Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Secret API of Banks

gduverger.com

Post reply on HN
Print view View original

181–190 of 257 posts

Re: The Secret API of Banks

#181

Post by mcintyre1994 »

Rjevski wrote: post #42
dewey wrote: post #8

For those in the EU there's something interesting coming next year, banks need to provide open API to interact with each other: https://thenextweb.com/worldofbanking/2018/06/27/openbanking... Already right now in Germany there are a lot of banks that share a common API format which is why there are a lot of banking apps where you can just log into your bank and don't need bank specific apps. It's called HBCI / FinTS…

PSD2 and “open” banking is bullshit. I wish this myth would die - it is anything but “open”. If you want to gain access to API s , you need to become an “AISP” (as they are called in the UK), this requires a certification and a load of other nonsense akin to PCI-DSS. This is for read-only access - for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requi…

I've only just joined so this isn't exactly a recommendation, but Monzo looks super exciting because of two features: instantly reporting transactions, and an API that lets you access your own transactions. If you've only ever used a shit bank, look how amazing this looks: https://docs.monzo.com/#list-transactions (caveat: I haven't tried it yet!)

Re: The Secret API of Banks

#183

Post by cjpa »

So, he does not trust third-parties with his banking details, but uses a third-party to send emails with a complete detail of his account to an email-server (which might or might not be run by a third party). The logic is lost on me.

Re: The Secret API of Banks

#184

Post by Havoc »

orf wrote: post #38
misterbwong wrote: post #18

This is very clever but makes me sad. It’s 2018 and the best, cleanest way of monitoring and storing my own transactions programmatically is by scraping an email.

*in America Banks provide an API in Europe. In fact it's a legal requirement that's coming into force in 2019, and there are a lot of 'mobile-first' banks like Monzo and Revolut which make this entirely un-needed in the first place (providing spending exports, decent analytics, push notifications, etc etc). Welcome to the future. Contact your local politician if you want to join us. Maybe also ask about chip and pin…

Some parts of Europe suck too. eg HSBC Systems feel like they’ve recent advanced from 1995 to 1996.

Re: The Secret API of Banks

#185

Post by Nursie »

repolfx wrote: post #165
sjtgraham wrote: post #58

Earlier quoted context omitted.

> If you want to gain access to APIs, you need to become an “AISP” It's more complicated than that. Banks can give unregulated entities access to their APIs, but they don't because IMO providing API access is directly opposed to their interests. If you want to be statutorily entitled to API access you need to be a registered AISP or PISP. Unfortunately what an AIS is is very specific, i.e. showing the account owner a…

From what I've heard the main problem is banks are afraid popular API access would overload their mainframe-era systems that don't scale and can't scale.

It's more that they'd prefer to keep the competition out of their datastores, AFAICT

Re: The Secret API of Banks

#186

Post by Legogris »

cjpa wrote: post #183

So, he does not trust third-parties with his banking details, but uses a third-party to send emails with a complete detail of his account to an email-server (which might or might not be run by a third party). The logic is lost on me.

Furthermore, the e-mails are sent in clear-text and readable by any endpoint on the way transporting the e-mail to its destination. It's akin to sending your information back to yourself by post card rather than stored in a file with a third-party.

Re: The Secret API of Banks

#187

Post by close04 »

Rjevski wrote: post #164
miracle2k wrote: post #97

Earlier quoted context omitted.

If you are allowed to access your data, then you can grant that access to third parties (pass along the API token). I happen to think that is great, but we live in a time where the idea of my sharing my Facebook account with an app is considered a problem, because it has a list of my friends. My financial history contains a lot of metadata about third parties. This is exactly the intersection between this overlay str…

At the moment you can already grant third parties access to your data - you can pass along your online banking credentials and they will scrape the web UI (there is an entire industry built on that - companies like TrueLayer will take any bank’s credentials and some cash and give you JSON in exchange, scraping the online banking UI behind the scenes). Stupid people will be stupid and will find a way to shoot themselv…

You are not and were never prevented from accessing your own data. You keep repeating that while also mentioning you have options to access it.

You may not like the options you have to access that data because you have different needs than most other people. But insisting you're not allowed feels more than just exaggeration.

Open banking means it's not 100% proprietary and exclusive to each bank, it doesn't mean they have to open all doors and say "do what you want, I'm not even here". Regulation is there with a reason especially when dealing with such sensitive topics. You get access but you have to meet some conditions and the bar will be set according to the sensitivity: confidential personal data and actual money? It's going to be pretty high.

People are more than happy to blame regulators when they fail to put measures in place to protect people from major issues but will complain nonetheless if the regulation is there.

Re: The Secret API of Banks

#188

Post by close04 »

Rjevski wrote: post #42
dewey wrote: post #8

For those in the EU there's something interesting coming next year, banks need to provide open API to interact with each other: https://thenextweb.com/worldofbanking/2018/06/27/openbanking... Already right now in Germany there are a lot of banks that share a common API format which is why there are a lot of banking apps where you can just log into your bank and don't need bank specific apps. It's called HBCI / FinTS…

PSD2 and “open” banking is bullshit. I wish this myth would die - it is anything but “open”. If you want to gain access to API s , you need to become an “AISP” (as they are called in the UK), this requires a certification and a load of other nonsense akin to PCI-DSS. This is for read-only access - for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requi…

So you take issue with the fact that there's a high bar when dealing with personal data and real money? Especially when this gives you access to do it en-masse?

It's open, just not the "open" you imagine. Like anyone from the street being allowed to do it.

Re: The Secret API of Banks

#189

Post by sofaofthedamned »

pebers wrote: post #138
sofaofthedamned wrote: post #73

Earlier quoted context omitted.

TBF in Europe (or specifically the UK) the new regulations seem to have come up with a plethora of new banks -Starling, Monzo, Revolut, Tide, etc. Both my personal and business accounts are with these, and it's awesome. Starling for my personal account and Tide for the business one. I get notifications of payments usually before the in-store machine has finished sorting itself out. Also get nice things like being abl…

Not from those EU regulations - PSD2 is more recent than most of those challengers. They've popped up because the FCA (the UK regulator) deliberately tried to make it easier to start banks in order to get more competition in the space.

Interesting, thank you.

Re: The Secret API of Banks

#190

Post by Rjevski »

mcintyre1994 wrote: post #181
Rjevski wrote: post #42

Earlier quoted context omitted.

PSD2 and “open” banking is bullshit. I wish this myth would die - it is anything but “open”. If you want to gain access to API s , you need to become an “AISP” (as they are called in the UK), this requires a certification and a load of other nonsense akin to PCI-DSS. This is for read-only access - for “write” access including the ability to edit payees or make payments you need to become a “PISP” which I assume requi…

I've only just joined so this isn't exactly a recommendation, but Monzo looks super exciting because of two features: instantly reporting transactions, and an API that lets you access your own transactions. If you've only ever used a shit bank, look how amazing this looks: https://docs.monzo.com/#list-transactions (caveat: I haven't tried it yet!)

I have Monzo and they are amazing indeed.
Post reply on HN