101–110 of 257 posts
As a developer living in a country that has fully implemented "Open Banking", here's a quick setting of expectations for Canadian developers so they don't get too excited as I did when this was first being introduced. Open Banking is not, in fact, open in almost any sense of the world. It is standardised and the standards are freely available ("open"), but other than that, you still need to have an official "blessing…
This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.
2FA is so seriously lacking here it's not funny. TD Bank has 2FA which has been SMS-based for a very long time, and they just introduced a 2FA app. FYI. But yes on Tangerine (and other banks) being so, so behind. Sending a wire online here is pretty much impossible..!
Not to mention the fact that they still don't allow hardware tokens / U2F eg. Yubikey.
As a developer living in a country that has fully implemented "Open Banking", here's a quick setting of expectations for Canadian developers so they don't get too excited as I did when this was first being introduced. Open Banking is not, in fact, open in almost any sense of the world. It is standardised and the standards are freely available ("open"), but other than that, you still need to have an official "blessing…
What country are you in?
Earlier quoted context omitted.
As another canadian, here's something that occurred to me recently: we like to sling around the oligopoly argument when talking about telecoms, but when I bothered to look a bit into it, rather than finding some tightly knit mafia-like boys club, what I found is that the landscape is quite fragmented and messy (e.g. look at the scope of Telus' operations in Ontario vs Quebec, or look at how Sasktel operates, or look…
I feel like the rural coverage issue is misleading and overused. Look at their coverage maps: https://www.rogers.com/mobility/network-coverage-map?icid=R_... Most of my province (BC) is not covered. They cover the urban areas and some wider areas along highways in plateau regions. Where is this burdensome coverage that is keeping them expensive?
I don't know why OAuth tokens aren't the default solution to this. BoA recently added this as an option and it's way more straight forward than giving my login credentials to Personal Capital or, god forbid, Intuit. edit: Of course it helps if the 3rd parties implement it as well. I revoked access to Intuit but Personal Capital only lets me use my userID and password.
- Banks like locking down your financial data since it makes it more likely you'll continue to uses the auxiliary services they provide. Every bank I've used always has a built in send-money-to-friends and budgeting tool. By locking in your data, they help promote these service.
- But mainly, I suspect banks never lose customers because of a lack of an open banking data API. Consumers don't demand it. With no financial incentive, why would they make your data accessible? Also combine that with the increased risk exposure from providing API and it's easy to see why they don't exist.
Funnily, I suspect banks tacitly prefer screen scraping solutions like Plaid since it doesn't require the bank create any new product surface area that needs to be audited and secured. No new API endpoints to create. And in the event of a credential breach, it's easy to point the finger at the user who clearly just gave their password over to Plaid.
I don't know why OAuth tokens aren't the default solution to this. BoA recently added this as an option and it's way more straight forward than giving my login credentials to Personal Capital or, god forbid, Intuit. edit: Of course it helps if the 3rd parties implement it as well. I revoked access to Intuit but Personal Capital only lets me use my userID and password.
One reason is that (fintech) implementors get freaked out by OAuth's ~15min window where your token can be revoked but you still have access to the RP. It's an issue but a minor one. The alternative, ad hoc per-request session management, is so much worse in almost every way.
For all the OAuth API services I've worked on we'd just look up the access token in the database on each request, so a revoked token becomes useless immediately.
Earlier quoted context omitted.
As another canadian, here's something that occurred to me recently: we like to sling around the oligopoly argument when talking about telecoms, but when I bothered to look a bit into it, rather than finding some tightly knit mafia-like boys club, what I found is that the landscape is quite fragmented and messy (e.g. look at the scope of Telus' operations in Ontario vs Quebec, or look at how Sasktel operates, or look…
> The big telecom lobbying argument vs CRTC about how urban markets need to subsidize rural infrastructure costs is not something 95% of canadians like to hear, but it kinda makes sense (They say rural infra simply isn't cost effective because Canada is so expansive, but you expect high speed Internet access in your Muskoka cottage, right?) That still doesn't explain why internet service is way more expensive in Cana…
To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about? I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to up…
It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow,…
It’s worse than that. I assume Plaid doesn’t scrape bank sites and rely on 3rd parties to bypass the EULAs on bank sites.
Earlier quoted context omitted.
> YNAB (You Need A Budget) use services like Plaid to...take my username and password and impersonate me to get my banking data WHAT. THE. F. I'm a longtime, happy YNAB user. I had no idea this was going on until just now. I always just assumed there were secure APIs used to import my data. YNAB's Capital One "integration" stopped working a few years ago (possibly because they cracked down on screen scraping?) and I…
For future reference the tip off is that YNAB/Plaid asks for your bank account's username and password directly. If they were using some proper API, you'd be redirected to an Authorization page on your bank's domain where you could review the requested permissions and the app requesting, and then choose to grant it.
I have never noped out of anything so hard.