Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teller – API for your bank account

blog.teller.io

Post reply on HN
Print view View original

21–30 of 282 posts

Re: Teller – API for your bank account

#21

Post by posix_compliant »

Animats wrote: post #11
sjtgraham wrote: post #8

Earlier quoted context omitted.

Founder here. First of all, I'm honored the legendary John Nagle now knows about my startup! :) Privacy policy and terms are linked to from https://teller.io/developer/beta Privacy policy: https://teller.io/developer/privacy Terms: https://teller.io/developer/terms Payments APIs will be signed by the developer's private key (See more about that our auth scheme here https://blog.teller.io/2016/04/26/tauth.html ) and t…

Your terms: "We are not liable for any loss or damage that may result from your use of our services. This includes any direct, indirect, or consequential losses; any loss or damage caused by tort, including negligence, breach of contract or otherwise." You don't get taken seriously in the financial space with terms like that. You need to accept responsibility for errors and carry errors and omissions insurance. Compa…

Bank of America's assets total over 2 trillion dollars. I would imagine it's easier for large financial institutions to create such strong guarantees for its users.

Re: Teller – API for your bank account

#22

Post by foxylion »

As a German it is hard to believe that such things do not exist yet in other countries. We have a standardized protocol called FinTS which is implemented by most banks. This results in a huge amount of desktop and mobile applications for banking.

Re: Teller – API for your bank account

#23

Post by lewisl9029 »

alexbilbie wrote: post #14

UK banks don't accept any liability if you give your online banking credentials to a third party. If some fraud was to come about as a result of someone using Teller then they would be out of pocket or has Teller got agreements with the compatible banks to overcome this situation (either by Teller reimbursing the customer or the bank)?

I believe this is true for most US banks also.

I can't even count how many promising-looking Fintech products I had to pass over because the only auth mechanism they offered was through sharing online banking credentials.

Until bank policies regarding credentials-sharing actually change, I think it's really irresponsible for products to even ask for credentials at all, let alone offer it as the default/only auth option. Users could be unwittingly putting their entire life savings at risk.

Re: Teller – API for your bank account

#25

Post by jswny »

sjtgraham wrote: post #15
lookingfj wrote: post #9

How does it work if not by screen scraping?

It works by using the same private APIs that the bank's own mobile app. We reverse engineer their app, work out the API contract, implement our client, and normalize the data. Reverse engineering mobile APIs is a superior strategy to screen-scraping because: - they already return structured data - the security model for that channel is different, e.g. no need for 2FA all the time so truly unattended use cases are pos…

Not only does this sound potentially illegal but how can you be confident that you will recognize the breaking changes in time to fix them? What if you begin supporting a large number of banks and you can't keep up?

Also, will your reverse-engineered use of the mobile API's have any detrimental effect on the user? I imagine the user will be the one authenticated with the API, what if the bank starts to see an influx of odd API traffic and decides to investigate it or there is some type of rate limit?

Your decision to reverse-engineer mobile API's opens the door for many important questions in my opinion.

Re: Teller – API for your bank account

#26

Post by sjtgraham »

Animats wrote: post #11
sjtgraham wrote: post #8

Earlier quoted context omitted.

Founder here. First of all, I'm honored the legendary John Nagle now knows about my startup! :) Privacy policy and terms are linked to from https://teller.io/developer/beta Privacy policy: https://teller.io/developer/privacy Terms: https://teller.io/developer/terms Payments APIs will be signed by the developer's private key (See more about that our auth scheme here https://blog.teller.io/2016/04/26/tauth.html ) and t…

Your terms: "We are not liable for any loss or damage that may result from your use of our services. This includes any direct, indirect, or consequential losses; any loss or damage caused by tort, including negligence, breach of contract or otherwise." You don't get taken seriously in the financial space with terms like that. You need to accept responsibility for errors and carry errors and omissions insurance. Compa…

Thanks for your feedback. We developed TAuth to provide attribution and non-repudiation for exactly this kind of situation. I personally take security very seriously such that launching our product has taken longer because designing and implementing a system worthy of performing financial transactions on behalf of others is a serious undertaking.

Our terms are comparable to the incumbent "screen-scrapers" in the market, e.g. Yodlee and Plaid. FWIW it is not currently possible for users to move money with Teller. I'm open to revisiting the terms when it is, and I'm always open and listening to feedback such as this.

Thanks for taking the time.

Re: Teller – API for your bank account

#27

Post by Alupis »

clappski wrote: post #20
sjtgraham wrote: post #15

Earlier quoted context omitted.

It works by using the same private APIs that the bank's own mobile app. We reverse engineer their app, work out the API contract, implement our client, and normalize the data. Reverse engineering mobile APIs is a superior strategy to screen-scraping because: - they already return structured data - the security model for that channel is different, e.g. no need for 2FA all the time so truly unattended use cases are pos…

This all sounds like it could potentially be illegal, have you spoken to a lawyer and cleared it all?

Or potentially broken easily - since these are private API's that the bank is free to change whenever they feel like it.

Re: Teller – API for your bank account

#28

Post by nbevans »

sjtgraham wrote: post #15
lookingfj wrote: post #9

How does it work if not by screen scraping?

It works by using the same private APIs that the bank's own mobile app. We reverse engineer their app, work out the API contract, implement our client, and normalize the data. Reverse engineering mobile APIs is a superior strategy to screen-scraping because: - they already return structured data - the security model for that channel is different, e.g. no need for 2FA all the time so truly unattended use cases are pos…

That sounds very risky - building a business based on a reverse engineered approach that could change at any time?
Post reply on HN