Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

finledger.com

Post reply on HN
Print view View original

11–20 of 257 posts

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#11

Post by neom »

version_five wrote: post #2

I'm guessing from this that Canada's banks are upset about getting their grass cut and are looking to regulate new entrants out of business. That's usually what a "made in Canada" solution means.

As a Canadian, I'm strongly in favour of a heavily regulated banking sector[1][2]. The report[3] mostly just describes that banks need to figure out some kinda API that allows me to authorize apps to access everything I could access from the front end. Seems reasonable? The report is good, and the orignal recommendation report from 2019 is also quite good.[4]

[1] https://cba.ca/global-banking-regulations-and-banks-in-canad... (I realize this is effectively banking regulator propaganda, nevertheless, facts are there)

[2] https://www.brookings.edu/research/know-thy-neighbor-what-ca...

[3] https://www.canada.ca/en/department-finance/programs/consult...

[4 ]https://www.canada.ca/en/department-finance/programs/consult...

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#12

Post by manishsharan »

This may be driven by TD's suit against Plaid

From this source https://www.lexology.com/library/detail.aspx?g=8f56092c-ab40...

"Users have complained that after connecting their bank accounts, Plaid stores their credentials and uses them to collect 5 years’ of transactional data and continues to track users’ data in future. Users further claim that the data-gathering scheme is not incidental to Plaid’s business model and is, in fact, its “very purpose.”

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#13

Post by frosted-flakes »

It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow, is there any recourse?

Hopefully individuals will be able to use the Open Banking APIs to access their own data directly, but it looks like accreditation will be required, so probably not.

Here's the full text of the report: https://www.canada.ca/en/department-finance/programs/consult...

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#15

Post by gregsadetsky »

barbazoo wrote: post #4

This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.

2FA is so seriously lacking here it's not funny.

TD Bank has 2FA which has been SMS-based for a very long time, and they just introduced a 2FA app. FYI.

But yes on Tangerine (and other banks) being so, so behind. Sending a wire online here is pretty much impossible..!

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#16

Post by version_five »

jt2190 wrote: post #6

For those outside of Canada: The Canadian banking industry is highly centralized. This looks like a way to keep more nimble upstarts from actually getting started. (Not directly related, but Revolut recently retreated from the Canadian market, for example.)

Agreed. See the replies to my other comment in this thread. Open banking as a concept is a great idea, in Canada it will be a used strategically as a way to limit competition.

Edit: I'd be happy to be wrong, you can let me know when Canada sees a flood of great new banking startups in the next couple years

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#17

Post by barbazoo »

SevenSigs wrote: post #9
barbazoo wrote: post #4

This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.

> Tangerine At least they used to have decent interest rates... now what's the point? they don't even have physical banks.

Overall it's a pretty good deal, no fee accounts, unlimited etransfers, decent credit card, good customer support, things like that. Back when I was shopping for no fee accounts this was the best deal there was.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#18

Post by jon-wood »

javajosh wrote: post #5
llbeansandrice wrote: post #3

I don't know why OAuth tokens aren't the default solution to this. BoA recently added this as an option and it's way more straight forward than giving my login credentials to Personal Capital or, god forbid, Intuit. edit: Of course it helps if the 3rd parties implement it as well. I revoked access to Intuit but Personal Capital only lets me use my userID and password.

One reason is that (fintech) implementors get freaked out by OAuth's ~15min window where your token can be revoked but you still have access to the RP. It's an issue but a minor one. The alternative, ad hoc per-request session management, is so much worse in almost every way.

There’s nothing in OAuth that would make that a limitation. Many people decide to issue JWTs without any sort of blacklisting of revoked tokens, but that’s not really a problem with the OAuth spec.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#20

Post by james_pm »

SevenSigs wrote: post #9
barbazoo wrote: post #4

This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.

> Tangerine At least they used to have decent interest rates... now what's the point? they don't even have physical banks.

Low/no fees mostly. A standard bank account at the big banks gives you few Interac transactions, for example, unless you either pay $12.99 a month or have >$3,000 in your account at all times. Tangerine provides unlimited Interac payments on a chequing account with no monthly fee.
Post reply on HN