Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Secret API of Banks

gduverger.com

Post reply on HN
Print view View original

141–150 of 257 posts

Re: The Secret API of Banks

#141

Post by RickS »

yurishimo wrote: post #61

Posts like this make me pretty excited to be a customer of a "tech-y" online bank. (In my case, Simple, not shilling, I just like them) Theoretically, these banks with great mobile apps are one step away from giving you API access once it's needed/wanted by enough consumers. Technically, your phone is doing it under the hood already. Simple uses React for their web interface, so I imagine they have nice JSON APIs for…

You can prod the network panel to reverse engineer simple's APIs. I've done it for some visualization tools in the past.

It's sloppy and undocumented, but their support staff are fantastic and surprisingly technical, so I had about a 100% success rate tweeting them things like "what's the new endpoint for what was previously /bank/transactions?"

A public version of this API was one of their stated goals in 2010 or so, but they're more interested in chasing non-technical product goals like couples accounts. I expect their most technical customers don't make up enough transaction volume to justify attention.

I love simple for being the least worst, but am still saddened by what they could have been if they had stripe's passion for technical execution. But hey, at least there's an API and they won't slap you with the CFAA for hitting it.

Re: The Secret API of Banks

#142

Post by RickS »

There's so much cool stuff you can do with this data. Think of all the creepy shit amazon does with your browsing data, but for your spending data, and you can browse it.

We're leaving a crazy amount of insight on the table.

Shameless plug: I built some personal finance viz tools based on similar data. they also just barely scratch the surface: http://rick.xxx/orchid.html

If you're working on interesting things in the fintech space, I'd love to chat with you about strategy or execution, especially w/r/t product design. Email in profile.

Re: The Secret API of Banks

#144

Post by TeMPOraL »

ummonk wrote: post #132
Rjevski wrote: post #42

Earlier quoted context omitted.

PSD2 and “open” banking is bullshit. I wish this myth would die - it is anything but “open”. If you want to gain access to API s , you need to become an “AISP” (as they are called in the UK), this requires a certification and a load of other nonsense akin to PCI-DSS. This is for read-only access - for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requi…

So you are saying Cambridge Analytica wouldn't be able to get access to people's banking data by marketing some sort of convenience app to them?

It sound more like Cambridge Analytica will be able to get access to people's banking data by making themselves an AISP, while I still have to scrap my fucking bank site to automate my own finanses. This is totally backwards, but that's profit motive for you.

Re: The Secret API of Banks

#145

Post by KirinDave »

ikeboy wrote: post #136
KirinDave wrote: post #128

Earlier quoted context omitted.

Hi, I founded Level Money, was one of Intuit's earliest aggcat customers and one of their last customers, and did this for a lot of people until Capital One bought my company and we did it for them. AMA, I guess. But to answer the implicit question: shutting that off can be harder than it sounds. And because it's a mobile API and iOS's store has fairly slow update cycles, it can be very hard to simply rotate your API…

Why is shutting it difficult? Any IP that logs into more than 5 accounts within a day gets a ban. They can use proxies but eventually will run out. You can also use your own canary accounts, provide them to the service you want to block, and ban any IP that tries to log in

You've just banned every client coming from a workplace with a private network, every client on a commercial VPN service, and every client using Starbucks wifi.

Enjoy your customer service costs. On the plus side, bank have really good customer retention once they capture a customer.

Re: The Secret API of Banks

#146

Post by pbreit »

dewey wrote: post #8

For those in the EU there's something interesting coming next year, banks need to provide open API to interact with each other: https://thenextweb.com/worldofbanking/2018/06/27/openbanking... Already right now in Germany there are a lot of banks that share a common API format which is why there are a lot of banking apps where you can just log into your bank and don't need bank specific apps. It's called HBCI / FinTS…

I've always kind of wondered if XML/JSON delivered over SMTP was a viable webhook approach?

Re: The Secret API of Banks

#147

Post by TeMPOraL »

toomuchtodo wrote: post #117
stephengillie wrote: post #108

Earlier quoted context omitted.

Why don't banks sell API access at a rate s/similar/lower than Google Maps API access? This is starting to feel like music and video piracy all over again.

Because the value is in not being commodified. Not giving API access is worth more than charging for it. If all of your credit lines, checking, savings, and investment accounts were an API call away, the institutions providing those no longer build relationships that can be profitable; they're simply utilities you could swap out interchangeably. As such, they're not a fan of this idea.

> they're simply utilities you could swap out interchangeably. As such, they're not a fan of this idea.

It's sad, because that's exactly what they should be. :/.

Re: The Secret API of Banks

#148

Post by TeMPOraL »

orf wrote: post #38
misterbwong wrote: post #18

This is very clever but makes me sad. It’s 2018 and the best, cleanest way of monitoring and storing my own transactions programmatically is by scraping an email.

*in America Banks provide an API in Europe. In fact it's a legal requirement that's coming into force in 2019, and there are a lot of 'mobile-first' banks like Monzo and Revolut which make this entirely un-needed in the first place (providing spending exports, decent analytics, push notifications, etc etc). Welcome to the future. Contact your local politician if you want to join us. Maybe also ask about chip and pin…

Are you sure?

Looking here[0], it seems the future is fake, and the EU is no better than the US in this regard. Even after 2019, I'll still have to scrape bank's website and manual exports to get my own data out in usable format.

--

[0] - https://news.ycombinator.com/item?id=17718782

Re: The Secret API of Banks

#149

Post by ikeboy »

KirinDave wrote: post #145
ikeboy wrote: post #136

Earlier quoted context omitted.

Why is shutting it difficult? Any IP that logs into more than 5 accounts within a day gets a ban. They can use proxies but eventually will run out. You can also use your own canary accounts, provide them to the service you want to block, and ban any IP that tries to log in

You've just banned every client coming from a workplace with a private network, every client on a commercial VPN service, and every client using Starbucks wifi. Enjoy your customer service costs. On the plus side, bank have really good customer retention once they capture a customer.

Doubt over 5 people log in to a single bank from most starbucks over a 24 hour period.

If it's a big enough bank, the threshold should be higher. But they can easily pull the data and set a threshold that cuts off only the peak of the distribution

Re: The Secret API of Banks

#150

Post by KirinDave »

ikeboy wrote: post #149
KirinDave wrote: post #145

Earlier quoted context omitted.

You've just banned every client coming from a workplace with a private network, every client on a commercial VPN service, and every client using Starbucks wifi. Enjoy your customer service costs. On the plus side, bank have really good customer retention once they capture a customer.

Doubt over 5 people log in to a single bank from most starbucks over a 24 hour period. If it's a big enough bank, the threshold should be higher. But they can easily pull the data and set a threshold that cuts off only the peak of the distribution

You'd certainly better hope so. A national bank going down is national news. You're gonna end up sending some muckety muck out to the press to bob their heads and apologize. They'd don't take kindly to that.

My prior investigations suggest that this strategy is ineffective. You suss out a ratelimit then pick a CSP and start spawning instances. Bonus points if it's a CSP that has a contract with that bank, they'll be petrified to try blocking you. Even well run consumer orgs can get tripped up with that.

But you're also suggesting that banks can use that data in that way or that that the relevant parties had the necessary capability at the time in question. Both are propositions you can make your own judgement on.

Here's another question: what happens when customers complain that you're cutting off their aggregtion service? You have your customer service reps say, "Sorry we locked you out of getting your own data?" Sounds like if you do that enough we have another press row. Thank goodness the CFPB was gutted, they loved 3rd party resale-to-consumer aggregtion services.

Post reply on HN