Nordigen: API aggregator to European banks • Hacker News Board

Re: Nordigen: API aggregator to European banks

#21

Post by throwawayswede » Mon, Aug 02, 2021, 12:18 PM UTC

There was a Show HN a few weeks ago [1] about a script that used Nordigen.

This is from Nordigen's information handling section in TOS, just so people understand what's going to happen with their financial data (I also recommend reading full TOS).

> 2.3. As the Services also allow User to upload Information and/or obtain Account Information and personal data therein, User further acknowledges and agrees that by uploading or entering any Information for the Services and by using the Services, User grants Nordigen permission to make anonymized data based on personal and non-personal data collected from User or through User's use of the Services, and combine such anonymized data with that of other Users in order to make anonymized aggregate data. Nordigen may use the anonymized data and anonymized aggregate data for various business purposes and legitimate interests of Nordigen, including but not limited to improving the Services, developing and improving other Nordigen products and services, and distributing or licensing such data to third parties with whom Nordigen has a business relationship.

1] https://news.ycombinator.com/item?id=27769266

Re: Nordigen: API aggregator to European banks

#22

Post by vesinisa » Mon, Aug 02, 2021, 12:21 PM UTC

rhn_mk1 wrote: post #18

maverwa wrote: post #3

I'd really like to have a read-only API that is accessible for personal projects to be able to retrieve my own transaction history. Sadly with PSD2 that is (afaik) impossible, or at least pretty close to impossible. Things like this (nordigen) might "solve" the problem by replacing it with a bigger one: now nordigen (or someone else) has access to all this transaction data and is going to leak it somewhere. I get why…

What makes it impossible in PSD2? The python-fints library can fetch available transaction history for supported banks no problem. https://github.com/raphaelm/python-fints https://python-fints.readthedocs.io/en/latest/reading.html#r...

Under PSD2 banks are required to give access to the "open" APIs only to audited partners (Third Party Payment Service Provider, TPP) They may give wider access, but most are somehow paranoid about the entire matter.

Re: Nordigen: API aggregator to European banks

#23

Post by dang » Mon, Aug 02, 2021, 12:38 PM UTC

Please stop using multiple accounts to promote your stuff on HN. It's against the rules and we ban accounts and sites that do it. Also, HN users notice obvious cases like https://news.ycombinator.com/item?id=27843204 and will flame you if you keep it up.

The rules are at https://news.ycombinator.com/newsguidelines.html and https://news.ycombinator.com/newsfaq.html.

--

For readers: of many past submissions promoting this startup, these look to be the major threads:

Show HN: Connect your bank account to Google Sheets - https://news.ycombinator.com/item?id=27769266 - July 2021 (76 comments)

Nordigen: Free banking data and premium insights - https://news.ycombinator.com/item?id=26375962 - March 2021 (39 comments)

Re: Nordigen: API aggregator to European banks

#24

Post by delusional » Mon, Aug 02, 2021, 12:40 PM UTC

elfrinjo wrote: post #20

maverwa wrote: post #3

I'd really like to have a read-only API that is accessible for personal projects to be able to retrieve my own transaction history. Sadly with PSD2 that is (afaik) impossible, or at least pretty close to impossible. Things like this (nordigen) might "solve" the problem by replacing it with a bigger one: now nordigen (or someone else) has access to all this transaction data and is going to leak it somewhere. I get why…

It is rally terrible that such a service is actually necessary... PSD2 was a chance to create a standard api for everyone including customers. I still cannot understand how they managed to f it up by limiting access to "trusted companies"

I work at a bank and it's quite simple really. The systems we use at my workplace are so antiquated and wonky that even giving people read access would be a monumental effort. To put it plainly, modernizing these systems takes effort similar in order of magnitude to landing on the moon. Not for any technical reason, but due to the mountains of manual processes and general cruft built up around them. The EU is not deaf to these concerns, and therefore the laws end up falling short for no other reason than that they want someone to actually be able to follow them.

We are talking about things like "make a request at the wrong time and the system will be broken for the next 24 hours, and you are not allowed to speak to the people who know why".

People (myself included until a few years ago) buy into this "banks need to be secure and move slowly to maintain that" but really most of it is due to mismanagement. The "move slowly" is a rationalization.

Re: Nordigen: API aggregator to European banks

#25

Post by tomaszs » Mon, Aug 02, 2021, 12:42 PM UTC

The first fintech solution I love

Re: Nordigen: API aggregator to European banks

#26

Post by elfrinjo » Mon, Aug 02, 2021, 12:49 PM UTC

delusional wrote: post #24

elfrinjo wrote: post #20

Earlier quoted context omitted.

It is rally terrible that such a service is actually necessary... PSD2 was a chance to create a standard api for everyone including customers. I still cannot understand how they managed to f it up by limiting access to "trusted companies"

I work at a bank and it's quite simple really. The systems we use at my workplace are so antiquated and wonky that even giving people read access would be a monumental effort. To put it plainly, modernizing these systems takes effort similar in order of magnitude to landing on the moon. Not for any technical reason, but due to the mountains of manual processes and general cruft built up around them. The EU is not dea…

Oh, I totally agree (started my carreer in a company that still used VSE/ESA and CICS and sometimes dream about ASRAs). However, they had to implement modern api-stuff with PSD2 and then they made it strictly b2b-only :-(

Re: Nordigen: API aggregator to European banks

#27

Post by andreineculau » Mon, Aug 02, 2021, 12:49 PM UTC

Given that the API is the product, their API style leaves many things to desire.

Concrete example:

Account details https://nordigen.com/en/docs/account-information/overview/pa... : alright, I send in a bank account ID, and get back some "application/json". What exactly I get back? You have to check another page with zero context https://nordigen.com/en/docs/account-information/output/acco...

As a techie, giving up my info https://news.ycombinator.com/item?id=28035602 to them is a big no-no given the above knee-jerk reaction.

Re: Nordigen: API aggregator to European banks

#28

Post by Gys » Mon, Aug 02, 2021, 1:28 PM UTC

elfrinjo wrote: post #20

maverwa wrote: post #3

I'd really like to have a read-only API that is accessible for personal projects to be able to retrieve my own transaction history. Sadly with PSD2 that is (afaik) impossible, or at least pretty close to impossible. Things like this (nordigen) might "solve" the problem by replacing it with a bigger one: now nordigen (or someone else) has access to all this transaction data and is going to leak it somewhere. I get why…

It is rally terrible that such a service is actually necessary... PSD2 was a chance to create a standard api for everyone including customers. I still cannot understand how they managed to f it up by limiting access to "trusted companies"

I think they do not want to deal with individuals not understanding oath2 flow, the API calls or having typos in python ;-)

Re: Nordigen: API aggregator to European banks

#29

Post by flas9sd » Mon, Aug 02, 2021, 2:20 PM UTC

I'm weirded out by PSD2. I see the utility, but there are only so much interested parties able to wield this tool. Its expressed goals are to "improve the security of payment transactions, enhance consumer protection, foster innovation and increase competition on the market".

But looking at open banking APIs all I see are "insight" features for risk assessment and data mining. If I want to make a payment, disclosing that the amount is covered via a boolean would suffice, instead all accounts, transaction history and balances are transferred with some payment initiators. Ready to be scored by a model. It reminds me of private messengers asking for permission to upload all contacts: surely this is not necessary most of the time, but you want to get on with your day and click yourself through TOS dialogues. I need bank account level privacy settings to not accidentally disclose the past 400 days of my financial history.

Re: Nordigen: API aggregator to European banks

#30

Post by maverwa » Mon, Aug 02, 2021, 2:42 PM UTC

delusional wrote: post #24

elfrinjo wrote: post #20

Earlier quoted context omitted.

It is rally terrible that such a service is actually necessary... PSD2 was a chance to create a standard api for everyone including customers. I still cannot understand how they managed to f it up by limiting access to "trusted companies"

I work at a bank and it's quite simple really. The systems we use at my workplace are so antiquated and wonky that even giving people read access would be a monumental effort. To put it plainly, modernizing these systems takes effort similar in order of magnitude to landing on the moon. Not for any technical reason, but due to the mountains of manual processes and general cruft built up around them. The EU is not dea…

Oh I think its a mix of both. But I do not have your insight ofc, so just guessing. I think banks should move slowly and pay extra attention to security. Examples like N26 show that not doing so can cause significant issues.

But its also a great excuse to justify your vintage cruft.