Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teller – API for your bank account

blog.teller.io

Post reply on HN
Print view View original

131–140 of 282 posts

Re: Teller – API for your bank account

#131

Post by devhead »

DerJacques wrote: post #121
kevincennis wrote: post #115

Earlier quoted context omitted.

Are they required to adhere to a standardized API? If not, then I think there's still some utility in a service that can normalize that stuff and provide you with a single, consistent interface.

My understanding is that the EU PSD2 regulation indeed is supposed to make banks adhere to a standardised API. That being said, I wouldn't expect a super easy to use REST api with documentation powered by readme.io.

one would think the people securing our finances has the technical capability to provide modern apis... one would think

Re: Teller – API for your bank account

#132

Post by reledi »

mirekrusin wrote: post #114

Somebody told me that 2018 is the deadline for EU banks to provide API access. If that's the case then going through any server side layer managed by somebody is unnecessary and people in general should think twice about every single bank transaction being stored somewhere "there". It gives out a lot of information from your internet provider to your child's creche, holidays habits, income (duh), loan repayments and…

FYI Open Banking API was announced to have personal customer transaction data on a read-only basis at the beginning of 2018, and the full scope, including business, customer and transactional data, reached by 2019.

Re: Teller – API for your bank account

#134

Post by viraptor »

sjtgraham wrote: post #33
alexbilbie wrote: post #14

UK banks don't accept any liability if you give your online banking credentials to a third party. If some fraud was to come about as a result of someone using Teller then they would be out of pocket or has Teller got agreements with the compatible banks to overcome this situation (either by Teller reimbursing the customer or the bank)?

Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth m…

> It is also worth mentioning there has never been a single case of fraud or loss attributed to "screen-scraping"

This response makes me angry. Every service worth attacking will have security problems at some point. You're running a store of bank credentials, which you have to have access to (as opposed to password managers for example which can store user encrypted data). Given enough time, one of these services will get hacked and "this has never happened before" is not going to be a good answer. Someone will be the first one.

I'm happy your service will push more banks to provide APIs. But I'm already doing bank screen scraping for myself because I don't trust services which require my credentials. I hope people consider that risk seriously.

Re: Teller – API for your bank account

#135

Post by corobo »

7ewis wrote: post #81

This looks really cool, but I'm nervous about trying it. Can they provide any guarantees?

While we make every effort to ensure our services are available, secure, accurate, complete, and free from defects we provide no guarantees, conditions, or warranties of this, express or implied.

We are not liable for any loss or damage that may result from your use of our services. This includes any direct, indirect, or consequential losses; any loss or damage caused by tort, including negligence, breach of contract or otherwise.

This applies if the loss or damage was foreseeable, arose in the normal course of things or you advised us that it might happen.

This includes but is not limited to loss of your income or revenue; salary, benefits, or other payments; business; profits or contracts; opportunity; anticipated savings; data; goodwill or reputation; intangible and tangible property; wasted management or office time.

No, none.

Re: Teller – API for your bank account

#136

Post by stouset »

meredydd wrote: post #79
sjtgraham wrote: post #33

Earlier quoted context omitted.

Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth m…

This is startup-ese for "Every single one of our users is breaking their bank's ToS, and we maintain plausible deniability by telling them to go and read complex legal documents themselves". I can totally understand the motivation (particularly with PSD2 around the corner, which will mandate banks to provide legit APIs - I'm guessing the plan is to grab market share before that happens). However, I am very skeptical…

Yeah. "No cases of fraud or loss due to screen-scraping" doesn't mean your service isn't going to be the one that leaks a treasure trove of banking credentials.

It's also highly probable that it has happened, it just wasn't attributed properly.

Re: Teller – API for your bank account

#138

Post by technofiend »

lewisl9029 wrote: post #23
alexbilbie wrote: post #14

UK banks don't accept any liability if you give your online banking credentials to a third party. If some fraud was to come about as a result of someone using Teller then they would be out of pocket or has Teller got agreements with the compatible banks to overcome this situation (either by Teller reimbursing the customer or the bank)?

I believe this is true for most US banks also. I can't even count how many promising-looking Fintech products I had to pass over because the only auth mechanism they offered was through sharing online banking credentials. Until bank policies regarding credentials-sharing actually change, I think it's really irresponsible for products to even ask for credentials at all, let alone offer it as the default/only auth opti…

Yodlee not only wants your credentials but at one point updated their customer agreement to grant them Power of Attorney with each institution they managed on your behalf. I don't know about you but PoA, a binding arbitration clause and their marketing your data to boot is well beyond my comfort level.

Re: Teller – API for your bank account

#139

Post by niklasrde »

guelo wrote: post #118

This is annoying, I got all excited and then realising this is for a handful of UK banks. Would be great if it were tagged as a UK thing more prominently.

I was really not excited, expecting it to be US-exclusive, until I clicked the link and saw it was UK banks. Whoop ;)

Re: Teller – API for your bank account

#140

Post by objclxt »

sjtgraham wrote: post #33
alexbilbie wrote: post #14

UK banks don't accept any liability if you give your online banking credentials to a third party. If some fraud was to come about as a result of someone using Teller then they would be out of pocket or has Teller got agreements with the compatible banks to overcome this situation (either by Teller reimbursing the customer or the bank)?

Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth m…

> It is also worth mentioning there has never been a single case of fraud or loss attributed to "screen-scraping"

Saying "it's never happened before" doesn't in anyway mitigate the attack vector. For what it's worth, there have been cases of fraud attributed to screen scraping, but they don't tend to get publicized.

It is pretty telling (no pun intended) that nowhere in your blog post does the word "security" appear, and no details about how you're storing credentials when you do need them. Why should I trust you with a credential from another party if you refuse to tell me how you're actually storing it.

> "We are not liable for any loss or damage that may result from your use of our services. This includes any direct, indirect, or consequential losses; any loss or damage caused by tort, including negligence, breach of contract or otherwise. This applies if the loss or damage was foreseeable, arose in the normal course of things or you advised us that it might happen."

I don't know which solicitor gave you those terms, but they will be laughed out of a court in England as unconscionable. You're not liable for any negligence, even if it's foreseeable or someone told you you were being negligent??

Post reply on HN