Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

How ACH works: A developer perspective – Part 2

engineering.zenpayroll.com

Post reply on HN
Print view View original

31–36 of 36 posts

Re: How ACH works: A developer perspective – Part 2

#31

Post by simoncion »

tomasien wrote: post #6
edawerd wrote: post #5

Earlier quoted context omitted.

I'm curious, if you don't store usernames and passwords for banking credentials, how do know if the ACH transfer will NSF? Do you ask the account holder for their bank credentials each time you want to pull money from their account?

No - so we risk rate for recurring payments and get a bunch of info from online banking that helps us determine how large of a recurring payment and at what interval we can allow. We've never been wrong, but we will be someday I'm sure. Recurring payments right now are not fully guaranteed against NSF risk only the first one and all one time payments. So for ZenPayroll I suppose that's particularly relevant. Someday…

> Someday we hope to offer stored usernames and passwords as a service...

Usernames and passwords are generally an all-or-nothing proposition, and will be for the foreseeable future. Is getting major banks to adopt a application-specific-password scheme [0] (maybe even with maybe-fine-grained permissions!) such a lost cause that it makes what you're proposing a vaguely reasonable thing to do?

[0] https://support.google.com/accounts/answer/185833?rd=1

Re: How ACH works: A developer perspective – Part 2

#32

Post by ersii »

tomasien wrote: post #23
richardwhiuk wrote: post #3

Earlier quoted context omitted.

You should fix the lack of SSL security on thesimpledifference.com Why? iFrame SSL certificates aren't visible, and no, your VeriSign trusted doesn't count. This means users will find it offputting as you note. Why else? Someone could hijack the HTTP page and point the iframe location somewhere else where they then intercept bank details. Next knox only seems to support a limited number of banks, unlike ACH which I'm…

SSL is fixed on https://thesimpledifference.com - don't have htaccess redirecting although I put the rule in. But ssl is up!

I would recommend running both https://thesimpledifference.com and https://knoxpayments.com through Qualys excellent SSL Server Test at https://www.ssllabs.com/ssltest/index.html when you got a spare moment over.

I would recommend configuring support for "Forward Secrecy" on both sites and enabling TLS 1.2 on thesimpledifference.com. Current score on both domains is "C".

Re: How ACH works: A developer perspective – Part 2

#33

Post by EvanAnderson »

timtas wrote: post #28

My first job out of college in 1987 was a COBOL programmer working on the Unisys version of the ACH system. There were two versions, IBM and Unisys, which were mandated to maintain 100% feature parity. The reason for two versions was that the Federal Reserve System preferred not to sole-source mainframes across its 12 districts. To understand ACH it helps to understand that it's basically electronic checks. The FRB s…

Having worked with Unisys-based financial software in the early 2000's (A Series MCP-based stuff) I can only assume that code you wrote is probably still running. There is a serious commitment to legacy compatibility there (for better or for worse).

Re: How ACH works: A developer perspective – Part 2

#34

Post by mike_hearn »

tomasien wrote: post #18
pfg wrote: post #16

Earlier quoted context omitted.

Sorry, edited my comment a bit to clarify. If I understood correctly, you use the login to verify the account information and to check whether funds are available. The transfer is initiated via ACH. Sofortüberweisung doesn't use ACH (or SEPA), they actually transfer the money via Online banking using a bot pretending to be the account owner.

OHHHH that's messed up. Wow! That's a really weird thing to do, but the fact that it's popular anyway really says a lot. Still though - wow.

It's popular because SEPA transfers are really cheap, compared to paying with credit cards.

Last time I paid with SOFORT I noticed that they hadn't committed the wire transfer. KLM issued me with my flight tickets, but the wire transfer was sitting in the outbox and could have been cancelled. Not sure what happens if I cancel a payment like that - does the merchant get notified and cancel the flight tickets too?

Re: How ACH works: A developer perspective – Part 2

#35

Post by tomasien »

ersii wrote: post #32
tomasien wrote: post #23

Earlier quoted context omitted.

SSL is fixed on https://thesimpledifference.com - don't have htaccess redirecting although I put the rule in. But ssl is up!

I would recommend running both https://thesimpledifference.com and https://knoxpayments.com through Qualys excellent SSL Server Test at https://www.ssllabs.com/ssltest/index.html when you got a spare moment over. I would recommend configuring support for "Forward Secrecy" on both sites and enabling TLS 1.2 on thesimpledifference.com. Current score on both domains is "C".

Great idea!
Post reply on HN