Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

finledger.com

Post reply on HN
Print view View original

251–257 of 257 posts

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#251

Post by gigatexal »

skrause wrote: post #227
gigatexal wrote: post #185

The EU has been moving in this direction with PSD2 and it’s been pretty good. Downside is there’s no defacto standard for APIs and each bank's development skills vary widely.

PSD2 is really bad. It doesn't actually allow you, the customer, to sign in to your banking account using your own application and an API. It only mandates that regulated thirdparty companies can access your banking account using some API. Here in Germany PSD2 was a big step back. Previously we had FinTS ( https://en.wikipedia.org/wiki/FinTS ), an open banking protocol used since the last 90s, and many programs suppo…

From what I remember FinTS was a very escoteric protocol and super low level. What PSD2 promises is modern APIs that devs from this millennia are used to to build off of.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#252

Post by pbasista »

Nursie wrote: post #245
pbasista wrote: post #243

Earlier quoted context omitted.

> if you grant access to just anyone, then you’ve created an instant fraudster’s paradise. I believe that everyone might get access to their own data and to performing actions on their own account. Could you clarify how is that supposed to create a fraudsters' paradise?

Yep, the moment you allow that sort of access people will let the arseholes in one way or another, because people in general don't have a clue about what permissions should be given to people who call up claiming to be, for instance, from the tax office. Even read only, fraudsters will find ways to exfiltrate private data that's useful for identity theft, blackmail or any number of criminal acts. People are not secur…

Getting access to a regular web app would be sufficient to perform that kind of abuse. It just would be more difficult to automate.

It seems to me that the difficulty of getting the victim to grant access to the attacker remains the same for both the web app access and the API access.

The advantage for the attacker of getting the API access is that they can more easily automate the performing of subtle frauds over a longer period of time, thereby avoiding the detection. But a determined attacker can automate that via the web app as well.

That is why it seems to me that the difference in fraud capabilities over both channels is, in principle, negligible.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#253

Post by varenc »

computator wrote: post #176
williamscales wrote: post #115

Earlier quoted context omitted.

Plaid is only one security breach away from being utterly destroyed. And they will take out the financial lives of all their customers with them. It’s utterly irresponsible and I have no idea how Plaid hasn’t been shut down. You have no recourse if they are breached. The TOS of your online banking probably says that if you disclose your username and password to any third party then you have no liability protections.

> It’s utterly irresponsible and I have no idea how Plaid hasn’t been shut down. You have no recourse if they are breached. Wise (formerly TransferWise) is another example. You have to move funds into your Wise account before you can do a transfer, payment, or currency exchange. Wise offer various ways to fund your account such as wire transfer, credit card payment, debit card payment, etc., each of which has differe…

> 2) Which raises the question about why the banks aren't blocking IP addresses that Wise uses to log into bank accounts, or at least making a complaint to Wise.

People doing screen-scraping like Plaid will seek out IPs that look innocuous. One place I heard of had bank of mobile phones all with cellular data plans hooked up to some UI automation. This lets them run screen scraping from a real phone on a real cellular network.

Also look at the company Luminati Networks/Bright Data: https://brightdata.com/proxy-types/mobile-residential-ips

They pay app developers to install an SDK on their popular mobile apps, then sell the right to run network requests through users devices. Perfect if you want to do some sketchy screen scraping and need access to a lot of innocent looking IP addresses.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#254

Post by midasuni »

barbazoo wrote: post #17
SevenSigs wrote: post #9

Earlier quoted context omitted.

> Tangerine At least they used to have decent interest rates... now what's the point? they don't even have physical banks.

Overall it's a pretty good deal, no fee accounts, unlimited etransfers, decent credit card, good customer support, things like that. Back when I was shopping for no fee accounts this was the best deal there was.

That’s all standard in the UK, why are US banks so different?

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#255

Post by Nursie »

pbasista wrote: post #252
Nursie wrote: post #245

Earlier quoted context omitted.

Yep, the moment you allow that sort of access people will let the arseholes in one way or another, because people in general don't have a clue about what permissions should be given to people who call up claiming to be, for instance, from the tax office. Even read only, fraudsters will find ways to exfiltrate private data that's useful for identity theft, blackmail or any number of criminal acts. People are not secur…

Getting access to a regular web app would be sufficient to perform that kind of abuse. It just would be more difficult to automate. It seems to me that the difficulty of getting the victim to grant access to the attacker remains the same for both the web app access and the API access. The advantage for the attacker of getting the API access is that they can more easily automate the performing of subtle frauds over a…

Yes, making attacks more difficult is often the point of security. Further, with an accredited intermediary, they have more responsibility to ensure their stuff isn’t compromised, and to stick to good practice. With free for all API access the world is wide open to fraud.

Re: Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

#257

Post by alibarber »

alibarber wrote: post #225
computator wrote: post #176

Earlier quoted context omitted.

> It’s utterly irresponsible and I have no idea how Plaid hasn’t been shut down. You have no recourse if they are breached. Wise (formerly TransferWise) is another example. You have to move funds into your Wise account before you can do a transfer, payment, or currency exchange. Wise offer various ways to fund your account such as wire transfer, credit card payment, debit card payment, etc., each of which has differe…

I've never seen this in either the UK or Finland when using Wise. Direct Debit is a legit thing that's more common in the UK - but that takes several days to clear and the protection is quite strong, Wise would have lost a lot of money to fraud if they offered it as an option... They use Trustly in the Nordics to do something similar to what you mention, which does seem to use propper bank APIs - as I have to authent…

I just transferred some cash from UK -> Europe and whatd'ya konw? There is indeed a hook to the bank, but I am pretty convinced that it is just the legit, real, EU (& UK) wide open banking that Wise have implemented for most of the popular UK banks, mainly because I was on the First Direct (my bank) site the entire time once I clicked through, and I still had to authenticate properly with the app for anything to actually happen.
Post reply on HN