Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

finledger.com

Post reply on HN
Print view View original

151–160 of 257 posts

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#151

Post by smnrchrds »

poopsmithe wrote: post #116
xibalba wrote: post #92

Earlier quoted context omitted.

> YNAB (You Need A Budget) use services like Plaid to...take my username and password and impersonate me to get my banking data WHAT. THE. F. I'm a longtime, happy YNAB user. I had no idea this was going on until just now. I always just assumed there were secure APIs used to import my data. YNAB's Capital One "integration" stopped working a few years ago (possibly because they cracked down on screen scraping?) and I…

You gave them your bank account login credentials and you didn't think it was strange?

Plaid has designed the screens to resemble each bank's login screen. They essentially phish people. I, as a tech-savvy person, noticed something was up when I saw the URL didn't match my bank's. But most people would put in their password, thinking they are logging into their bank's website, and would be none the wiser.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#152

Post by JamisonM »

nezgar wrote: post #122
JamisonM wrote: post #60

Earlier quoted context omitted.

But sending you an SMS is a lot more security than no 2FA at all, right? I am aware of attacks that state/very sophisticated actors can use to intercept SMS messages but that's a serious edge case for a normal person, right?

It's not secure at all, as some services (PayPal!) Allow password reset via SMS to your regitered mobile number. So if someone even has control of your mobile number via sim swap for 5 minutes they gain full control of your paypal acct. Heard of enough incidents of this earlier this year through one of the Canadian prepaid mobile flanker brands... Paypal makes it hard to remove a mobile number from your account once…

> Heard of enough incidents of this earlier this year through one of the Canadian prepaid mobile flanker brands..

Please explain, sorry I did not hear about this.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#153

Post by Beldin »

xmodem wrote: post #144
Jarwain wrote: post #129

Earlier quoted context omitted.

How is that enforced? What is the technical basis that enforces read-only access using user/password auth? Especially since that user/password auth is used by an end user to do "write"-type actions?

It's enforced - sometimes - by the bank. My bank provides read access to everything with a username + password, but to transfer money or update details requires an SMS confirmation.

I remember a presentation by the head of security of an Internet-only bank years ago, about banking malware.

The latest malware was a man-in-the-browser style one: it intercepted your input and changed what you saw on-screen. This was used to defeat extra authentication: the malware inserted a (fake) deposit (something like "yearly subscription mr. X" for $2134.56) into your on-screen total and phoned home. The victim was then called by a mr. X who claimed to have accidentally swapped two digits in a transfer, and that the bank had said they can't fix it because the target account was a valid account. All they could do was exceptionally give out the phone number of the receiving side. Would you be so kind to rectify the situation?

Since mr. X had all the details correct (amount, statement on transaction), the victim would initiate and authenticate a transfer. No way for the bank to detect, as this wouls be a genuine transfer order by the account owner.

To be clear: the attack requires a victim whose browser is hacked and an associated phone number. That seemed like a tall order to me, but apparently not tall enough to stop this attack from being integrated into multi-banking malware.

In short: read-only access is good, but not sufficient to prevent all attacks.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#154

Post by phoenixy1 »

I have some issues with the wording in this article (I work at Plaid and I don't think everything it says about us is accurate) but the report is a good thing. Right now we really are dependent on screen scraping at many banks and we'd much rather use API-based connections to power our services, but so many banks just don't provide APIs. I'm optimistic for an open banking future in Canada and who knows, maybe even the US some day...

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#155

Post by Fogest »

lucasyvas wrote: post #148
Fogest wrote: post #145

Earlier quoted context omitted.

Let's be real, banks wouldn't see government regulation like this if something like Plaid didn't force them to have to implement more secure ways to get your own financial data.

I actually do agree - but two wrongs don't make a right here. Taking raw credentials from users without them knowing is completely messed up and a massive danger to the end-user. It's not justifiable in those terms.

Yes I agree it can be scary, but it seems like this is the way a lot of companies have to do things if they want regulation to change at any reasonable pace.

Just look at Uber and AirBnB as examples. Most cities they started in they were operating in kinda grey areas or even breaking laws. But they could afford to eat any fines and continue on anyway. It forced governments to put regulations in place to support these systems.

Especially when it comes to banking, it moves at such a snails pace for anything to ever evolve. The two banks I am with in Canada only just recently finally added support for 2FA. But it's not even the type where you can use your own authenticator app. You have to use SMS, Phone Call, or their app. My one bank has my "password" being restricted to 6 characters. It's basically got to be a 6 digit pin. It's incredibly insecure already, Plaid doesn't make it much worse.

Now with 2FA finally there I feel a lot more secure using Plaid. Because now everytime I want to import my transactions in YNAB I have to enter my 2FA code before it can pull things.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#156

Post by xibalba »

poopsmithe wrote: post #116
xibalba wrote: post #92

Earlier quoted context omitted.

> YNAB (You Need A Budget) use services like Plaid to...take my username and password and impersonate me to get my banking data WHAT. THE. F. I'm a longtime, happy YNAB user. I had no idea this was going on until just now. I always just assumed there were secure APIs used to import my data. YNAB's Capital One "integration" stopped working a few years ago (possibly because they cracked down on screen scraping?) and I…

You gave them your bank account login credentials and you didn't think it was strange?

As another HNer responded: cred screens are given the appearance of being your financial institution, so I assumed an api auth token being issued after “logging in” with the institution. Still, shame on me for not inspecting more closely.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#157

Post by canada_dry »

Given the tech savvy HN user base I'm surprised at all the "I'm surprised these 3rd party services are just impersonating me".

I'd love it if there were API's to access my banking data directly, but failing that I rely on the meager "txn download via csv" my Canadian banks offer (at least).

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#158

Post by phoenixy1 »

manishsharan wrote: post #12

This may be driven by TD's suit against Plaid From this source https://www.lexology.com/library/detail.aspx?g=8f56092c-ab40... "Users have complained that after connecting their bank accounts, Plaid stores their credentials and uses them to collect 5 years’ of transactional data and continues to track users’ data in future. Users further claim that the data-gathering scheme is not incidental to Plaid’s business model…

Probably not? The suit was dismissed. Sorry for the paywall but I can't find a better source: https://news.bloomberglaw.com/banking-law/td-bank-plaid-sett...

[full disclosure: I work at Plaid]

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#160

Post by westurner »

ceejayoz wrote: post #141
lucasyvas wrote: post #134

Earlier quoted context omitted.

Read-only access is not possible. By handing over the credentials you are handing over write access. You are correct.

A couple of my banking institutions let me generate a read-only set of credentials for this sort of purpose. Citi and Capital One have OAuth flows that Plaid supports, too, which tends to make me angrier at the banks than Plaid; the need for this stuff has been clear for a decade now, but only a few have added OAuth or similar.

AFAIU, there are still zero (0) consumer banking APIs with Read-Only e.g. OAuth APIs in the US as well?

Banks could save themselves CPU, RAM, bandwidth, and liability by implementing read-only API tokens and methods that need only return JSON - instead of HTML or worse, monthly PDF tables for a fee - possibly similar to the Plaid API: https://plaid.com/docs/api/

There is competition in consumer/retail banking, but still the only way to do e.g. budget and fraud analysis with third party apps is to give away all authentication factors: u/p/sqa; and TBH that's unacceptable.

Traditional and distributed ledger service providers might also consider W3C ILP: Interledger Protocol (in starting their move to quantum-resistant ledgers by 2022 in order to have a 5 year refresh cycle before QC is a real risk by 2027, optimistically, for science) when reviewing the entropy of username+password_hash+security_question_answer strings in comparison to the entropy of cryptoasset account public key hash strings: https://interledger.org/developer-tools/get-started/overview...

> Sender – Initiates a value transfer.

> Router (Connector) – Applies currency exchange and forwards packets of value. This is an intermediary node between the sender and the receiver. {MSB: KYC, AML, 10k reporting requirement, etc}

> Receiver – Receives the value

Multifactor authentication: Something you have, something you know, something you are

Multisig: n-of-m keys required to approve a transaction

Edit: from "Fed announces details of new interbank service to support instant payments" https://news.ycombinator.com/item?id=24109576 :

> For purposes of Interledger, we call all settlement systems ledgers. These can include banks, blockchains, peer-to-peer payment schemes, automated clearing house (ACH), mobile money institutions, central-bank operated real-time gross settlement (RTGS) systems, and even more. […]

> You can envision the Interledger as a graph where the points are individual nodes and the edges are accounts between two parties. Parties with only one account can send or receive through the party on the other side of that account. Parties with two or more accounts are connectors, who can facilitate payments to or from anyone they're connected to.

> Connectors [AKA routers] provide a service of forwarding packets and relaying money, and they take on some risk when they do so. In exchange, connectors can charge fees and derive a profit from these services. In the open network of the Interledger, connectors are expected to compete among one another to offer the best balance of speed, reliability, coverage, and cost.

W3C ILP: Interledger Protocol > Peering, Clearing and Settling: https://interledger.org/rfcs/0032-peering-clearing-settlemen...

Post reply on HN