Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
1–10 of 257 posts
Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
#2I'm guessing from this that Canada's banks are upset about getting their grass cut and are looking to regulate new entrants out of business. That's usually what a "made in Canada" solution means.
Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
#3I don't know why OAuth tokens aren't the default solution to this. BoA recently added this as an option and it's way more straight forward than giving my login credentials to Personal Capital or, god forbid, Intuit.
edit: Of course it helps if the 3rd parties implement it as well. I revoked access to Intuit but Personal Capital only lets me use my userID and password.
Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
#4This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.
Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
#5I don't know why OAuth tokens aren't the default solution to this. BoA recently added this as an option and it's way more straight forward than giving my login credentials to Personal Capital or, god forbid, Intuit. edit: Of course it helps if the 3rd parties implement it as well. I revoked access to Intuit but Personal Capital only lets me use my userID and password.
One reason is that (fintech) implementors get freaked out by OAuth's ~15min window where your token can be revoked but you still have access to the RP.
It's an issue but a minor one. The alternative, ad hoc per-request session management, is so much worse in almost every way.
Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
#6For those outside of Canada: The Canadian banking industry is highly centralized. This looks like a way to keep more nimble upstarts from actually getting started.
(Not directly related, but Revolut recently retreated from the Canadian market, for example.)
Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
#7[deleted]
Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
#8I'm guessing from this that Canada's banks are upset about getting their grass cut and are looking to regulate new entrants out of business. That's usually what a "made in Canada" solution means.
How so? Giving your banking credentials to a third-party for it to login and screen-scrape is not secure. Mandating that banks provide an API instead for third-party apps to use won't necessarily 'regulate new entrants out of business'.
Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
#9This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.
> Tangerine
At least they used to have decent interest rates... now what's the point? they don't even have physical banks.
Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
#10What's open banking? What's the context?