Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

finledger.com

Post reply on HN
Print view View original

31–40 of 257 posts

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#31

Post by lhorie »

ohazi wrote: post #24

To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about? I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to up…

This.

As others mentioned, the whole point of an effort towards OpenBanking is that services like Plaid literally store your username/password in their system and impersonate you to do whatever they do. Any software dev worth their salt would instinctively know this is a big security no-no, so to have this happen with your banking credentials of all things and on such a large scale seems insane to me.

An effort to implement OpenBanking is akin to working towards Android-style granular permissions instead of just granting root access to any third party who wants to do something on your behalf.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#32

Post by brailsafe »

version_five wrote: post #28
ohazi wrote: post #24

To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about? I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to up…

I guess you're talking to me. I'm not arguing for screen scraping. I'm stating my experience as a Canadian that our oligopolies use legislation like this as a way to discourage competition, under the guise of helping users. And they rely on people like you to talk about how great it is that we're all getting a made in Canada open banking solution when what we'll really get is something that makes new entry impossible…

Wouldn't this more or less be a protocol for any bank to implement? How would this lock people in to anything?

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#33

Post by javajosh »

jon-wood wrote: post #18
javajosh wrote: post #5

Earlier quoted context omitted.

One reason is that (fintech) implementors get freaked out by OAuth's ~15min window where your token can be revoked but you still have access to the RP. It's an issue but a minor one. The alternative, ad hoc per-request session management, is so much worse in almost every way.

There’s nothing in OAuth that would make that a limitation. Many people decide to issue JWTs without any sort of blacklisting of revoked tokens, but that’s not really a problem with the OAuth spec.

>blacklisting of revoked tokens

Ah, so a blacklist eh? ...Checked by an ad hoc per-request session mechanism perhaps?

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#34

Post by SilverRed »

ohazi wrote: post #24

To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about? I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to up…

We have a system like this in Australia already. The benefit of it is its a read only system so if criminals get access to your api key, they can list your details out but they can't take your money or do much useful. So much better than giving a 3rd party your login details.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#35

Post by echlebek »

version_five wrote: post #28
ohazi wrote: post #24

To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about? I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to up…

I guess you're talking to me. I'm not arguing for screen scraping. I'm stating my experience as a Canadian that our oligopolies use legislation like this as a way to discourage competition, under the guise of helping users. And they rely on people like you to talk about how great it is that we're all getting a made in Canada open banking solution when what we'll really get is something that makes new entry impossible…

So to recap, Canada without open banking: 5 big banks, impossible to compete.

Canada with open banking: 5 big banks, impossible to compete.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#36

Post by brailsafe »

jt2190 wrote: post #6

For those outside of Canada: The Canadian banking industry is highly centralized. This looks like a way to keep more nimble upstarts from actually getting started. (Not directly related, but Revolut recently retreated from the Canadian market, for example.)

Ya, but exactly what is your claim here beyond something like regulation kills the free market.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#37

Post by neom »

version_five wrote: post #28
ohazi wrote: post #24

To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about? I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to up…

I guess you're talking to me. I'm not arguing for screen scraping. I'm stating my experience as a Canadian that our oligopolies use legislation like this as a way to discourage competition, under the guise of helping users. And they rely on people like you to talk about how great it is that we're all getting a made in Canada open banking solution when what we'll really get is something that makes new entry impossible…

I'm curious what you think you would get from a deregulated banking sector and a deregulated telecom sector? As far as I see it, people in Thunder Bay, Swan River, Bas-Saint-Laurent, or, etc etc wouldn't have had cell service for a long time, maybe even still today, and we might have cheaper cell plans and more data and faster speeds in Toronto and Vancouver. Canadian economy would be in a considerably weaker position with more Canadians in poor financial situations, but we had a wider range of products and services? I can only see deregulation of those sectors being self serving, I don't think it helps all Canadians at large, and I think that's what being a Canadian is all aboot.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#38

Post by SilverRed »

frosted-flakes wrote: post #13

It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow,…

I think the future is that banks/bank apps will do the budgeting stuff themselves. Most bank apps will now break down your monthly spending by categories. My bank app shows me my weekly and monthly spend compared to previous periods, how much I spent in each category, how much I spent at each business, how much I have spent this month so far compared to the same time last month and etc.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#40

Post by SilverRed »

vesinisa wrote: post #26
manishsharan wrote: post #12

This may be driven by TD's suit against Plaid From this source https://www.lexology.com/library/detail.aspx?g=8f56092c-ab40... "Users have complained that after connecting their bank accounts, Plaid stores their credentials and uses them to collect 5 years’ of transactional data and continues to track users’ data in future. Users further claim that the data-gathering scheme is not incidental to Plaid’s business model…

Holy smokes, that is shady and scary.

It's not shady, its the explicit purpose of these apps, they collect your transaction data and show you more detailed analysis of it. Since there is no API to safely get the data in a read only way, the only option is to screen scrape the banks website.
Post reply on HN