Live data from Hacker News

Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

finledger.com

51–60 of 257 posts

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#51

Brazil started Open Banking at 2019 https://www.bcb.gov.br/en/financialstability/open_banking

The planning is there. The second phase started on august 18th and encompasses sharing your info with different parties (consensually). Next phase is actually hiring services and more interesting stuff.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#52

It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow,…

To be fair, YNAB is rather explicit about how it connects to your accounts and also actively recommends against doing so in favor of manually entering your transactions. My experience with connecting the two is that I still need to manually validate every transaction because on occasion Plaid is either slow or just misses entries entirely. Also in the case of YNAB, Plaid is not posting transactions on your accounts.…

I manually enter all of my transactions, but for correcting mistakes or for automatic payments, linking to my bank accounts is still very useful.

Also, some accounts update faster than others for some reason. Usually YNAB will import them the same day.

Plaid doesn't post transactions, but it does have my credentials which I said I would not share with anyone when I opened my bank account. Those credentials do allow posting transactions, and while it's not likely that anything will happen, if something does, I'm theoretically responsible. At the moment, I'm willing to take that risk.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#53
post #24

To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about? I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to up…

Yeah PSD2 in Europe has been live for a bit and it’s magic.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#54
post #24

To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about? I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to up…

We have a system like this in Australia already. The benefit of it is its a read only system so if criminals get access to your api key, they can list your details out but they can't take your money or do much useful. So much better than giving a 3rd party your login details.

Can you share the systems that provide read only API access please? I've tried to find services like them numerous times over the years but have failed at piercing the cloud of opaqueness that seems to surround banking.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#55

Earlier quoted context omitted.

We have a system like this in Australia already. The benefit of it is its a read only system so if criminals get access to your api key, they can list your details out but they can't take your money or do much useful. So much better than giving a 3rd party your login details.

Can you share the systems that provide read only API access please? I've tried to find services like them numerous times over the years but have failed at piercing the cloud of opaqueness that seems to surround banking.

Up bank has a read only api.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#56

It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow,…

I think the future is that banks/bank apps will do the budgeting stuff themselves. Most bank apps will now break down your monthly spending by categories. My bank app shows me my weekly and monthly spend compared to previous periods, how much I spent in each category, how much I spent at each business, how much I have spent this month so far compared to the same time last month and etc.

My bank does that too, and has done so for many years now. It's close to useless though, because I have no control over it. YNAB isn't just historical trends, it's a budgeting program.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#57

Earlier quoted context omitted.

So to recap, Canada without open banking: 5 big banks, impossible to compete. Canada with open banking: 5 big banks, impossible to compete.

I believe he’s saying that adding this flavor of open banking regulation, on top of the others, further entrenches the incumbents, meaning the situation is not identical as future unwinding of these defenses will have more work to do. In addition, the “open banking” would be implemented in a less than ideal way from the perspective of consumers and squander an opportunity to meaningfully improve retail banking and th…

I find it hard to believe that the current situation could get any worse for consumers.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#58

It’s interesting to me how quickly I’ve soured on the concept of open banking, which on paper sounds fantastic and originally I was very much in favour of. And which I’ve used personally to make it easier to extract my own data for my own use. However more often than not now I’m seeing it used for really invasive applications. Such as when I rented my most recent apartment and they asked to use open banking to verify…

I feel the same. The convenience will likely outweigh the security concerns in the not too distant future.

What I would like is some middle step - that instead of allowing open access to accounts, I get to choose how the data is summarised and presented. e.g. just show total income and outgoings, fortnightly, over the last 6 months. Things like that.

Yes, I could export the transactions, do some Excel hand waving and make a report, then make a PDF and send it, then they would do data entry into their system summarising what they read. But automating that data sharing step would be fantastic.

I am in the process of applying for a home loan at the moment, and the amount of documentation is significant. If I were able to automate 80% of it in a fairly anonymised data way, that would be really useful.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#59
post #24

To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about? I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to up…

I guess you're talking to me. I'm not arguing for screen scraping. I'm stating my experience as a Canadian that our oligopolies use legislation like this as a way to discourage competition, under the guise of helping users. And they rely on people like you to talk about how great it is that we're all getting a made in Canada open banking solution when what we'll really get is something that makes new entry impossible…

The process you are describing is ["regulatory capture"](https://en.wikipedia.org/wiki/Regulatory_capture) It isn't Canada specific. It is the rule for everyone, for all people, and for all times. The people with the most incentive to corrupt a corporate governing body are the corporations that are being governed themselves. No one else cares as much as they do.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#60
post #4

This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.

> Obviously no 2FA. Don't worry, you really aren't missing out on much security because the 2FA most banks implement just involves sending you an SMS.

But sending you an SMS is a lot more security than no 2FA at all, right?

I am aware of attacks that state/very sophisticated actors can use to intercept SMS messages but that's a serious edge case for a normal person, right?

Post reply on HN