Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teller – API for your bank account

blog.teller.io

Post reply on HN
Print view View original

181–190 of 282 posts

Re: Teller – API for your bank account

#181

Post by echion »

viraptor wrote: post #134
sjtgraham wrote: post #33

Earlier quoted context omitted.

Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth m…

> It is also worth mentioning there has never been a single case of fraud or loss attributed to "screen-scraping" This response makes me angry. Every service worth attacking will have security problems at some point. You're running a store of bank credentials, which you have to have access to (as opposed to password managers for example which can store user encrypted data). Given enough time, one of these services wi…

> I'm already doing bank screen scraping for myself

Any tools you recommend, or is it all hand-rolled?

Re: Teller – API for your bank account

#183

Post by javiercr »

bruno2223 wrote: post #44

Cool project, You should make it open source (to grow your bank catalog by the community) with some premium Plan (to earn money of it) That's the only way to get it worldwide, otherwise, you will have to do MITM attack every single Bank App in order to get their APIs, with is painful and most of the times impossible without valid credentials. Opensource + Premium is the way to go!

Teller is amazing (kudos to Stevie), but if you're looking for an open source solution you can take a look to:

https://github.com/bankscrap/bankscrap

We already support major banks in Spain and we're looking forward for people who can contribute with adapters to support even more banks worldwide.

Re: Teller – API for your bank account

#186

Post by resf »

EpicEng wrote: post #141
diggernet wrote: post #120

Earlier quoted context omitted.

Far better to leave their users open to huge liability instead, eh?

From a business perspective? Yes. If you go out of business it's game over, and it's unreasonable to expect them to provide legal advice. That said, I don't think the business model on display here is tenable at all and I don't think it will be successful. I certainly wouldn't sign on for this, way too risky.

On the other hand, if the only way you can stay in business is by deceiving your own customers, what you are running is a scam.

Re: Teller – API for your bank account

#187

Post by thwarted »

sjtgraham wrote: post #33
alexbilbie wrote: post #14

UK banks don't accept any liability if you give your online banking credentials to a third party. If some fraud was to come about as a result of someone using Teller then they would be out of pocket or has Teller got agreements with the compatible banks to overcome this situation (either by Teller reimbursing the customer or the bank)?

Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth m…

We want to help banks deliver these APIs ... The market can't wait for the banks, developers and users want new choices, apps and service now.

It was my understanding that the YC-backed company Standard Treasury (acquired by Silicon Valley Bank in 2015) was trying to do this. I don't know where they went with this or what happened (although I believe there was techcrunch write-up about them and the purchase by SVB). Hopefully you can make this work securely because having to navigate a shitty branded (which apparently means constantly changing) web interface to monitor and move money is increasingly frustrating.

Re: Teller – API for your bank account

#188

Post by jimmcslim »

Does anyone have any insight into a PSD2-style effort in Australia?

I notice that National Australia Bank is experimenting with APIs, they have a developer portal [1], with FX rates and branch location APIs currently available. Authentication, customer details and accounts APIs are 'coming soon'.

[1] https://developer.nab.com.au/ourapis

Re: Teller – API for your bank account

#189

Post by ldn_tech_exec1 »

thwarted wrote: post #187
sjtgraham wrote: post #33

Earlier quoted context omitted.

Hi, Firstly, we don't always need a credential. Some banks provide other auth mechanisms, e.g. EMV CAP. We use this for Barclays and Nationwide. Using Teller might not violate your bank's terms of service, which is why we advise you to read them in conjunction with ours. Furthermore, it is the view of some senior bank people that I speak to that PSD2 will make such clauses in banking terms illegal. It is also worth m…

We want to help banks deliver these APIs ... The market can't wait for the banks, developers and users want new choices, apps and service now. It was my understanding that the YC-backed company Standard Treasury (acquired by Silicon Valley Bank in 2015) was trying to do this. I don't know where they went with this or what happened (although I believe there was techcrunch write-up about them and the purchase by SVB).…

The team from Standard Treasury ended up building SVB's virtual card platform.

Re: Teller – API for your bank account

#190

Post by thwarted »

gregable wrote: post #162
viraptor wrote: post #134

Earlier quoted context omitted.

> It is also worth mentioning there has never been a single case of fraud or loss attributed to "screen-scraping" This response makes me angry. Every service worth attacking will have security problems at some point. You're running a store of bank credentials, which you have to have access to (as opposed to password managers for example which can store user encrypted data). Given enough time, one of these services wi…

It would be interesting if there were a way to run a local client that holds your credentials and does the screen scraping to send back to this API (or others).

I believe Wesabe had an implementation that did this.

From http://blog.precipice.org/why-wesabe-lost-to-mint/

   Wesabe built our own data acquisition system, first
   using downloadable client programs (partially because
   that was easier and partially to preserve users’
   privacy)
Post reply on HN