They'll never disclose what the security issue is, I assume?
More people knowing a password is never going to be better security though is it? That said, if you're trying to beat a competitor and you are doing it like this, you're not doing well.
Bank of America Cut Off Finance Sites from Its Data
21–30 of 61 posts
Re: Bank of America Cut Off Finance Sites from Its Data
#22Why don't banks implement read-only passwords?
USAA does, but it's not implemented as simply as app passwords. There are two major issues with aggregators: 1) authentication and 2) data access mechanism. A read-only app password would solve #1, but aggregators commonly implement #2 by screen-scraping, which is the bane of everyone's existence. I wouldn't be surprised if half of the reason BoA cut off aggregator access was because most of the aggregators were screen-scraping, and BoA got tired of the support calls whenever they made a site change and people's accounts stopped syncing.
Last I heard (um, a couple of years ago), USAA's solution was a proper API, but Mint was still screen-scraping. I have no idea if that's because Mint is lazy or USAA'S API is too limited for what they want, but my money would be on the former.
Re: Bank of America Cut Off Finance Sites from Its Data
#23Earlier quoted context omitted.
That's what these "finance sites" already do. That's why you have to enter your bank username and password to use them - they just scrape the website. Incidentally, I have never used one, because that requirement is completely insane.
I think the point was so that the banks couldn't block access via ip address. Each person would be able to aggregate their bank info on their home computer or they could secure their own server to do it for them constantly.
I would use that in a heartbeat. Just wanted to point out that it the incumbents' approach as well, rather than some actual API which banks decided to discontinue.
Re: Bank of America Cut Off Finance Sites from Its Data
#24Remember when Simple was going to offer an API and provide a path forward for this problem [1][2]? Never happened [3], speaks to challenges of financial data still I guess.
[1] http://www.programmableweb.com/news/banksimple-banking-servi...
Re: Bank of America Cut Off Finance Sites from Its Data
#25Fuck it, I am going to build an open source project with the sole goal of automating access to all of these sites with selenium or something. Get ready for war(in the nice, data science-y way)
That's what these "finance sites" already do. That's why you have to enter your bank username and password to use them - they just scrape the website. Incidentally, I have never used one, because that requirement is completely insane.
Why is that insane? It's inelegant, but it's not functionally different than having an API and a system for registering API keys. Either you trust the aggregator or you don't; if you don't you shouldn't give them access to your data either way. If they do something they shouldn't with your data, they'll be ruined if it becomes public.
(Of course there's a huge gray area of things they could do that you wouldn't like, but that would't ruin them. But there's a clear difference between questionable things, like selling your data to advertisers, and completely not-ok things, like stealing your money).
Re: Bank of America Cut Off Finance Sites from Its Data
#26I stopped using mint a while ago since there was no way to get it to work with my Bank's two factor authentication. read only password would make things a lot easier.
Re: Bank of America Cut Off Finance Sites from Its Data
#27This leads to an opening for either a challenger to Mint that has better relationships with the banks, a bank with a better UI than the existing banks, or a bank that explicitly supports Mint.
The existing banks burying their heads in the sand when there is obvious consumer demand makes the area much more ripe for a new entrant. I'm not sure how it will play out, but I would consider switching banks in order to have a better UI on my money. Supporting something like Mint or Personal Capital is basically a requirement for me to put my money in your bank.
Note that I'm not even particularly happy with Mint, I just can't imagine not having some form of aggregation of my financial life. I probably check it at least 1-2x a week and have been for 5+ years, it's a critical piece of software for me.
Re: Bank of America Cut Off Finance Sites from Its Data
#28The US banking system has not adapted to the modern world at all. Anyone who has worked with ACH will tell you how bad it is from a payment processing point of view - for those who don't know - you only receive negative ack, i.e., when a transfer failed and it's nowhere close to being instantaneous. It's common elsewhere to have a "read" password and a "write" password. Basically, you'll be prompted with additional s…
The good thing is that there are efforts to improve ACH. For example the UK already has "Faster Payments"[0]. In the US the Federal Reserve has a task force[1] going to implement fast pay. Sadly it will be a while before the US gets it as they are still in the planning stages for the system. The completed spec is expected by the end of 2016, so we probably won't see it implemented until 2018.
To add, the US is so complicated because we have so many friggin banks. Many countries there are only a few banks the service the nation, while the US has something like 14,000 different banks.
[0] https://en.wikipedia.org/wiki/Faster_Payments_Service
[1] https://fedpaymentsimprovement.org/get-involved/faster-payme...
Re: Bank of America Cut Off Finance Sites from Its Data
#29Is this just for bank accounts (checking / savings)? I have a credit card account with BoA, and Mint isn't having any problems accessing it.
Re: Bank of America Cut Off Finance Sites from Its Data
#30I don't use the aggregators because I want to, and they don't use my passwords and screen scrape because they want to. I just can't have being aware of my finances take all fucking day. I wish there was a standard and secure format and protocol for collecting balances and transactions built into the FDIC or NCUA rules or something.
For a secure protocol just use HTTPS. Secure formats don't really exist for data interconnects, since you'd have to send across enough information to decrypt it, and now we're in the "security through obscurity" territory.
It might sound horrifying but JSON or CSV over HTTPS is the most likely to work and the least work for financial institutions to implement (thus giving them less ammo to fight it on cost grounds).
Services interconnecting is largely a solved problem in general. Banks might have needed better security historically, but these days these services are all fairly secure, so there isn't much bar raising that needed. Heck Apple Pay is basically this system.