Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Secret API of Banks

gduverger.com

Post reply on HN
Print view View original

71–80 of 257 posts

Re: The Secret API of Banks

#71

Post by Rjevski »

Nursie wrote: post #65
Rjevski wrote: post #42

Earlier quoted context omitted.

PSD2 and “open” banking is bullshit. I wish this myth would die - it is anything but “open”. If you want to gain access to API s , you need to become an “AISP” (as they are called in the UK), this requires a certification and a load of other nonsense akin to PCI-DSS. This is for read-only access - for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requi…

So you need to be vetted and approved before being allowed access to some of people's most private and secure data. Why is this a problem exactly?

My problem is that it does not even allow access to your own account. Nobody has a problem with access to others' accounts being regulated. I just want to do whatever I want with my own account.

Re: The Secret API of Banks

#72

Post by KirinDave »

The actual secret API of banks-and by the way this is the initial strategy Plaid pursed if rumor is to be believed (essentially without the consent of the banks)-is by reverse engineering mobile app APIs. Most of these bank APIs try to use cheesy secret token vending to prevent casual API traffic on their endpoints, but the reality is that a sufficiently instrumented Android kernel (or rooted iOS device) will let you reverse engineer those protocols and masquerade as legitimate users.

Re: The Secret API of Banks

#73

Post by sofaofthedamned »

WilliamEdward wrote: post #36
VikingCoder wrote: post #20

I hate sounding like a VC jerk, but the banking industry needs some serious disruption.

I had a similar idea, so I looked up the process for starting a bank. There's a good reason fresh-faced startup VCs can't get into it. - Extremely high starting capital requirements (10-100 million USD) - Knowledge on security, finance, and law, means you will be needing an expert team of lawyers, accountants, cryptographers, etc. - An actual location and strictly controlled building to keep the physical money. There…

TBF in Europe (or specifically the UK) the new regulations seem to have come up with a plethora of new banks -Starling, Monzo, Revolut, Tide, etc.

Both my personal and business accounts are with these, and it's awesome. Starling for my personal account and Tide for the business one. I get notifications of payments usually before the in-store machine has finished sorting itself out. Also get nice things like being able to use Google Pay before the card arrives. I've just got married, and our joint account will be one of these.

I assume these banks have popped up from these EU regulations, as they didn't exist 3 years ago.

Re: The Secret API of Banks

#74

Post by mindslight »

jimmyswimmy wrote: post #54

I guess it's not popular or all that well-known anymore, but for quite a while there's been a Quicken-led banking interface for some banks. Known as OFX or Direct Connect, it provides at least one-way (download) access to banking transactions. I think there's a way to upload as well but have never used it nor had a bank that supports it for upload. My bank has a separate enrollment - it was free - offering download-o…

^ This.

It's often called "Quicken Direct Connect" (NOT "web connect", that's a bastardization trying to push the login flow through the proprietary web interface), and often has to be specifically enabled for your account (Bank of Slum-merica is the only place I've heard charging for the functionality though).

Check say https://ofx-prod-filist.intuit.com/qb2600/data/fidir.txt to see if your bank is listed (that contains both direct and web connect banks, you'll figure out what the flags mean).

Setup a cron or human cron to pull and save the raw OFX (QFX) query every day/week/month, and then run whatever reports/analytics you want from that. This way you'll have history to use with whatever program/scripts you move to, and can also straightforwardly integrate legacy banks that make you use the web interface (just at a much lower polling rate).

Re: The Secret API of Banks

#75

Post by jsjohnst »

orf wrote: post #67
bhhaskin wrote: post #60

Earlier quoted context omitted.

Sure, but as other users like Rjevski have pointed out the PSD2 API is going to be nearly impossible for the common person to use. Unless you want to become pretty much PCI-DSS certified.

So you're surprised or concerned that applications that wish to extract financial data abour consumers programmatically from their bank accounts need to conform to regulations regarding the storage of said data ? Oh no. What a travesty.

From GP:

> API is going to be nearly impossible for the common person to use

Reading what you are replying to and making an argument against that rather than a hypothetical straw man that GP didn’t imply or mean will get you further.

Re: The Secret API of Banks

#76

Post by exegete »

heinrichf wrote: post #21

Many banks do not actually include any information in the notifications, because of the unencrypted nature of in-transit email. That is, "There has been a debit on your account" instead of "There has been a debit of X$ from merchant Y".

It'd be pretty neat to give a bank your public PGP key and then they could send you encrypted emails with more details.

Re: The Secret API of Banks

#77

Post by __jal »

jimmyswimmy wrote: post #54

I guess it's not popular or all that well-known anymore, but for quite a while there's been a Quicken-led banking interface for some banks. Known as OFX or Direct Connect, it provides at least one-way (download) access to banking transactions. I think there's a way to upload as well but have never used it nor had a bank that supports it for upload. My bank has a separate enrollment - it was free - offering download-o…

I used OFX for quite a while. Had a home-grown pile of scripts that did my budgeting/record keeping, and even reverse-engineered their payment submission system, and had nearly everything semi-automated to my personal satisfaction for a while.

And then they revamped everything, sprinkled security (and "security") pixie-dust around, and I gave up after locking myself out repeatedly trying to jump through the new hoops.

Re: The Secret API of Banks

#78

Post by kqr »

fastball wrote: post #57
kqr wrote: post #35

Earlier quoted context omitted.

This is, on one hand, great. I made the switch to a similar bank myself a few years back. What I failed to realise at the time was how exposed I became to the vulnerabilities associated with being cashless. Cash is not just an ancient relic. Cash is an ancient relic and a fundamental component of a free society. My country has, in practise, become nearly cashless and I used to be proud to be one of the very early ado…

I guess that's the target for anonymous cryptocurrencies like Monero and ZCash?

I'm skeptical of any tender that is rendered worthless by something as simple and common as an electrical outage.

Re: The Secret API of Banks

#79

Post by orf »

jsjohnst wrote: post #75
orf wrote: post #67

Earlier quoted context omitted.

So you're surprised or concerned that applications that wish to extract financial data abour consumers programmatically from their bank accounts need to conform to regulations regarding the storage of said data ? Oh no. What a travesty.

From GP: > API is going to be nearly impossible for the common person to use Reading what you are replying to and making an argument against that rather than a hypothetical straw man that GP didn’t imply or mean will get you further.

Apologies, I misread it as him complaining that small, one man startups will not be able to compete due to the necessary regulatory burden.

Re: The Secret API of Banks

#80

Post by jsjohnst »

spookthesunset wrote: post #39
TomMarius wrote: post #27

Earlier quoted context omitted.

What user facing aspects bug you the most?

- Instant, ultra-low cost inner-bank transfers. None of this "wait a day (or more)" ACH business or "send money via paypal, but then have to wait a day (or more) to ACH it into a real bank account". Useful for everything from paying friends back to moving money between two personal accounts. - ubiquitous NFC-based payment systems

> Instant, ultra-low cost inner-bank transfers.

I assume you mean inter-bank. Many US banks do instant transfer between accounts in the same bank, even if different account holders. On the inter-bank front, there’s Zelle that many US banks support that’s instant and free, but it has stupidly low limits. On the kinda instant front (aka under 15min), wiretransfers exist but they are a poor UX universally and have a steep fee generally (my bank does it for free, but I have to have a high end account for that).

Post reply on HN