Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

finledger.com

Post reply on HN
Print view View original

91–100 of 257 posts

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#91

Post by Dylan16807 »

version_five wrote: post #28
ohazi wrote: post #24

To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about? I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to up…

I guess you're talking to me. I'm not arguing for screen scraping. I'm stating my experience as a Canadian that our oligopolies use legislation like this as a way to discourage competition, under the guise of helping users. And they rely on people like you to talk about how great it is that we're all getting a made in Canada open banking solution when what we'll really get is something that makes new entry impossible…

> Edit: I see this is a losing battle, the comments responding to the parent seem to imply that he is championing open banking against a group that disagree with it. And the replies to me think that I don't want open banking. Enjoy your discussion

It would help if you specified a problem with the proposal or with the Advisory Committee on Open Banking in particular. If you can't, then a guess of "Canada's banks are upset about competition" is a really exaggerated immediate post.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#92

Post by xibalba »

frosted-flakes wrote: post #13

It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow,…

> YNAB (You Need A Budget) use services like Plaid to...take my username and password and impersonate me to get my banking data

WHAT. THE. F.

I'm a longtime, happy YNAB user. I had no idea this was going on until just now. I always just assumed there were secure APIs used to import my data. YNAB's Capital One "integration" stopped working a few years ago (possibly because they cracked down on screen scraping?) and I was upset with Capital One. Perhaps Capital One took steps to prevent insecure access/screen scraping?

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#93

Post by beachy »

kaolinite wrote: post #41

It’s interesting to me how quickly I’ve soured on the concept of open banking, which on paper sounds fantastic and originally I was very much in favour of. And which I’ve used personally to make it easier to extract my own data for my own use. However more often than not now I’m seeing it used for really invasive applications. Such as when I rented my most recent apartment and they asked to use open banking to verify…

> Such as when I rented my most recent apartment and they asked to use open banking to verify our finances

There was a Launch HN recently that did just this, but for people like Uber drivers wanting to borrow money to buy their own car. They handed over their Uber credentials, and the service scraped their Uber history to determine whether they were a good risk or not.

I'm not usually into slippery slope arguments but what your landlord asked of you is just that little bit worse than their service (worse as they have access to your bank account, not just your payroll data).

I think the moral of the story is that as a provider (Uber, a bank), you should be proactive about providing read-only access to data, removing the need for screen scraping and providing better security to your drivers/customers.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#94

Post by grouseway »

lhorie wrote: post #63
version_five wrote: post #28

Earlier quoted context omitted.

I guess you're talking to me. I'm not arguing for screen scraping. I'm stating my experience as a Canadian that our oligopolies use legislation like this as a way to discourage competition, under the guise of helping users. And they rely on people like you to talk about how great it is that we're all getting a made in Canada open banking solution when what we'll really get is something that makes new entry impossible…

As another canadian, here's something that occurred to me recently: we like to sling around the oligopoly argument when talking about telecoms, but when I bothered to look a bit into it, rather than finding some tightly knit mafia-like boys club, what I found is that the landscape is quite fragmented and messy (e.g. look at the scope of Telus' operations in Ontario vs Quebec, or look at how Sasktel operates, or look…

I feel like the rural coverage issue is misleading and overused. Look at their coverage maps:

https://www.rogers.com/mobility/network-coverage-map?icid=R_...

Most of my province (BC) is not covered. They cover the urban areas and some wider areas along highways in plateau regions. Where is this burdensome coverage that is keeping them expensive?

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#95

Post by jt2190 »

franga2000 wrote: post #70

As a developer living in a country that has fully implemented "Open Banking", here's a quick setting of expectations for Canadian developers so they don't get too excited as I did when this was first being introduced. Open Banking is not, in fact, open in almost any sense of the world. It is standardised and the standards are freely available ("open"), but other than that, you still need to have an official "blessing…

What country are you in?

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#96

Post by lhorie »

munk-a wrote: post #82
lhorie wrote: post #63

Earlier quoted context omitted.

As another canadian, here's something that occurred to me recently: we like to sling around the oligopoly argument when talking about telecoms, but when I bothered to look a bit into it, rather than finding some tightly knit mafia-like boys club, what I found is that the landscape is quite fragmented and messy (e.g. look at the scope of Telus' operations in Ontario vs Quebec, or look at how Sasktel operates, or look…

> The big telecom lobbying argument vs CRTC about how urban markets need to subsidize rural infrastructure costs is not something 95% of canadians like to hear, but it kinda makes sense For some groups (especially reservations where their location to practice independent governance is government mandated) I can absolutely sympathize - but for most of the rest of rural Canada - uh why? Urban centers like Toronto and V…

I think Novus, Fibrestream and friends are good examples that support the idea that the market is healthy and oligopolies don't have the ability to use their position to choke out smaller players.

I'd wager that Canada is still largely a wild west when it comes to physical copper coverage. Meaning big players do project long term profit from rural markets and actively invest in them, but that the projections aren't sustainable below some price threshold, hence butting heads with CRTC to make the math work out.

As for the notion that country bumpkins ought to be satisfied with inconvenience, I'm not sure how to respond other than more and more they expect modern things to be available to them. A customer is never in their right mind going to shoulder a 100k upfront cost to lay fiber to a town, so if someone wants to make the cost benefit analysis, it's most likely going to be one of the big players, IMHO

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#97

Post by JamisonM »

franga2000 wrote: post #76
JamisonM wrote: post #60

Earlier quoted context omitted.

But sending you an SMS is a lot more security than no 2FA at all, right? I am aware of attacks that state/very sophisticated actors can use to intercept SMS messages but that's a serious edge case for a normal person, right?

Depends on where you are - a SIM swap attack is surprisingly easy to do in many places. But more generally, a sophisticated actor doesn't have to be targeting you specifically. Many people assume that "nobody would put in so much effort to steal from me ", but they don't have to be. A sophisticated attacker with the capability to intercept SMS would likely be casting a very wide net. Once people start noticing, they'…

This argument seems strange to me.. how many attacks are by someone literally armed with a customer list from a financial institution? The "casting a wide net" seems directly opposed to the effort involved in a SMS intercept attack which requires significant resources. I don't see a practical circumstance where this is a reasonable risk I guess. I just don't know. I would love an article-length explainer out there somewhere I guess, I just haven't seen one.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#98

Post by ghostpepper »

franga2000 wrote: post #70

As a developer living in a country that has fully implemented "Open Banking", here's a quick setting of expectations for Canadian developers so they don't get too excited as I did when this was first being introduced. Open Banking is not, in fact, open in almost any sense of the world. It is standardised and the standards are freely available ("open"), but other than that, you still need to have an official "blessing…

As a Canadian who has been waiting for the hypothetical ideal situation you describe since Mint and YNAB launched in Canada, that is disappointing to hear. Perhaps there will be a startup that can jump through the hoops and then provide some sort of programmability / webhook access to end users.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#99

Post by frosted-flakes »

munk-a wrote: post #82
lhorie wrote: post #63

Earlier quoted context omitted.

As another canadian, here's something that occurred to me recently: we like to sling around the oligopoly argument when talking about telecoms, but when I bothered to look a bit into it, rather than finding some tightly knit mafia-like boys club, what I found is that the landscape is quite fragmented and messy (e.g. look at the scope of Telus' operations in Ontario vs Quebec, or look at how Sasktel operates, or look…

> The big telecom lobbying argument vs CRTC about how urban markets need to subsidize rural infrastructure costs is not something 95% of canadians like to hear, but it kinda makes sense For some groups (especially reservations where their location to practice independent governance is government mandated) I can absolutely sympathize - but for most of the rest of rural Canada - uh why? Urban centers like Toronto and V…

Are you really comparing live operas and plays to Internet access? One is a luxury. The other is a necessary utility (that also facilitates other luxuries, but that's beside the point, because there's a lot of things you need the utility for).

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#100

Post by varenc »

xibalba wrote: post #92
frosted-flakes wrote: post #13

It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow,…

> YNAB (You Need A Budget) use services like Plaid to...take my username and password and impersonate me to get my banking data WHAT. THE. F. I'm a longtime, happy YNAB user. I had no idea this was going on until just now. I always just assumed there were secure APIs used to import my data. YNAB's Capital One "integration" stopped working a few years ago (possibly because they cracked down on screen scraping?) and I…

For future reference the tip off is that YNAB/Plaid asks for your bank account's username and password directly. If they were using some proper API, you'd be redirected to an Authorization page on your bank's domain where you could review the requested permissions and the app requesting, and then choose to grant it.
Post reply on HN