Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: Wealthfolio: Private, open-source investment tracker

wealthfolio.app

Post reply on HN
Print view View original

21–30 of 281 posts

Re: Show HN: Wealthfolio: Private, open-source investment tracker

#23

Post by diggan »

picardo wrote: post #17
TexanFeller wrote: post #9

"Local Data Storage. No Subscriptions, No Cloud" This is what we need more often from our software, especially from software that works with sensitive data. I do typically want sync options though since I tend to use several different devices and it sucks not being able to reference information on the go from my phone. Sync options can include locally/self hosted options or use something like iCloud that don't depend…

> This is what we need more often from our software, especially from software that works with sensitive data. Storing sensitive data in local storage makes you vulnerable to XSS attacks and Man-in-the-Browser attacks. You're exposing your sensitive data to an attacker that injects a script to the website and to malicious browser extensions. All sensitive data stored in local storage must be encrypted using a key stor…

> Storing sensitive data in local storage makes you vulnerable to XSS attacks and Man-in-the-Browser attacks. You're exposing your sensitive data to an attacker that injects a script to the website and to malicious browser extensions

The app in question runs locally and only with trusted code. How is the attacker supposed to get in there to place the XSS or even do a MITM attack when there is no exposed website at all? Neither are there browser extensions involved here.

> All sensitive data stored in local storage must be encrypted using a key stored in the server

Huh? Please don't do this, especially not for "local first" applications, would defeat the entire purpose.

Re: Show HN: Wealthfolio: Private, open-source investment tracker

#24

Post by diggan »

Dalewyn wrote: post #21

Speaking practically, I don't see a need or reason for this. I can just login to my bank and brokerage accounts and check live data on the spot. Speaking as a Boglehead, checking on your investments frequently is usually a bad thing.

> Speaking practically, I don't see a need or reason for this. I can just login to my bank and brokerage accounts and check live data on the spot.

First mentioned and most prominent feature is "Accounts Aggregation" on the landing page. If you don't have multiple accounts, it makes sense you don't see any need for this. But you should also realize that it's fairly common to have multiple accounts, for various of reasons.

Re: Show HN: Wealthfolio: Private, open-source investment tracker

#27

Post by Dalewyn »

diggan wrote: post #24
Dalewyn wrote: post #21

Speaking practically, I don't see a need or reason for this. I can just login to my bank and brokerage accounts and check live data on the spot. Speaking as a Boglehead, checking on your investments frequently is usually a bad thing.

> Speaking practically, I don't see a need or reason for this. I can just login to my bank and brokerage accounts and check live data on the spot. First mentioned and most prominent feature is "Accounts Aggregation" on the landing page. If you don't have multiple accounts, it makes sense you don't see any need for this. But you should also realize that it's fairly common to have multiple accounts, for various of reas…

I haven't used it myself (yet?), but both my bank and my brokerage purport to let me link external accounts for easier aggregated viewing.
Post reply on HN