platforms), they should expect a call from the regulators, who will want to be sure that they can't cause any systemic instability (eg by getting hacked.)
Re: Teller – API for your bank account
#90As a German it is hard to believe that such things do not exist yet in other countries. We have a standardized protocol called FinTS which is implemented by most banks. This results in a huge amount of desktop and mobile applications for banking.
FinTS (formerly known as HBCI) is horrible and serves as a great example of how not to design a API. The non-machine-readable german-language-only API specification consist of >800 pages spread across various PDFs[1] full of gibberish. There are no official client libraries, no minimal examples, different banks only support certain versions etc. etc. etc. [1] https://www.hbci-zka.de/dokumente/spezifikation_deutsch/fi…
> There are no official client libraries, no minimal examples, different banks only support certain versions etc. etc. etc.
Sounds just like any other API, from most REST APIs to messengers.
HBCI is a lot better designed, and a lot easier to work with than the many different messengers that exist on phones nowadays. Everything is documented, everything is specified, and you have a stable API. Try getting something like this for Facebook Messenger, Allo, Duo, WhatsApp, Signal, Riot, all at once.
HBCI is bad, but it's a rare gem. Usually, when many major corporations have similar products, they try to prevent any such APIs from being created at all.
> non-machine-readable
I'm not sure I've seen any major API that's machine readable. Most major APIs don't have any machine-readable specifications publicly available. They probably have them internally, but almost never publicly.
> german-language-only
That's not really an issue, if you're in Germany. I don't go into the US and expect their banks to provide their specifications in English either. I realize that English has become the lingua franca in IT, but that's not a good thing.