Man... The loss of Mint has really left a gap in this market.
I have been using Empower (previously Personal Capital) for almost 10 years now and have been happy enough
Show HN: Wealthfolio: Private, open-source investment tracker
31–40 of 281 posts
Re: Show HN: Wealthfolio: Private, open-source investment tracker
#32"Local Data Storage. No Subscriptions, No Cloud" This is what we need more often from our software, especially from software that works with sensitive data. I do typically want sync options though since I tend to use several different devices and it sucks not being able to reference information on the go from my phone. Sync options can include locally/self hosted options or use something like iCloud that don't depend…
[deleted]
Re: Show HN: Wealthfolio: Private, open-source investment tracker
#33[flagged]
[deleted]
Re: Show HN: Wealthfolio: Private, open-source investment tracker
#34Earlier quoted context omitted.
That's what I was wondering. It's a ton of work, but would love the auto importing / screen scraping features that Mint.com had. For a local desktop tool it even has the potential to support every possible service because they can't do IP blocking on end-users (versus the server-to-server model that Mint.com had, caused many services to IP block Mint's servers). Unfortunately, depending on an open-source tool to do t…
> but would love the auto importing / screen scraping features that Mint.com had I never used it, but didn't that ask you for the username/password in order to do its job? If so, I wouldn't touch it with a ten-foot pole. > cause the program to send your data elsewhere -- or worse, deplete accounts' funds. Again, seemingly because their shitty architecture would that even be possible. There are modern (possibly only E…
Some banks allow you to create separate limited read only credentials at least that can be revoked at any time. But not all of them allow this.
Re: Show HN: Wealthfolio: Private, open-source investment tracker
#35quite nice! It would be great to have a bit more infos about how to get setup, how to input existing values from accounts, etc
I think I got it right after doing a "deposit" of the exact value of my account, then try to work out what was the correct "buy" price for each stock without the P/L, it roughly works but the numbers don't exactly match those that I have in my account, perhaps because you're not using the same data source as my account
Re: Show HN: Wealthfolio: Private, open-source investment tracker
#36Earlier quoted context omitted.
> This is what we need more often from our software, especially from software that works with sensitive data. Storing sensitive data in local storage makes you vulnerable to XSS attacks and Man-in-the-Browser attacks. You're exposing your sensitive data to an attacker that injects a script to the website and to malicious browser extensions. All sensitive data stored in local storage must be encrypted using a key stor…
> Storing sensitive data in local storage makes you vulnerable to XSS attacks and Man-in-the-Browser attacks. You're exposing your sensitive data to an attacker that injects a script to the website and to malicious browser extensions The app in question runs locally and only with trusted code. How is the attacker supposed to get in there to place the XSS or even do a MITM attack when there is no exposed website at al…
> only with trusted code
That's a big assumption. Have you read all the code, and the dependencies of the dependencies of your code? If you haven't, how do you know it can be trusted? What if there is a backdoor in an obscure dependency that can inject a script into your website to steal your sensitive data? Don't laugh it off. When there is money on the line, someone is going to try it.
> Neither are there browser extensions involved here.
What about the extensions you installed in your browser? What about the user scripts (if you use them)?
> Huh? Please don't do this, especially not for "local first" applications, would defeat the entire purpose.
Why not? Why do you want a local first app in the first place? What's the purpose of a local first app, if not security?
Re: Show HN: Wealthfolio: Private, open-source investment tracker
#37Man... The loss of Mint has really left a gap in this market.
Once Mint.com has closed I started to dig for alternatives and found Monarch Money. Couldn't be happier to pay for the service. New features come out pretty often, and I believe they work on the better support for tracking investments.
Re: Show HN: Wealthfolio: Private, open-source investment tracker
#38First question from reading through the landing page is about this part: > Import your statements from your broker or bank. Exactly what brokers/banks that are supported should be listed somewhere and linked here, as that's a "make or break" feature for a lot of people I bet. Not much point in replacing my homegrown "Banks CSV export -> Data processing > Import into spreadsheet" workflow unless I just replace that la…
I don't know about Wealthfolio, but the import QFX/OFX/CSV/etc. into GnuCash has ways to reconcile that with transactions you've manually recorded/edited, which can be much richer than the bank or CC knows. (GnuCash also has a way to import via network access, but I haven't tried it.)
(Example of richness: splitting am Amazon CC charge into the multiple expense accounts for the items that went into the order, and also accounting for the CC rewards and the Gift Card balance that contributed.)
I tried taking a break from GnuCash for maybe year, and going to a spreadsheet, and found: (1) it was still substantial work to maintain an accurate view of balances, and (2) I was missing a lot of information I found I needed in practice.
Re: Show HN: Wealthfolio: Private, open-source investment tracker
#39Earlier quoted context omitted.
> Storing sensitive data in local storage makes you vulnerable to XSS attacks and Man-in-the-Browser attacks. You're exposing your sensitive data to an attacker that injects a script to the website and to malicious browser extensions The app in question runs locally and only with trusted code. How is the attacker supposed to get in there to place the XSS or even do a MITM attack when there is no exposed website at al…
> only with trusted code That's a big assumption. Have you read all the code, and the dependencies of the dependencies of your code? If you haven't, how do you know it can be trusted? What if there is a backdoor in an obscure dependency that can inject a script into your website to steal your sensitive data? Don't laugh it off. When there is money on the line, someone is going to try it. > Neither are there browser e…
I think you're misunderstanding what kind of application this is.
It's not a website, it doesn't run in your normal browser. It runs as a standalone application.
> Why not? Why do you want a local first app in the first place? What's the purpose of a local first app, if not security?
Because as soon as those keys aren't available (either because the endpoint no longer exists, or you cannot connect to the endpoint for whatever reason (like being offline)), you can no longer access your data.
That isn't "local first" at all, it's something else entirely.
Re: Show HN: Wealthfolio: Private, open-source investment tracker
#40Earlier quoted context omitted.
> but would love the auto importing / screen scraping features that Mint.com had I never used it, but didn't that ask you for the username/password in order to do its job? If so, I wouldn't touch it with a ten-foot pole. > cause the program to send your data elsewhere -- or worse, deplete accounts' funds. Again, seemingly because their shitty architecture would that even be possible. There are modern (possibly only E…
Some banks allow you to create separate limited read only credentials at least that can be revoked at any time. But not all of them allow this.
I used Every Dollar for budgeting for a while. It seemed mixed. Some banks used auth through the bank that would create a token for the site/app, which could be revoked through my account when the bank. Others used a 3rd party service which required the user enter their bank creds, and seemingly trust them.
I was in the market for a new bank, so I ended up coming up with my short list of banks I’d look at moving to, then went to Every Dollar to try adding accounts to see what kind of prompt I was met with. Anything that required the 3rd party to store my creds was out of the running. I ended up ending a 20+ year relationship with a bank of this. There were other things too, but this was the straw that got me to actually cut ties.
I assume Mint was similar. I used it a long time ago, probably when I was more trusting in my youth.