Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

SimpleFIN Bridge – Securely provide your bank transaction data to apps

bridge.simplefin.org

Post reply on HN
Print view View original

31–35 of 35 posts

Re: SimpleFIN Bridge – Securely provide your bank transaction data to apps

#31

Post by iffycan »

wolframarnold wrote: post #24

This is pretty interesting. Aside from the security questions already asked, and assuming they can be addressed satisfactorily, I have this question/suggestion: Financial institutions all differ in their online offerings and most live in the stone age (i.e. no useful API's), such that accessing transaction data relies largely on screen scraping. One of the biggest make or break moments for services like yours is gett…

We have attempted to try the open source bank access model you've described [1], but I'm not confident that such a system would ever be dependable without the cooperation of the FIs themselves, for the reasons AdieuToLogic gives.

[1] https://github.com/simplefin/bank-access

Re: SimpleFIN Bridge – Securely provide your bank transaction data to apps

#32

Post by iffycan »

AdieuToLogic wrote: post #26

Since this offering appears to be heavily based on OAuth 2.0, if not completely compliant with it, how have you addressed the concerns set forth in RFC-6819 "OAuth 2.0 Threat Model and Security Considerations"[1]? And what reparations are SimpleFIN agreeing to provide in the event of customer information being compromised? 1 - http://tools.ietf.org/html/rfc6819

It actually isn't based on OAuth2. For instance, consumers of the read only SimpleFIN protocol don't have to establish a relationship with the server -- they need only provide credentials. Also, the SimpleFIN Server does not redirect a client back to another server -- it is left to the user to deliver the credentials to the party(ies) of their choosing.

As far as reparations, we haven't yet published that policy, but we will.

Re: SimpleFIN Bridge – Securely provide your bank transaction data to apps

#33

Post by AdieuToLogic »

iffycan wrote: post #32
AdieuToLogic wrote: post #26

Since this offering appears to be heavily based on OAuth 2.0, if not completely compliant with it, how have you addressed the concerns set forth in RFC-6819 "OAuth 2.0 Threat Model and Security Considerations"[1]? And what reparations are SimpleFIN agreeing to provide in the event of customer information being compromised? 1 - http://tools.ietf.org/html/rfc6819

It actually isn't based on OAuth2. For instance, consumers of the read only SimpleFIN protocol don't have to establish a relationship with the server -- they need only provide credentials. Also, the SimpleFIN Server does not redirect a client back to another server -- it is left to the user to deliver the credentials to the party(ies) of their choosing. As far as reparations, we haven't yet published that policy, but…

> It actually isn't based on OAuth2.

Well, your spec requires use of the HTTP Bearer token[1], which is described in the Introduction section of RFC 6750 as being:

"This specification defines the use of bearer tokens over HTTP/1.1 [RFC2616] using Transport Layer Security (TLS) [RFC5246] to access protected resources."

So I hope you can understand my impression.

And there are legitimate criticisms of using Bearer tokens[1]. With the offering you are considering, these are very significant.

FWIW, you may think I'm being adversarial/hyper-critical/a-dick (or any combination therein). I can definitively say that in my mind I am not (in this particular case) _and_ that the questions/statements I've posted on this forum are "kindergarten level with mittens on" compared to what the eCommerce banking community will hit you with.

If, as you said in a separate reply, you have worked in the PCI space for the last decade, then the scrutiny you will be exposed to will not be a surprise.

1 - http://hueniverse.com/2010/09/29/oauth-bearer-tokens-are-a-t...

Re: SimpleFIN Bridge – Securely provide your bank transaction data to apps

#34

Post by wglb »

AdieuToLogic wrote: post #25
tptacek wrote: post #15

1. What are you actually doing to secure this? Are you encrypting persistent data? What data do you retain and for how long? 2. Who's in charge of your application security? Do you have a full-time security person on staff? Can we see who they are? 3. Have you retained a security consultancy to review your code? Are you doing it on a regular basis, or as a one-shot thing? 4. Do you have a security page somewhere we c…

Most of these questions can be rolled up into: Where is their proof of PCI Data Security Compliance[1]? The fact that the submitter responded to your detailed and relevant questions with "This is helpful; I'll get you a good response when I have a good moment" is reason enough to run as far away as possible from this. 1 - https://www.pcisecuritystandards.org/financial_institutions/

I don't think PCI is anywhere near the minimum that is needed. In the JP Morgan hack: did their PCI compliance help their status? In the Target breach: did their PCI compliance help prevent their attack? How about the Global Payments breach of a couple of years ago?

So with respect to Most of these questions can be rolled up into, i would post a Strong Disagree.

Re: SimpleFIN Bridge – Securely provide your bank transaction data to apps

#35

Post by iffycan »

tptacek wrote: post #15

1. What are you actually doing to secure this? Are you encrypting persistent data? What data do you retain and for how long? 2. Who's in charge of your application security? Do you have a full-time security person on staff? Can we see who they are? 3. Have you retained a security consultancy to review your code? Are you doing it on a regular basis, or as a one-shot thing? 4. Do you have a security page somewhere we c…

Alright, here's something tangible: https://bridge.simplefin.org/info/security It's not complete, but it's a start. We'll gladly take feedback.
Post reply on HN