Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Teller – API for your bank account

blog.teller.io

Post reply on HN
Print view View original

201–210 of 282 posts

Re: Teller – API for your bank account

#201

Post by narsil »

sparkling wrote: post #53
foxylion wrote: post #22

As a German it is hard to believe that such things do not exist yet in other countries. We have a standardized protocol called FinTS which is implemented by most banks. This results in a huge amount of desktop and mobile applications for banking.

FinTS (formerly known as HBCI) is horrible and serves as a great example of how not to design a API. The non-machine-readable german-language-only API specification consist of >800 pages spread across various PDFs[1] full of gibberish. There are no official client libraries, no minimal examples, different banks only support certain versions etc. etc. etc. [1] https://www.hbci-zka.de/dokumente/spezifikation_deutsch/fi…

German isn't "gibberish" to some of us, so I would not describe it that way. It's a German banking API after all. A functional API that is being used is better than no API at all.

Re: Teller – API for your bank account

#202

Post by stouset »

chirau wrote: post #175
stouset wrote: post #136

Earlier quoted context omitted.

Yeah. "No cases of fraud or loss due to screen-scraping" doesn't mean your service isn't going to be the one that leaks a treasure trove of banking credentials. It's also highly probable that it has happened, it just wasn't attributed properly.

Why do you assume everything has already happened? Do you also assume Gmail passwords have already been hacked? Just asking.

Why do you say I think "everything" has already happened?

I think it's likely one of these screen-scraping sites that store bank passwords has been breached, and any losses as a result have simply not been attributed to it.

I say this having experience in infosec and seeing how comically little companies who should care about security actually do. Often there's not even a single person with infosec experience. And they make every mistake you'd passively learn not to by casually reading HN comments.

That's not to say some companies don't get it right. Some (including my current employer) do an extraordinary job. But even teams with solid infosec staff get broken in to. The odds that a site storing large numbers of bank passwords with only a handful of engineers not getting popped sooner rather than later is slim.

Re: Teller – API for your bank account

#203

Post by traviscj »

dbbk wrote: post #122
meredydd wrote: post #79

Earlier quoted context omitted.

This is startup-ese for "Every single one of our users is breaking their bank's ToS, and we maintain plausible deniability by telling them to go and read complex legal documents themselves". I can totally understand the motivation (particularly with PSD2 around the corner, which will mandate banks to provide legit APIs - I'm guessing the plan is to grab market share before that happens). However, I am very skeptical…

To be fair I think there is still going to be a lot of appetite for a service like Teller once PSD2 launches to unify these individual bank APIs. They may not even all work the same way. It'd be much better to have one entry point than develop for multiple different banks' implementation.

The Stripe business model, basically.

Re: Teller – API for your bank account

#204

Post by curun1r »

djsumdog wrote: post #153
viraptor wrote: post #134

Earlier quoted context omitted.

> It is also worth mentioning there has never been a single case of fraud or loss attributed to "screen-scraping" This response makes me angry. Every service worth attacking will have security problems at some point. You're running a store of bank credentials, which you have to have access to (as opposed to password managers for example which can store user encrypted data). Given enough time, one of these services wi…

This is what always worried me about services like Mint.

Mint is probably the one you don't have to worry about. The service that stores credentials and scrapes bank sites is the same one that powers TurboTax and QuickBooks. Intuit spends a lot of money keeping that service secure and they're well aware of how catastrophic a breech would be.

In short, that service is run out of private datacenters, not publicly available. You'd have to compromise not just Mint/TurboTax/QuickBooks but then the FICDS service, which only has methods that take a token representing the credentials and passes back transactions, not the actual credentials.

It's the competitors to Mint who can't afford their own datacenters and don't have the many millions of dollars to put into securing their service the way Intuit does that should be much more worrisome.

Disclaimer: I used to work at Intuit, though not on any of the products I mentioned. But I have had many conversations with the people that run Mint and FICDS and I know the overall architecture used. I give my bank credentials to Mint without any worry. It would probably require a state-level entity to get in, and they'd likely need to get someone hired into that group to facilitate it. The service is very secure.

Re: Teller – API for your bank account

#205

Post by runeks »

> Transfer money between accounts, make external payments using Faster Payments, and manage your payees, standing orders, and Direct Debits all through the Teller API.

What will the fees be on sending/receiving money?

Scraping data from your own bank account seems rather uninteresting to me. I assume sending/transferring is limited to domestic banks. Is this the case?

Re: Teller – API for your bank account

#206

Post by ldn_tech_exec1 »

runeks wrote: post #205

> Transfer money between accounts, make external payments using Faster Payments, and manage your payees, standing orders, and Direct Debits all through the Teller API. What will the fees be on sending/receiving money? Scraping data from your own bank account seems rather uninteresting to me. I assume sending/transferring is limited to domestic banks. Is this the case?

Teller allows developers to build applications on top of their users' bank accounts, not just your own. Read more about TAuth and how it works here: https://blog.teller.io/2016/04/26/tauth.html

Re: Teller – API for your bank account

#207

Post by KGIII »

knlje wrote: post #91
wutwutwutwut wrote: post #55

Earlier quoted context omitted.

How do you actually share your credentials? I assume you have to provide a 2FA-token when logging on?

You write the equivalent info (user+pass+keycode) into a third party app.

Is it me, or does this read like a disaster in the making?

Re: Teller – API for your bank account

#208

Post by film42 »

kondro wrote: post #195
film42 wrote: post #185

Engineer at MX here! We have a similar product for US and Canadian banks called Atrium. More info here: https://atrium.mx.com/home NOTE: I saw a few people mentioning Plaid and Quovo so I thought it would be appropriate to mention our product.

Didn't Morningstar just sell you to a bank though? Is your product still going to be on the open market in 6 months time?

MX is not owned by any bank. It's still privately owned startup. We are long term in that we have many 5-7 year contracts with big name banks and add more each quarter. We offer mobile banking solutions, data categorization and budgeting tools to banks, so we Atrium is a product to sell access to the services we built to power our other products. So yes, our product will definitely be on the market for years to come.

We do add as many data sources as possible. We can use Morningstar for example to find cusip of holdings data. We're always trying to improve too :).

Re: Teller – API for your bank account

#209

Post by txdv »

fkistner wrote: post #84
sparkling wrote: post #53

Earlier quoted context omitted.

FinTS (formerly known as HBCI) is horrible and serves as a great example of how not to design a API. The non-machine-readable german-language-only API specification consist of >800 pages spread across various PDFs[1] full of gibberish. There are no official client libraries, no minimal examples, different banks only support certain versions etc. etc. etc. [1] https://www.hbci-zka.de/dokumente/spezifikation_deutsch/fi…

Enterprisey APIs with adoption beat nicely designed APIs without adoption anytime. Besides, that does not explain, why none of the other banks can get their act together. If FinTS is too difficult to implement, how come they are not offering something simpler?

Like xml and json... Wait a minute

Re: Teller – API for your bank account

#210

Post by tempestn »

curun1r wrote: post #204
djsumdog wrote: post #153

Earlier quoted context omitted.

This is what always worried me about services like Mint.

Mint is probably the one you don't have to worry about. The service that stores credentials and scrapes bank sites is the same one that powers TurboTax and QuickBooks. Intuit spends a lot of money keeping that service secure and they're well aware of how catastrophic a breech would be. In short, that service is run out of private datacenters, not publicly available. You'd have to compromise not just Mint/TurboTax/Qui…

I don't know, if the general level of bug-ridden-ness of their products is any indication, I wouldn't put much stock in their security. There are glaring bugs in Quickbooks for example that persist year after year, having been reported repeatedly, even as they continue to release a new version every single year with various visual tweaks and seemingly not much else.
Post reply on HN