Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teller – API for your bank account

blog.teller.io

Post reply on HN
Print view View original

121–130 of 282 posts

Re: Teller – API for your bank account

#121

Post by DerJacques »

kevincennis wrote: post #115
mirekrusin wrote: post #114

Somebody told me that 2018 is the deadline for EU banks to provide API access. If that's the case then going through any server side layer managed by somebody is unnecessary and people in general should think twice about every single bank transaction being stored somewhere "there". It gives out a lot of information from your internet provider to your child's creche, holidays habits, income (duh), loan repayments and…

Are they required to adhere to a standardized API? If not, then I think there's still some utility in a service that can normalize that stuff and provide you with a single, consistent interface.

My understanding is that the EU PSD2 regulation indeed is supposed to make banks adhere to a standardised API. That being said, I wouldn't expect a super easy to use REST api with documentation powered by readme.io.

Re: Teller – API for your bank account

#122

Post by dbbk »

meredydd wrote: post #79
sjtgraham wrote: post #33

Earlier quoted context omitted.

Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth m…

This is startup-ese for "Every single one of our users is breaking their bank's ToS, and we maintain plausible deniability by telling them to go and read complex legal documents themselves". I can totally understand the motivation (particularly with PSD2 around the corner, which will mandate banks to provide legit APIs - I'm guessing the plan is to grab market share before that happens). However, I am very skeptical…

To be fair I think there is still going to be a lot of appetite for a service like Teller once PSD2 launches to unify these individual bank APIs. They may not even all work the same way. It'd be much better to have one entry point than develop for multiple different banks' implementation.

Re: Teller – API for your bank account

#123

Post by rodgerd »

sparkling wrote: post #53
foxylion wrote: post #22

As a German it is hard to believe that such things do not exist yet in other countries. We have a standardized protocol called FinTS which is implemented by most banks. This results in a huge amount of desktop and mobile applications for banking.

FinTS (formerly known as HBCI) is horrible and serves as a great example of how not to design a API. The non-machine-readable german-language-only API specification consist of >800 pages spread across various PDFs[1] full of gibberish. There are no official client libraries, no minimal examples, different banks only support certain versions etc. etc. etc. [1] https://www.hbci-zka.de/dokumente/spezifikation_deutsch/fi…

> german-language-only

Ah the horror. Last week it was bleating that German laws are written in German, this week it's bleating that German bank documentation is written in German.

Re: Teller – API for your bank account

#124

Post by jasiek »

icebraining wrote: post #113
jasiek wrote: post #62

Earlier quoted context omitted.

Current roaming regulations in the EU are designed with the biggest, transnational players in mind. By subsidizing operations in a less lucrative market using proceeds from other countries, they can bleed smaller national telecoms. They will then proceed to buy them for pennies on the dollar. This will result in less competition down the road, and higher prices for the end user.

Can you break that down? How do the roaming regulations enable those bigger players to do that?

http://ec.europa.eu/transparency/regdoc/rep/10102/2016/EN/SW... - see page 32 (ARRPU). Operators in different countries have different profits per user (obvious). If you have someone like T-Mobile or Orange, they'll use the proceeds from say... France, to finance their operations in say... Poland. This will put pressure on other national operators to further lower prices. Lower prices mean lower profit margins, mean lower dividends, lower company valuation, being less attractive to investors, etc. After a while their value will decline by so much, they'll be willing to sell themselves at the current going price of their infrastructure. Orange buys them, and kills off competition.

Re: Teller – API for your bank account

#125

Post by dbbk »

sjtgraham wrote: post #26
Animats wrote: post #11

Earlier quoted context omitted.

Your terms: "We are not liable for any loss or damage that may result from your use of our services. This includes any direct, indirect, or consequential losses; any loss or damage caused by tort, including negligence, breach of contract or otherwise." You don't get taken seriously in the financial space with terms like that. You need to accept responsibility for errors and carry errors and omissions insurance. Compa…

Thanks for your feedback. We developed TAuth to provide attribution and non-repudiation for exactly this kind of situation. I personally take security very seriously such that launching our product has taken longer because designing and implementing a system worthy of performing financial transactions on behalf of others is a serious undertaking. Our terms are comparable to the incumbent "screen-scrapers" in the mark…

Is there much desire for moving money via API though? Seems like it would expose you to massive risk for little reward.

Re: Teller – API for your bank account

#126

Post by jasiek »

kevincennis wrote: post #115
mirekrusin wrote: post #114

Somebody told me that 2018 is the deadline for EU banks to provide API access. If that's the case then going through any server side layer managed by somebody is unnecessary and people in general should think twice about every single bank transaction being stored somewhere "there". It gives out a lot of information from your internet provider to your child's creche, holidays habits, income (duh), loan repayments and…

Are they required to adhere to a standardized API? If not, then I think there's still some utility in a service that can normalize that stuff and provide you with a single, consistent interface.

Nope. They just need to provide "an API". Got a hundred banks? That's potentially 100 integrations you'll need to do - the barriers remain in place an everyone is happy.

Re: Teller – API for your bank account

#127

Post by corobo »

sjtgraham wrote: post #26
Animats wrote: post #11

Earlier quoted context omitted.

Your terms: "We are not liable for any loss or damage that may result from your use of our services. This includes any direct, indirect, or consequential losses; any loss or damage caused by tort, including negligence, breach of contract or otherwise." You don't get taken seriously in the financial space with terms like that. You need to accept responsibility for errors and carry errors and omissions insurance. Compa…

Thanks for your feedback. We developed TAuth to provide attribution and non-repudiation for exactly this kind of situation. I personally take security very seriously such that launching our product has taken longer because designing and implementing a system worthy of performing financial transactions on behalf of others is a serious undertaking. Our terms are comparable to the incumbent "screen-scrapers" in the mark…

> I personally take security very seriously

Respectfully, your users don't care about technical security if you get compromised - they care about their financial security. Please do reconsider your stance on liability, I found myself wincing while reading that disclaimer.

It pains me to say it as a techie but insurance is more important than security in this case. It'd be great if you were iron clad against all hacks ever but it'd sit more easily if there was insurance backing it up. What if you get a rogue employee dumping out all the credentials for example, not all attacks come from outside.

If you don't trust your security enough to assume liability, why should your users?

> FWIW it is not currently possible for users to move money with Teller

I don't believe it's so much a compromised service or API that's concerning, it's your credential storage. The data you hold does allow users to move money if compromised.

Having picked fault with your service enough, it does look like a great service and I'd love to use it one day. Best of luck!

Re: Teller – API for your bank account

#129

Post by reledi »

sjtgraham wrote: post #49
jswny wrote: post #25

Earlier quoted context omitted.

Not only does this sound potentially illegal but how can you be confident that you will recognize the breaking changes in time to fix them? What if you begin supporting a large number of banks and you can't keep up? Also, will your reverse-engineered use of the mobile API's have any detrimental effect on the user? I imagine the user will be the one authenticated with the API, what if the bank starts to see an influx…

The EU Computer Programs Directive 2009 provides an exemption for reverse-engineering for the purposes of creating inter-operable systems. This directive has been harmonized into UK law (where Teller is domiciled and operates) and Teller satisfies the requirements to be protected by the exemption. We have also developed many novel techniques that do not meet the UK legal definition of reverse-engineering so we have t…

Hey Stevie, I was at the HN London where you gave a very memorable demo on reverse-engineering mobile banking apps. Stoked to see to how far you've come and congratulations on the Teller beta launch!

Even back then you had caught the attention of banks. I'm sure they've threatened you many times. But now that banks are taking you more seriously and returning your calls, how are you going to convince them to work with you instead of against you?

And what happens when, if they haven't begun already, try and legally DoS you?

Re: Teller – API for your bank account

#130

Post by rufugee »

JohnnyMneunomic wrote: post #71
rufugee wrote: post #43

Earlier quoted context omitted.

First I've heard about Plaid and Quovo. These services seem to be targeted at a developer interested in developing products for others. I really wish someone would come out with an API service targeted towards someone who would like to manage and query their portfolio of accounts with code. I have tried time and time again to use things like Mint or Quicken to have a consolidated view of my accounts, but invariably I…

Would you pay for access to this API service?

Provided it were priced reasonably...absolutely.
Post reply on HN