Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023(finledger.com)
finledger.com
Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023
https://finledger.com/2021/08/09/canada-sets-open-banking-target-for-2023/
256 comments
Plaid is only one security breach away from being utterly destroyed. And they will take out the financial lives of all their customers with them.
It’s utterly irresponsible and I have no idea how Plaid hasn’t been shut down. You have no recourse if they are breached. The TOS of your online banking probably says that if you disclose your username and password to any third party then you have no liability protections.
It’s utterly irresponsible and I have no idea how Plaid hasn’t been shut down. You have no recourse if they are breached. The TOS of your online banking probably says that if you disclose your username and password to any third party then you have no liability protections.
> It’s utterly irresponsible and I have no idea how Plaid hasn’t been shut down. You have no recourse if they are breached.
Wise (formerly TransferWise) is another example. You have to move funds into your Wise account before you can do a transfer, payment, or currency exchange. Wise offer various ways to fund your account such as wire transfer, credit card payment, debit card payment, etc., each of which has different fees, but by far the lowest fee is "direct debit" which involves giving Wise your bank card number and password. I imagine that the overwhelming majority of Wise customers have no idea that this is terrible for security and privacy.
Everything about this practice is hard to believe:
1) I doubt that any bank has given Wise permission to do this.
2) Which raises the question about why the banks aren't blocking IP addresses that Wise uses to log into bank accounts, or at least making a complaint to Wise.
3) It's obviously against the banks' terms of service, but Wise may be breaking some law regarding unauthorized access (in the same vein that you can't authorize a third party to use your passport, for example).
4) What else is Wise doing after they log into your bank account? Are they collecting other information about your transactions and balance?
5) Does Wise store your bank card number and password? If they do, they'd have to store it as cleartext (not as a one-way hash) if they expect to use it again. They could encrypt it of course, but it would have to be reversible so they could get the cleartext back.
6) Why hasn't any bank regulator forced them to stop doing this?
Wise (formerly TransferWise) is another example. You have to move funds into your Wise account before you can do a transfer, payment, or currency exchange. Wise offer various ways to fund your account such as wire transfer, credit card payment, debit card payment, etc., each of which has different fees, but by far the lowest fee is "direct debit" which involves giving Wise your bank card number and password. I imagine that the overwhelming majority of Wise customers have no idea that this is terrible for security and privacy.
Everything about this practice is hard to believe:
1) I doubt that any bank has given Wise permission to do this.
2) Which raises the question about why the banks aren't blocking IP addresses that Wise uses to log into bank accounts, or at least making a complaint to Wise.
3) It's obviously against the banks' terms of service, but Wise may be breaking some law regarding unauthorized access (in the same vein that you can't authorize a third party to use your passport, for example).
4) What else is Wise doing after they log into your bank account? Are they collecting other information about your transactions and balance?
5) Does Wise store your bank card number and password? If they do, they'd have to store it as cleartext (not as a one-way hash) if they expect to use it again. They could encrypt it of course, but it would have to be reversible so they could get the cleartext back.
6) Why hasn't any bank regulator forced them to stop doing this?
I've never seen this in either the UK or Finland when using Wise. Direct Debit is a legit thing that's more common in the UK - but that takes several days to clear and the protection is quite strong, Wise would have lost a lot of money to fraud if they offered it as an option...
They use Trustly in the Nordics to do something similar to what you mention, which does seem to use propper bank APIs - as I have to authenticate it on the bank app or website separately.
They use Trustly in the Nordics to do something similar to what you mention, which does seem to use propper bank APIs - as I have to authenticate it on the bank app or website separately.
I just transferred some cash from UK -> Europe and whatd'ya konw? There is indeed a hook to the bank, but I am pretty convinced that it is just the legit, real, EU (& UK) wide open banking that Wise have implemented for most of the popular UK banks, mainly because I was on the First Direct (my bank) site the entire time once I clicked through, and I still had to authenticate properly with the app for anything to actually happen.
Are you sure you're not confusing things? Direct debit usually means just a permission to charge the given account for the specified amount. It's commonly used in Canada and doesn't involve sharing your password.
Wise (formerly TransferWise) has different meanings for "debit" and "direct debit".
Their "debit" option works the way you think. You give only your bank card number, expiry date, and CVV.
However, their "direct debit" option requires you to enter your bank debit card number and bank password into Wise's web form. It is not a redirect to the bank website. The URL says "https://wise.com/..." when you're asked to enter that info. Wise definitely gets your bank credentials.
They have yet another option called "bill payment" in which you log into your bank account yourself and do a bill payment to Wise (and giving your Wise account number).
Both the "debit" and "bill payment" methods look secure and acceptable. But Wise charges a considerably higher fee than with their "direct debit" method. And it always seems to take a day or two for the funds to appear in your Wise account with those other methods. They really want to encourage their "direct debit" method in which they get your bank login info.
Their "debit" option works the way you think. You give only your bank card number, expiry date, and CVV.
However, their "direct debit" option requires you to enter your bank debit card number and bank password into Wise's web form. It is not a redirect to the bank website. The URL says "https://wise.com/..." when you're asked to enter that info. Wise definitely gets your bank credentials.
They have yet another option called "bill payment" in which you log into your bank account yourself and do a bill payment to Wise (and giving your Wise account number).
Both the "debit" and "bill payment" methods look secure and acceptable. But Wise charges a considerably higher fee than with their "direct debit" method. And it always seems to take a day or two for the funds to appear in your Wise account with those other methods. They really want to encourage their "direct debit" method in which they get your bank login info.
Are you in the US?
I think Wise’s ways of adding funds vary depending on what’s available in terms of payment infrastructure in each country. In the UK where Wise is based, direct debits are very common for routine payments but do not require a card number. But for receiving money Wise UK’s closest equivalent right now is to authorise payment via open banking and your bank ( the newish UK specs for doing this are really good and online here: https://standards.openbanking.org.uk/ )
I'm speaking about Canada. I should have mentioned that. You're right that the payment options are probably quite different in each country where Wise operates.
Out of curiosity, in Canada (and the USA, where I assume it will be similar), how do you call the system to authorise a business, for example a utility company, to charge your bank account directly every given period, with a more-or-less flexible amount, and with no need for you to take any action?
The reason I ask is that that is what is called a "Direct Debit" in the UK and the European SEPA area, and it does not involve providing any credentials to the bank account. Rather, you only need to provide your International Bank Account Number (IBAN) and maybe your name. However, the ability for a company to be able to take Direct Debit payments is heavily regulated, you can easily cancel them via your bank, and even reverse charges if they were illegitimate.
The reason I ask is that that is what is called a "Direct Debit" in the UK and the European SEPA area, and it does not involve providing any credentials to the bank account. Rather, you only need to provide your International Bank Account Number (IBAN) and maybe your name. However, the ability for a company to be able to take Direct Debit payments is heavily regulated, you can easily cancel them via your bank, and even reverse charges if they were illegitimate.
This is as common as bread and butter in Australia. You provide your bank account (or credit/debit card) details to the company or even govt (gas, electricity, water, car registration, insurance, internet, mobile etc.) and a so called direct debit authority and the company will just debit from your account on the due date.
Yes, Direct Debits or similar are something that I would normally assume is commonplace in every developed country. However, I'm so aware of the American TV trope of receiving "bills" in the mail and having to remember to pay them that I wonder if it's just something that has stuck as a cliché even if it's no longer the case, or whether it is still the ordinary way of handling these payments in North America.
Yeah, direct debit is a very specific, well-standardised thing in the UK and comes with a fair amount of consumer protection. It’s also a bit Oauth-ish in that you can unilaterally cancel it from your bank’s side of things instead of going through the provider.
Can confirm that Wise use Open Banking API to send money in the UK, if your bank supports it. If your bank doesn't support it, it's either debit / credit card or bank transfer.
[deleted]
> 2) Which raises the question about why the banks aren't blocking IP addresses that Wise uses to log into bank accounts, or at least making a complaint to Wise.
People doing screen-scraping like Plaid will seek out IPs that look innocuous. One place I heard of had bank of mobile phones all with cellular data plans hooked up to some UI automation. This lets them run screen scraping from a real phone on a real cellular network.
Also look at the company Luminati Networks/Bright Data: https://brightdata.com/proxy-types/mobile-residential-ips
They pay app developers to install an SDK on their popular mobile apps, then sell the right to run network requests through users devices. Perfect if you want to do some sketchy screen scraping and need access to a lot of innocent looking IP addresses.
People doing screen-scraping like Plaid will seek out IPs that look innocuous. One place I heard of had bank of mobile phones all with cellular data plans hooked up to some UI automation. This lets them run screen scraping from a real phone on a real cellular network.
Also look at the company Luminati Networks/Bright Data: https://brightdata.com/proxy-types/mobile-residential-ips
They pay app developers to install an SDK on their popular mobile apps, then sell the right to run network requests through users devices. Perfect if you want to do some sketchy screen scraping and need access to a lot of innocent looking IP addresses.
> Wise (formerly TransferWise) is another example
It is not. The direct debit feature you describe is provided by Plaid.
Wise itself says so in this TrustPilot answer https://ca.trustpilot.com/reviews/60e668daf9f48702a893a5e6
> It sounds like you might be trying to make a ACH direct debit payment, in which case Plaid is indeed one of the payment handlers that help us process these types of payments. However, we also offer other payment options for USD, if your account isn't able to support ACH direct debit.
There are other sources mentioning TransferWise is a customer of Plaid like https://www.digfingroup.com/plaid-visa/ and https://politechs.ca/2020/09/09/visas-acquisition-of-plaid-c...
It is not. The direct debit feature you describe is provided by Plaid.
Wise itself says so in this TrustPilot answer https://ca.trustpilot.com/reviews/60e668daf9f48702a893a5e6
> It sounds like you might be trying to make a ACH direct debit payment, in which case Plaid is indeed one of the payment handlers that help us process these types of payments. However, we also offer other payment options for USD, if your account isn't able to support ACH direct debit.
There are other sources mentioning TransferWise is a customer of Plaid like https://www.digfingroup.com/plaid-visa/ and https://politechs.ca/2020/09/09/visas-acquisition-of-plaid-c...
In Australia Wise will provide you with a reference number and hold the xfer and wait for me to transfer the money to them. Wise has a unique email called a PayId that is registered to their account.
I use my banks app and transfer money to their PayId using the reference number. The transfer takes a few seconds. When Wise gets the money in their account they resume the transfer and I get an in-app notification. Easy
I use my banks app and transfer money to their PayId using the reference number. The transfer takes a few seconds. When Wise gets the money in their account they resume the transfer and I get an in-app notification. Easy
In what country does it have that option? Doesn't seem to be a thing in Australia as far as I can tell. But we do have multiple different ways of doing free (or free for the sender and very low cost for a merchant) payments and transfers, including real-time transfers to/from financial institutions...
Given that it seems to be a similar case in Europe, UK etc. I assume this might just be a US thing?
Given that it seems to be a similar case in Europe, UK etc. I assume this might just be a US thing?
Australia does have other examples of these systems though, like poli (https://www.polipayments.com/) which is commonly used by airlines to accept and prove direct deposit payments
I work at Plaid, and I responded to this on the parent, but because this is pretty highly upvoted I figured I'd respond here too for visibility: the Consumer Financial Production Bureau addressed the fact that a financial institution cannot waive liability responsibilities in a recent Compliance Aid. FAQ 4 says that institutions cannot rely on an agreement with the consumer that waives the liability protections under Regulation E if a consumer has shared their account information with a third party because those are protections provided under the Electronic Funds Transfer Act.
Source: https://www.consumerfinance.gov/compliance/compliance-resour...
Source: https://www.consumerfinance.gov/compliance/compliance-resour...
I'm pretty salty about this. It's totally unethical, they knew it wasn't legal, and yet... they're going to be OK outside the fine?
Why do we bother being ethical when nobody besides us gives a shit outside a slap on the wrist?
You know how many people thought of Plaid before it was a thing, then rightfully wrote it off as "don't attempt"? What kind of sick precedent does this set?
Why do I even bother caring.
Why do we bother being ethical when nobody besides us gives a shit outside a slap on the wrist?
You know how many people thought of Plaid before it was a thing, then rightfully wrote it off as "don't attempt"? What kind of sick precedent does this set?
Why do I even bother caring.
> they knew it wasn't legal
Who knew what wasn't legal? I don't think anyone is doing anything illegal here?
Who knew what wasn't legal? I don't think anyone is doing anything illegal here?
Coercing credentials out of a user is phishing. I was wrong in that it may not be technically illegal, but are we really going to dispute if phishing is acceptable behaviour for a company to participate in?
You already know the answer. Ask forgiveness not permission, move fast and break things.
Our profession is such a joke. We're no better than the stereotypical trades worker of yore... a bunch of plumbers scamming and ripping off the every day person that doesn't know any better. Truly pathetic.
Or perhaps it is our systems that are pathetic? Laws, regulations and enforcement thereof has always been a bureaucratic effort.
As an early career engineer, who works at a highly bureaucratic company, I always asked for permission for access to things I needed for my job. The gate keepers would ignore me. Worst example was when my management asked me to start version controlling a project I created. I had to work with the change management department, it took them six months to create a repo on a server just because no one knew the person who knew how to do that, and they had to be the ones to make it, not me.
Then I moved up in the company and got direct communication with the customer. The gate keepers come to me, not the other way around. Repos get created in a day now.
The problem with every bureaucracy is the incentives are never aligned with the organizations stated mission. When you say “version control” what you really mean is version control for employees who directly bring money to the company, for which we’ll dedicate significant parts of our budget to employ people for a function that can be automated as some sort of make-work scheme. The incentives are messed up.
Bureaucrats only win when they don’t get fired, and they don’t get fired when they follow the policies and procedures. And policies and procedures are there for the well trodden happy path. If you are innovating, there will, by definition, be no happy path, you have to make it, and if you ask a bureaucrat for help, they’ll seize up because there is no procedure to follow. At best they’ll direct you to someone else, who will also seize up and direct you back to the same person who sent you.
I discovered that the best way around that is to make seizing up a more likely way to visibly fail. I need you to help me get this build out to the customer TODAY if failure to do that will result in higher consequences than failing to follow procedures, they will make the build.
So moving fast and breaking things can get you to that high consequence state that bureaucrats seem to budge on. If you have a successful startup that breaks the law, you can please your users, and afford lawyers to defend you in court and afford PR firms that can convince the media to harass your regulators on your behalf.
As an early career engineer, who works at a highly bureaucratic company, I always asked for permission for access to things I needed for my job. The gate keepers would ignore me. Worst example was when my management asked me to start version controlling a project I created. I had to work with the change management department, it took them six months to create a repo on a server just because no one knew the person who knew how to do that, and they had to be the ones to make it, not me.
Then I moved up in the company and got direct communication with the customer. The gate keepers come to me, not the other way around. Repos get created in a day now.
The problem with every bureaucracy is the incentives are never aligned with the organizations stated mission. When you say “version control” what you really mean is version control for employees who directly bring money to the company, for which we’ll dedicate significant parts of our budget to employ people for a function that can be automated as some sort of make-work scheme. The incentives are messed up.
Bureaucrats only win when they don’t get fired, and they don’t get fired when they follow the policies and procedures. And policies and procedures are there for the well trodden happy path. If you are innovating, there will, by definition, be no happy path, you have to make it, and if you ask a bureaucrat for help, they’ll seize up because there is no procedure to follow. At best they’ll direct you to someone else, who will also seize up and direct you back to the same person who sent you.
I discovered that the best way around that is to make seizing up a more likely way to visibly fail. I need you to help me get this build out to the customer TODAY if failure to do that will result in higher consequences than failing to follow procedures, they will make the build.
So moving fast and breaking things can get you to that high consequence state that bureaucrats seem to budge on. If you have a successful startup that breaks the law, you can please your users, and afford lawyers to defend you in court and afford PR firms that can convince the media to harass your regulators on your behalf.
I've been thinking about this quite a bit recently. I essenrially agree with you, software engineering culture/habits is nowhere close to actual "engineering". One suspicion I have is that this was largely enabled by the fact that software companies, in contrast to most hardware businesses could denounce liability for their products.
The thing is, because software companies have become the most successful businesses in the world, SE principles (move fast, break stuff) are now viewed as "being innovative" and necessary for success. So they are increasingly being applied to other engineering disciplines.
The thing is, because software companies have become the most successful businesses in the world, SE principles (move fast, break stuff) are now viewed as "being innovative" and necessary for success. So they are increasingly being applied to other engineering disciplines.
I don’t actually share your low opinion of trades people current or of yore - and even the most unethical plumber isn’t financially ruining people by the tens of thousands. All the to say this profession can be MUCH worse than the tradespeople of yore
And the fine was a joke... less then $1 per person affected.
> Nearly 98 million people were affected, according to the settlement
> Nearly 98 million people were affected, according to the settlement
I haven't used Plaid, but how is this different from Mint or Quicken that have been around for years?
Mint and Quicken are end user applications, Plaid is not. Plaid is an API provider to access financial information from multiple institutions.
Ok, but it's like the portion of Mint or Quicken that interfaces with financial institutions, and it enables end user applications, right?
When I wrote "how is it different" I meant how is it different in the task it performs which (I assume) Mint and Quicken also perform.
When I wrote "how is it different" I meant how is it different in the task it performs which (I assume) Mint and Quicken also perform.
Mint also did screen scraping, powered by Yodlee [1], if that’s what you mean. So, yes, same risks as Plaid.
They later moved off of Yodlee to Intuit APIs, post acquisition, although those also do screen scraping [2], and thus carry the same risks.
[1] https://news.ycombinator.com/item?id=1537825
[2] https://money.cnn.com/2010/12/02/pf/mint_leaves_yodlee/
They later moved off of Yodlee to Intuit APIs, post acquisition, although those also do screen scraping [2], and thus carry the same risks.
[1] https://news.ycombinator.com/item?id=1537825
[2] https://money.cnn.com/2010/12/02/pf/mint_leaves_yodlee/
As someone who attempts to import all my own banking transactions into open-source personal financial software, I certainly don't like the situation, but banks often give someone looking to download their own financial transaction data no other choice. This is basically what Intuit/Quicken do for 'Quicken Web Connect', too...
Additionally, though I think the advent of new APIs which will allow you to authenticate directly with your bank (FDX) are a great improvement for overall security, I think they're going to be a step backwards for free access to your own personal financial information. Because banks are limiting access to FDX to large players like Plaid/Quicken, I fear you will be forced to pay a third-party to get your own personal financial data in the future!
Additionally, though I think the advent of new APIs which will allow you to authenticate directly with your bank (FDX) are a great improvement for overall security, I think they're going to be a step backwards for free access to your own personal financial information. Because banks are limiting access to FDX to large players like Plaid/Quicken, I fear you will be forced to pay a third-party to get your own personal financial data in the future!
Don’t tie banks have extra steps to do things beyond read-only authentication?
My bank requires 2FA to send money to new payees. While losing my user/pass would lead to information leak, there’s little chance of my money being shipped off without further breeches.
My bank requires 2FA to send money to new payees. While losing my user/pass would lead to information leak, there’s little chance of my money being shipped off without further breeches.
Edit: Never mind, I was confusing the use of Plaid for linking accounts (like Robinhood does) with its use to actually monitor accounts (like YNAB).
How would they know about that transaction I made today without my password?
This is FUD. Lots of Plaid-based connections only allow reads. This is a regulated industry, and the fallout reputationally might be tough, but consumers are well-protected.
Is it, though? I’ve given Plaid the user name and password to my bank account. The same set of credentials that I use to log in, to pay bills, transfer money, etc. Plaid stores this information for future use in some sort of reversible encryption. So now we trust Plaid to keep both their data set of user names and encrypted passwords secure, and also to keep their decryption keys secure. Forget that noise. Like the previous commenter , they’re one breach away from exposing millions of bank account credentials. It doesn’t matter if the Plaid API is read only for the integration side - somebody has MY credentials, and that’s not read only.
Eh, it’s herd security. Hackers with credentials may pick off a few people’s accounts, but the odds of you being hit are low since it’s a hard problem to scale and there’s so many targets.
For the 0.3 seconds until they automate emptying accounts...
If all Plaid's customers accounts were emptied in one go, I suspect banks would reverse those transactions and tell any counterparties that lost money to pound sand.
I believe the cool kids call it a "hard fork", as in, if you are the bank that received the stolen funds and let someone withdraw them, you get forked, hard.
I believe the cool kids call it a "hard fork", as in, if you are the bank that received the stolen funds and let someone withdraw them, you get forked, hard.
You wouldn’t drain all accounts all at once. Pick a couple accounts to satisfy your needs and drain them. Harder to get caught.
How is that enforced? What is the technical basis that enforces read-only access using user/password auth? Especially since that user/password auth is used by an end user to do "write"-type actions?
It's enforced - sometimes - by the bank. My bank provides read access to everything with a username + password, but to transfer money or update details requires an SMS confirmation.
I remember a presentation by the head of security of an Internet-only bank years ago, about banking malware.
The latest malware was a man-in-the-browser style one: it intercepted your input and changed what you saw on-screen. This was used to defeat extra authentication: the malware inserted a (fake) deposit (something like "yearly subscription mr. X" for $2134.56) into your on-screen total and phoned home. The victim was then called by a mr. X who claimed to have accidentally swapped two digits in a transfer, and that the bank had said they can't fix it because the target account was a valid account. All they could do was exceptionally give out the phone number of the receiving side. Would you be so kind to rectify the situation?
Since mr. X had all the details correct (amount, statement on transaction), the victim would initiate and authenticate a transfer. No way for the bank to detect, as this wouls be a genuine transfer order by the account owner.
To be clear: the attack requires a victim whose browser is hacked and an associated phone number. That seemed like a tall order to me, but apparently not tall enough to stop this attack from being integrated into multi-banking malware.
In short: read-only access is good, but not sufficient to prevent all attacks.
The latest malware was a man-in-the-browser style one: it intercepted your input and changed what you saw on-screen. This was used to defeat extra authentication: the malware inserted a (fake) deposit (something like "yearly subscription mr. X" for $2134.56) into your on-screen total and phoned home. The victim was then called by a mr. X who claimed to have accidentally swapped two digits in a transfer, and that the bank had said they can't fix it because the target account was a valid account. All they could do was exceptionally give out the phone number of the receiving side. Would you be so kind to rectify the situation?
Since mr. X had all the details correct (amount, statement on transaction), the victim would initiate and authenticate a transfer. No way for the bank to detect, as this wouls be a genuine transfer order by the account owner.
To be clear: the attack requires a victim whose browser is hacked and an associated phone number. That seemed like a tall order to me, but apparently not tall enough to stop this attack from being integrated into multi-banking malware.
In short: read-only access is good, but not sufficient to prevent all attacks.
That type of hack doesn’t require the user/password. It’s also on the same league as the Nigerian Prince, just appealing to kindness rather than greed.
Idiots fall for these scams all the time, password not needed.
Idiots fall for these scams all the time, password not needed.
Read-only access is not possible. By handing over the credentials you are handing over write access. You are correct.
A couple of my banking institutions let me generate a read-only set of credentials for this sort of purpose.
Citi and Capital One have OAuth flows that Plaid supports, too, which tends to make me angrier at the banks than Plaid; the need for this stuff has been clear for a decade now, but only a few have added OAuth or similar.
Citi and Capital One have OAuth flows that Plaid supports, too, which tends to make me angrier at the banks than Plaid; the need for this stuff has been clear for a decade now, but only a few have added OAuth or similar.
AFAIU, there are still zero (0) consumer banking APIs with Read-Only e.g. OAuth APIs in the US as well?
Banks could save themselves CPU, RAM, bandwidth, and liability by implementing read-only API tokens and methods that need only return JSON - instead of HTML or worse, monthly PDF tables for a fee - possibly similar to the Plaid API: https://plaid.com/docs/api/
There is competition in consumer/retail banking, but still the only way to do e.g. budget and fraud analysis with third party apps is to give away all authentication factors: u/p/sqa; and TBH that's unacceptable.
Traditional and distributed ledger service providers might also consider W3C ILP: Interledger Protocol (in starting their move to quantum-resistant ledgers by 2022 in order to have a 5 year refresh cycle before QC is a real risk by 2027, optimistically, for science) when reviewing the entropy of username+password_hash+security_question_answer strings in comparison to the entropy of cryptoasset account public key hash strings: https://interledger.org/developer-tools/get-started/overview...
> Sender – Initiates a value transfer.
> Router (Connector) – Applies currency exchange and forwards packets of value. This is an intermediary node between the sender and the receiver. {MSB: KYC, AML, 10k reporting requirement, etc}
> Receiver – Receives the value
Multifactor authentication: Something you have, something you know, something you are
Multisig: n-of-m keys required to approve a transaction
Edit: from "Fed announces details of new interbank service to support instant payments" https://news.ycombinator.com/item?id=24109576 :
> For purposes of Interledger, we call all settlement systems ledgers. These can include banks, blockchains, peer-to-peer payment schemes, automated clearing house (ACH), mobile money institutions, central-bank operated real-time gross settlement (RTGS) systems, and even more. […]
> You can envision the Interledger as a graph where the points are individual nodes and the edges are accounts between two parties. Parties with only one account can send or receive through the party on the other side of that account. Parties with two or more accounts are connectors, who can facilitate payments to or from anyone they're connected to.
> Connectors [AKA routers] provide a service of forwarding packets and relaying money, and they take on some risk when they do so. In exchange, connectors can charge fees and derive a profit from these services. In the open network of the Interledger, connectors are expected to compete among one another to offer the best balance of speed, reliability, coverage, and cost.
W3C ILP: Interledger Protocol > Peering, Clearing and Settling: https://interledger.org/rfcs/0032-peering-clearing-settlemen...
Banks could save themselves CPU, RAM, bandwidth, and liability by implementing read-only API tokens and methods that need only return JSON - instead of HTML or worse, monthly PDF tables for a fee - possibly similar to the Plaid API: https://plaid.com/docs/api/
There is competition in consumer/retail banking, but still the only way to do e.g. budget and fraud analysis with third party apps is to give away all authentication factors: u/p/sqa; and TBH that's unacceptable.
Traditional and distributed ledger service providers might also consider W3C ILP: Interledger Protocol (in starting their move to quantum-resistant ledgers by 2022 in order to have a 5 year refresh cycle before QC is a real risk by 2027, optimistically, for science) when reviewing the entropy of username+password_hash+security_question_answer strings in comparison to the entropy of cryptoasset account public key hash strings: https://interledger.org/developer-tools/get-started/overview...
> Sender – Initiates a value transfer.
> Router (Connector) – Applies currency exchange and forwards packets of value. This is an intermediary node between the sender and the receiver. {MSB: KYC, AML, 10k reporting requirement, etc}
> Receiver – Receives the value
Multifactor authentication: Something you have, something you know, something you are
Multisig: n-of-m keys required to approve a transaction
Edit: from "Fed announces details of new interbank service to support instant payments" https://news.ycombinator.com/item?id=24109576 :
> For purposes of Interledger, we call all settlement systems ledgers. These can include banks, blockchains, peer-to-peer payment schemes, automated clearing house (ACH), mobile money institutions, central-bank operated real-time gross settlement (RTGS) systems, and even more. […]
> You can envision the Interledger as a graph where the points are individual nodes and the edges are accounts between two parties. Parties with only one account can send or receive through the party on the other side of that account. Parties with two or more accounts are connectors, who can facilitate payments to or from anyone they're connected to.
> Connectors [AKA routers] provide a service of forwarding packets and relaying money, and they take on some risk when they do so. In exchange, connectors can charge fees and derive a profit from these services. In the open network of the Interledger, connectors are expected to compete among one another to offer the best balance of speed, reliability, coverage, and cost.
W3C ILP: Interledger Protocol > Peering, Clearing and Settling: https://interledger.org/rfcs/0032-peering-clearing-settlemen...
> Hopefully individuals will be able to use the Open Banking APIs to access their own data directly, but it looks like accreditation will be required, so probably not.
When you loan your money to a bank by depositing ledger dollars or cash - and they, since GLBA in 1999, invest it and offer less than a 1% checking interest rate - and they won't even give you the record of all of your transactions as CSV/OFX `SELECT * FROM transactions WHERE account_id=?`, you have to pay $20/mo per autogenerated PDF containing a table of transactions to scrape with e.g. PDFminer (because they don't keep all account history data online)?
Seemingly OT, but not. APIs for comparison here:
FinTS / HBCI: Home Banking Computer Information protocol https://en.wikipedia.org/wiki/FinTS
E.g. GNUcash (open source double-entry accounting software) supports HBCI (and QIF (Quicken format), and OFX (Open Financial Exchange)). https://www.gnucash.org/features.phtml
HBCI/FinTS has been around in Germany for quite awhile but nowhere else has comparable banking standards? I.e. Plaid may (unfortunately, due to lack of read-only tokens across the entire US consumer banking industry) be the most viable option for implementing HBCI-like support in GNUcash
OpenBanking API Specifications: https://standards.openbanking.org.uk/api-specifications/
Web3 (Ethereum,) APIs: https://web3py.readthedocs.io/en/stable/web3.main.html#rpc-a...
ISO20022 is "A single standardisation approach (methodology, process, repository) to be used by all financial standards initiatives" https://www.iso20022.org/
Brazil's PIX is one of the first real implementers of ISO20022. A note regarding such challenges: https://news.ycombinator.com/item?id=24104351
What data format does the FTC CAT Consolidated Audit Trail expect to receive mandatory financial reporting information in? Could ILP simplify banking and financial reporting at all?
FWIU, RippleNet (?) is the only network that supports attachments of e.g. line-item invoices (that we'd all like to see in the interest of transparency and accountability in government spending).
W3C ILP: Interledger Protocol. See links above.
Of the specs in this loose category, only cryptoledgers do not depend upon (DNS or) TLS/SSL - at the protocol layer, at least - and every CA in the kept-up-to-date trusted CA cert bundle (that could be built from a CT Certificate Transparency log of cert issuance and revocation events kept in a blockchain or e.g. centralized google/trillian, which they have the trusted sole root and backup responsibilities for).
Though, the DNS dependency has probably crept back into e.g. the bitcoind software by now (which used to bootstrap its list of peer nodes (~UNL) from an IRC IP address instead of a DNS domain).
FWIU, each trusted ACH (US 'Direct Deposit') party has a (one) GPG key that they use to sign transaction documents sent over now (S)FTP on scout's honor - on behalf of all of their customers' accounts.
When you loan your money to a bank by depositing ledger dollars or cash - and they, since GLBA in 1999, invest it and offer less than a 1% checking interest rate - and they won't even give you the record of all of your transactions as CSV/OFX `SELECT * FROM transactions WHERE account_id=?`, you have to pay $20/mo per autogenerated PDF containing a table of transactions to scrape with e.g. PDFminer (because they don't keep all account history data online)?
Seemingly OT, but not. APIs for comparison here:
FinTS / HBCI: Home Banking Computer Information protocol https://en.wikipedia.org/wiki/FinTS
E.g. GNUcash (open source double-entry accounting software) supports HBCI (and QIF (Quicken format), and OFX (Open Financial Exchange)). https://www.gnucash.org/features.phtml
HBCI/FinTS has been around in Germany for quite awhile but nowhere else has comparable banking standards? I.e. Plaid may (unfortunately, due to lack of read-only tokens across the entire US consumer banking industry) be the most viable option for implementing HBCI-like support in GNUcash
OpenBanking API Specifications: https://standards.openbanking.org.uk/api-specifications/
Web3 (Ethereum,) APIs: https://web3py.readthedocs.io/en/stable/web3.main.html#rpc-a...
ISO20022 is "A single standardisation approach (methodology, process, repository) to be used by all financial standards initiatives" https://www.iso20022.org/
Brazil's PIX is one of the first real implementers of ISO20022. A note regarding such challenges: https://news.ycombinator.com/item?id=24104351
What data format does the FTC CAT Consolidated Audit Trail expect to receive mandatory financial reporting information in? Could ILP simplify banking and financial reporting at all?
FWIU, RippleNet (?) is the only network that supports attachments of e.g. line-item invoices (that we'd all like to see in the interest of transparency and accountability in government spending).
W3C ILP: Interledger Protocol. See links above.
Of the specs in this loose category, only cryptoledgers do not depend upon (DNS or) TLS/SSL - at the protocol layer, at least - and every CA in the kept-up-to-date trusted CA cert bundle (that could be built from a CT Certificate Transparency log of cert issuance and revocation events kept in a blockchain or e.g. centralized google/trillian, which they have the trusted sole root and backup responsibilities for).
Though, the DNS dependency has probably crept back into e.g. the bitcoind software by now (which used to bootstrap its list of peer nodes (~UNL) from an IRC IP address instead of a DNS domain).
FWIU, each trusted ACH (US 'Direct Deposit') party has a (one) GPG key that they use to sign transaction documents sent over now (S)FTP on scout's honor - on behalf of all of their customers' accounts.
Regulated by settlements over this specific allegation lmao
Consumers are only protected by people pointing this out over and over again
Consumers are only protected by people pointing this out over and over again
To be fair, YNAB is rather explicit about how it connects to your accounts and also actively recommends against doing so in favor of manually entering your transactions. My experience with connecting the two is that I still need to manually validate every transaction because on occasion Plaid is either slow or just misses entries entirely.
Also in the case of YNAB, Plaid is not posting transactions on your accounts. It's a screen scraping service transferring account data.
Also in the case of YNAB, Plaid is not posting transactions on your accounts. It's a screen scraping service transferring account data.
I manually enter all of my transactions, but for correcting mistakes or for automatic payments, linking to my bank accounts is still very useful.
Also, some accounts update faster than others for some reason. Usually YNAB will import them the same day.
Plaid doesn't post transactions, but it does have my credentials which I said I would not share with anyone when I opened my bank account. Those credentials do allow posting transactions, and while it's not likely that anything will happen, if something does, I'm theoretically responsible. At the moment, I'm willing to take that risk.
Also, some accounts update faster than others for some reason. Usually YNAB will import them the same day.
Plaid doesn't post transactions, but it does have my credentials which I said I would not share with anyone when I opened my bank account. Those credentials do allow posting transactions, and while it's not likely that anything will happen, if something does, I'm theoretically responsible. At the moment, I'm willing to take that risk.
FWIW I use Schwab for banking and I was able to connect YNAB to Schwab without entering my password. It looks like Schwab supports read-only API access, and Plaid takes advantage of that to avoid needing your credentials.
As an added plus, you can keep 2FA enabled. Schwab does 2FA through an app so it's a touch above SMS-based 2FA (although only a single app is supported, Symantic VIP Access, rather than generic support for apps like Google Authenticator).
I also hate Plaid's model where you provide Plaid your credentials, and I've never entered my credentials into Plaid.
As an added plus, you can keep 2FA enabled. Schwab does 2FA through an app so it's a touch above SMS-based 2FA (although only a single app is supported, Symantic VIP Access, rather than generic support for apps like Google Authenticator).
I also hate Plaid's model where you provide Plaid your credentials, and I've never entered my credentials into Plaid.
If you trust python-vipaccess[0], you can use it to provision the token to load into your preferred TOTP app. It’s not a supported method but if you (or someone coming across this later) want to use another app it’s an option :) From WilsonHammer on Reddit[1]:
1) Install pip, a python package manager, using your OS package manager.
2) Install python-vipaccess by executing `pip install --user python-vipaccess`
3) Execute `vipaccess provision -p -t VSMT` - this will print out all the information needed. Note the Symantec ID (it looks like VSMT12345678). It is what goes in the "Credential ID" field when adding a new device on Schwab's website.
4) Save the `otpauth://...` data into data.txt.
4.5) (Optional) Modify the `issuer=Symantec` parameter to read `issuer=Charles%20Schwab` Also change `VIP%20Access:VSMT123456789` to your Schwab online banking username. These are purely aesthetic changes and will only make a difference in the label that shows up in the Google Auth app.
5) Install qrencode using your OS package manager.
6) Execute `qrencode.exe -o qr.png -s 15 < data.txt` to generate the QR image (qr.png) from your otpauth data file. The -s 15 scales how many pixels wide a QR block is in the image (in this case, 15).
7) Scan the QR image (qr.png) with your google auth app.
8) Go to Schwab -> Service -> Security Center -> Manage Two-Step Verification -> Add another Security Token and input the Symantec ID from step 3 (it looks like VSMT12345678) and the current rolling TOTP code from the Google Auth App. (If you use Authy you may have to type it manually)
[0] https://github.com/dlenski/python-vipaccess
[1] https://www.reddit.com/r/personalfinance/comments/hvvuwl/usi...
1) Install pip, a python package manager, using your OS package manager.
2) Install python-vipaccess by executing `pip install --user python-vipaccess`
3) Execute `vipaccess provision -p -t VSMT` - this will print out all the information needed. Note the Symantec ID (it looks like VSMT12345678). It is what goes in the "Credential ID" field when adding a new device on Schwab's website.
4) Save the `otpauth://...` data into data.txt.
4.5) (Optional) Modify the `issuer=Symantec` parameter to read `issuer=Charles%20Schwab` Also change `VIP%20Access:VSMT123456789` to your Schwab online banking username. These are purely aesthetic changes and will only make a difference in the label that shows up in the Google Auth app.
5) Install qrencode using your OS package manager.
6) Execute `qrencode.exe -o qr.png -s 15 < data.txt` to generate the QR image (qr.png) from your otpauth data file. The -s 15 scales how many pixels wide a QR block is in the image (in this case, 15).
7) Scan the QR image (qr.png) with your google auth app.
8) Go to Schwab -> Service -> Security Center -> Manage Two-Step Verification -> Add another Security Token and input the Symantec ID from step 3 (it looks like VSMT12345678) and the current rolling TOTP code from the Google Auth App. (If you use Authy you may have to type it manually)
[0] https://github.com/dlenski/python-vipaccess
[1] https://www.reddit.com/r/personalfinance/comments/hvvuwl/usi...
In the UK, which has implemented open banking already, you can use services like https://syncforynab.com/ (no affiliation, just a happy customer) to link your accounts to YNAB. Some challenger banks like Monzo and Starling allow you to set up webhooks for transactions so they're immediately available in YNAB through Sync for YNAB rather than having to use x-hourly syncs via open banking companies that are officially blessed by the big banks.
I recently moved back to the US after 5 years in the UK. It’s hard to overstate how awesome Monzo is, and how much of a steaming pile of 3rd world shit banking in the US is.
Addendum: I still use Monzo in the US. Call the cops. I don’t care.
I haven't read the entire report yet, but it seems like a step in the right direction (even given some of the caveats folks have pointed out). I work at Plaid and a big focus area for us is to move as much traffic to APIs as possible, with a target of 75% of traffic to be committed to APIs by EOY, and we’re hopeful that we’ll be close to a fully API based industry in the next few years. IMO anything that makes API-based connectivity and open finance standards more widespread is a win for both fintech developers and anyone with a bank account.
It’s worse than that. I assume Plaid doesn’t scrape bank sites and rely on 3rd parties to bypass the EULAs on bank sites.
can you please elaborate? this is quite the accusation
It is something I heard working in fintech, a lot around security, that the aggregators rely on 3rd party scrapers. Not plaid specific.
I think the future is that banks/bank apps will do the budgeting stuff themselves. Most bank apps will now break down your monthly spending by categories. My bank app shows me my weekly and monthly spend compared to previous periods, how much I spent in each category, how much I spent at each business, how much I have spent this month so far compared to the same time last month and etc.
I hope not. I have accounts at more than one bank, and need to have the data centralized for it to be useful.
Having a standard and open API across banks, brokerages, and credit providers would be killer.
Having a standard and open API across banks, brokerages, and credit providers would be killer.
My bank does that too, and has done so for many years now. It's close to useless though, because I have no control over it. YNAB isn't just historical trends, it's a budgeting program.
Startups prove the model, and then legacy enterprises adopt.
Uk banks are doing this now. You can use open banking to show all your (uk) accounts in one place
Hi! I work at Plaid wanted to share that the Consumer Financial Production Bureau addressed the fact that a financial institution cannot waive liability responsibilities in a recent Compliance Aid. FAQ 4 says that instititutions cannot rely on an agreement with the consumer that waives the liability protections under Regulation E if a consumer has shared their account information with a third party because those are protections provided under the Electronic Funds Transfer Act.
Source: https://www.consumerfinance.gov/compliance/compliance-resour...
Source: https://www.consumerfinance.gov/compliance/compliance-resour...
That's for the USA. This news is about Canada.
But still. Terrible security model, right?
Dunno how Turbotax does things under the hood in the US, but when it prompts me for the username and password of my broker to import my info, it certainly make me very queasy.
This is basically the main reason why I built uFincs (https://ufincs.com/) without any sort of bank integration. As a Canadian myself, the privacy implications of letting a third party like Plaid take my bank password to get my data were, indeed, rather sketchy. I've been looking forward to the day that open banking gets pushed here, so this is definitely good news that uFincs (and every other personal finance app) nmight eventually get some secure bank integrations.
Although, knowing how these things usually go, I'm sure the "2023" target is a little optimistic...
Although, knowing how these things usually go, I'm sure the "2023" target is a little optimistic...
>if something goes wrong and Plaid loses my money somehow, is there any recourse
Wait, you mean you don't read and understand every word of every legal agreement you accede to??
Ok, well, as a responsible consumer, have you considered keeping a lawyer on retainer?
Wait, you mean you don't read and understand every word of every legal agreement you accede to??
Ok, well, as a responsible consumer, have you considered keeping a lawyer on retainer?
I've worked for a heavy customer of Plaid, and I've experienced the good and bad side of said entities and architectures, and the propaganda used by both sides. Banks say "impersonate", Plaid says something else. I think a reasonable viewpoint could say that you are authorizing Plaid to act on your behalf. Would a bank punish a rich person for having their accountant/finance manager know their credentials and use them in their duties? Would a bank publicly punish someone for storing their bank password in a password manager? How about an online password manager?
I don't know what Plaid is.
But the user/password thing sounds insane. How can that be even an idea for a solution?
What else is there, when the bank doesn't provide an API & the ability to do something proper, like OAuth2?
There is this alternative: don't create a service that does something like this.
This put me off this type of banking app the first time I tried to register an account with them ten years ago, and I haven't touched them since.
I suppose EU users have an easier time with the PDS2 directive mandating interoperability between banking actors, but I'm unsure how many have found a way around properly implementing it.
I suppose EU users have an easier time with the PDS2 directive mandating interoperability between banking actors, but I'm unsure how many have found a way around properly implementing it.
> YNAB (You Need A Budget) use services like Plaid to...take my username and password and impersonate me to get my banking data
WHAT. THE. F.
I'm a longtime, happy YNAB user. I had no idea this was going on until just now. I always just assumed there were secure APIs used to import my data. YNAB's Capital One "integration" stopped working a few years ago (possibly because they cracked down on screen scraping?) and I was upset with Capital One. Perhaps Capital One took steps to prevent insecure access/screen scraping?
WHAT. THE. F.
I'm a longtime, happy YNAB user. I had no idea this was going on until just now. I always just assumed there were secure APIs used to import my data. YNAB's Capital One "integration" stopped working a few years ago (possibly because they cracked down on screen scraping?) and I was upset with Capital One. Perhaps Capital One took steps to prevent insecure access/screen scraping?
For future reference the tip off is that YNAB/Plaid asks for your bank account's username and password directly. If they were using some proper API, you'd be redirected to an Authorization page on your bank's domain where you could review the requested permissions and the app requesting, and then choose to grant it.
Exactly this, Plaid "kindly requests" you violate the ToS you have with the bank and hand over the keys to your finances.
I have never noped out of anything so hard.
I have never noped out of anything so hard.
It would be interesting if an attorney general went after Plaid for CFAA violation.
I'm conflicted on the issue. Plaid only has to do this insane screen scraping because there's no other way to get my own financial data. The details of how it's done pains me, but I also think I should have freedom of choice with my data.
IMHO, the Canadian proposal seems like the ideal solution. Force the banks to offer a secure and more efficient way for consumers to access their open banking data. (This will also massively lower the barrier to entry for another Plaid competitor)
edit: Plaid's docs mention that banks may detect and block this screen-scraping. They frame it as the bank limiting "your ability to access your financial information", which I think is somewhat valid. They're quite obtuse about the whole scraping thing though: https://plaid.com/trouble-connecting/#:~:text=Your%20financi...
IMHO, the Canadian proposal seems like the ideal solution. Force the banks to offer a secure and more efficient way for consumers to access their open banking data. (This will also massively lower the barrier to entry for another Plaid competitor)
edit: Plaid's docs mention that banks may detect and block this screen-scraping. They frame it as the bank limiting "your ability to access your financial information", which I think is somewhat valid. They're quite obtuse about the whole scraping thing though: https://plaid.com/trouble-connecting/#:~:text=Your%20financi...
I'm not conflicted on it at all. Plaid might need to do this for them to work, but there's nothing that makes Plaid required for anything you do with your banking. People keep mistaking convenience for necessity, and that's how we keep ending up with hacked-together services that leak everyone's info and worse.
I'd rather have no convenience than a convenience that hands off the keys to my life behind my back. And so should the rest of us.
I'd rather have no convenience than a convenience that hands off the keys to my life behind my back. And so should the rest of us.
You're basically saying that if a law makes something impossible, then it's OK to ignore the law?
This is how most old/out of date laws/not fit for purpose laws end up being revised.
Hi! I work at Plaid. We’re strong advocates for API-based connectivity -- our goal is for 75% of our traffic to be committed to APIs by the end of the year. As part of that, we've actually converted our integration with Capital One to be 100% API-based and use OAuth for authentication. You can read more here: https://www.capitalone.com/about/newsroom/data-sharing-agree...
What you did was wrong and you all knew it.
It seems to have paid off though, so congratulations. Nobody with half a brain would trust you.
It seems to have paid off though, so congratulations. Nobody with half a brain would trust you.
Let's be real, banks wouldn't see government regulation like this if something like Plaid didn't force them to have to implement more secure ways to get your own financial data.
I actually do agree - but two wrongs don't make a right here. Taking raw credentials from users without them knowing is completely messed up and a massive danger to the end-user. It's not justifiable in those terms.
Yes I agree it can be scary, but it seems like this is the way a lot of companies have to do things if they want regulation to change at any reasonable pace.
Just look at Uber and AirBnB as examples. Most cities they started in they were operating in kinda grey areas or even breaking laws. But they could afford to eat any fines and continue on anyway. It forced governments to put regulations in place to support these systems.
Especially when it comes to banking, it moves at such a snails pace for anything to ever evolve. The two banks I am with in Canada only just recently finally added support for 2FA. But it's not even the type where you can use your own authenticator app. You have to use SMS, Phone Call, or their app. My one bank has my "password" being restricted to 6 characters. It's basically got to be a 6 digit pin. It's incredibly insecure already, Plaid doesn't make it much worse.
Now with 2FA finally there I feel a lot more secure using Plaid. Because now everytime I want to import my transactions in YNAB I have to enter my 2FA code before it can pull things.
Just look at Uber and AirBnB as examples. Most cities they started in they were operating in kinda grey areas or even breaking laws. But they could afford to eat any fines and continue on anyway. It forced governments to put regulations in place to support these systems.
Especially when it comes to banking, it moves at such a snails pace for anything to ever evolve. The two banks I am with in Canada only just recently finally added support for 2FA. But it's not even the type where you can use your own authenticator app. You have to use SMS, Phone Call, or their app. My one bank has my "password" being restricted to 6 characters. It's basically got to be a 6 digit pin. It's incredibly insecure already, Plaid doesn't make it much worse.
Now with 2FA finally there I feel a lot more secure using Plaid. Because now everytime I want to import my transactions in YNAB I have to enter my 2FA code before it can pull things.
But is it a good thing for companies that are rich enough to be able to force changes in regulations by overwhelming the government's ability to punish them?
No, it definitely is not. Governments notoriously move slow and they do not often keep up with the fast moving pace of technology.
Governments for the most part worldwide have still done barely anything to address things like "loot boxes" in gaming despite them being almost identical to gambling. They aren't even getting fined or anything for this and are raking in billions of dollars. So whether or not big companies are doing things to break regulations they can still be doing things that should be regulated or are not ethical anyway.
The taxi industry was pretty bad and often filled with scams and corruption. One of the cities I live near only allowed one cab company to be licensed in the city and they sucked especially when people needed rides home at night. So when Uber came in people loved it because they could finally get home safety after a night of drinking and it discouraged people from having to try and drive home drunk. For whatever reason the city always only allowed this one cab company. It would be reasonable to think a city official had some affiliation with that company to not allow other cab companies to come in.
Uber forced that to happen and it forced them to make regulation for it. There seemed to be no progress in that happening before Uber came to town.
So while Uber has some pretty shitty practices and I wouldn't consider it a good company, it is definitely a good example of what often needs to be done to force regulation.
And I mean a city always had the option to increase their fines to something massive and hit Uber hard, but instead they realized that their population wanted that and they would likely lose a lot of votes if they did something against the people like that.
Governments for the most part worldwide have still done barely anything to address things like "loot boxes" in gaming despite them being almost identical to gambling. They aren't even getting fined or anything for this and are raking in billions of dollars. So whether or not big companies are doing things to break regulations they can still be doing things that should be regulated or are not ethical anyway.
The taxi industry was pretty bad and often filled with scams and corruption. One of the cities I live near only allowed one cab company to be licensed in the city and they sucked especially when people needed rides home at night. So when Uber came in people loved it because they could finally get home safety after a night of drinking and it discouraged people from having to try and drive home drunk. For whatever reason the city always only allowed this one cab company. It would be reasonable to think a city official had some affiliation with that company to not allow other cab companies to come in.
Uber forced that to happen and it forced them to make regulation for it. There seemed to be no progress in that happening before Uber came to town.
So while Uber has some pretty shitty practices and I wouldn't consider it a good company, it is definitely a good example of what often needs to be done to force regulation.
And I mean a city always had the option to increase their fines to something massive and hit Uber hard, but instead they realized that their population wanted that and they would likely lose a lot of votes if they did something against the people like that.
Literally the only way for apps you want to use with your own financial details is to screen scrape.
Plaid better have good security!
But I don't see this as unethical in the slightest. In fact, I see it as a company doing the right thing by consumers in letting them get access to their own data.
Plaid better have good security!
But I don't see this as unethical in the slightest. In fact, I see it as a company doing the right thing by consumers in letting them get access to their own data.
I don’t see this as wrong at all, it’s an extremely useful feature with no alternative. Actually if alternatives start to appear it’s to services like theirs.
And insulting their whole user base like this sure will get you lots of support.
And insulting their whole user base like this sure will get you lots of support.
Do you make it unmistakably clear for new users that if you have a data breach and someone loses $400,000 because you leaked their password, they are likely shit out of luck?
Don't know US regulations, but my country has plenty of case law determining that the customer is liable for every single dollar of loss if someone uses their account details to steal their money or take a massive loan in their name.
Don't know US regulations, but my country has plenty of case law determining that the customer is liable for every single dollar of loss if someone uses their account details to steal their money or take a massive loan in their name.
Is there a list of which institutions you support using APIs versus screen scrapers? I'm a happy user of YNAB and would like to have automated imports for any bank that can be read from securely.
Unfortunately, there isn't a comprehensive list that I'm allowed to share, and even if there were we're often rolling out API access gradually because it can require implementation changes on the developer's side (for example, to support an OAuth redirect flow), so it's possible that right now a particular institution may be accessed via API in one Plaid integration but via screen-scraping in another. I think the only thing I can say here about specific institutions is that of the major US banks, Capital One, Chase, Wells Fargo, and US Bank have all issued press releases indicating that they have signed agreements with us to provide API based access.
I'm sure you guys started at that point and realized it was not possible because the banks didn't offer it, didn't understand why, and didn't care about you
And now after you made your solution and gained traction with many fintech apps, the timeline was accelerated by FTC settlements
But don't get the order twisted, you're trying to plai us.
And now after you made your solution and gained traction with many fintech apps, the timeline was accelerated by FTC settlements
But don't get the order twisted, you're trying to plai us.
You gave them your bank account login credentials and you didn't think it was strange?
Plaid has designed the screens to resemble each bank's login screen. They essentially phish people. I, as a tech-savvy person, noticed something was up when I saw the URL didn't match my bank's. But most people would put in their password, thinking they are logging into their bank's website, and would be none the wiser.
OK, I work at Plaid and I feel like I have to jump in here -- while it's true that we've iterated on the Plaid Link UI over time and it hasn't always looked like it does now, you can see what the login screen currently looks like here: https://plaid.com/plaid-link/ and here: https://plaid.com/demo/
IMO it does clearly tell end users that they are connecting to Plaid.
IMO it does clearly tell end users that they are connecting to Plaid.
So some good finally came from that TD lawsuit. The last time I saw a Plaid login in a service I use, it was a definite phishing screen. It's good that you have moved away from phishing people, but it doesn't change the fact that a) you phished them for years, and b) you still do not in any way warn them that if they use your service it 'voids the warranty', so if their account gets hacked (not necessarily through Plaid), they will be SOL.
As another HNer responded: cred screens are given the appearance of being your financial institution, so I assumed an api auth token being issued after “logging in” with the institution. Still, shame on me for not inspecting more closely.
As a developer living in a country that has fully implemented "Open Banking", here's a quick setting of expectations for Canadian developers so they don't get too excited as I did when this was first being introduced.
Open Banking is not, in fact, open in almost any sense of the world. It is standardised and the standards are freely available ("open"), but other than that, you still need to have an official "blessing" to actually access a production API endpoint (even for your own account), you need a legal entity that has some highly specific and entirely meaningless certificates that are hard (and potentially expensive) to get and even after all of that, you'll still need to negotiate access with each bank individually.
What I imagined when I first heard of "Open Banking" was a public OAuth2 endpoint where I can grant my custom script access to just my bank balance and transaction history (possibly with a change webhook) and have it update my finance tracking database.
The "open" part is only relevant to the banks, since they don't have to pay royalties for the standard implementing the APIs. For the rest of us, it might as well be SS7.
Open Banking is not, in fact, open in almost any sense of the world. It is standardised and the standards are freely available ("open"), but other than that, you still need to have an official "blessing" to actually access a production API endpoint (even for your own account), you need a legal entity that has some highly specific and entirely meaningless certificates that are hard (and potentially expensive) to get and even after all of that, you'll still need to negotiate access with each bank individually.
What I imagined when I first heard of "Open Banking" was a public OAuth2 endpoint where I can grant my custom script access to just my bank balance and transaction history (possibly with a change webhook) and have it update my finance tracking database.
The "open" part is only relevant to the banks, since they don't have to pay royalties for the standard implementing the APIs. For the rest of us, it might as well be SS7.
If you're based in Europe or UK, Nordigen has a completely free API do exactly what you described (I'm one of the cofounders).
We're connected to 1,500 EU/UK banks and you can connect your bank account to your script/app without any license, certificates or any fees. We don't charge for accessing banking data, we only charge for complimentary data enrichment services like transaction categorisation.
https://nordigen.com/
We're connected to 1,500 EU/UK banks and you can connect your bank account to your script/app without any license, certificates or any fees. We don't charge for accessing banking data, we only charge for complimentary data enrichment services like transaction categorisation.
https://nordigen.com/
I'm interested in having an API access to my own banking data.
However, personally, this feels almost as bad privacy-wise as screen scraping my bank account.
Reading your privacy policy only promotes my distrust.
I realize I may not be your target demographic though.
However, personally, this feels almost as bad privacy-wise as screen scraping my bank account.
Reading your privacy policy only promotes my distrust.
I realize I may not be your target demographic though.
We were considering using Nordingen but our main concern is that it seems that Nordingen is essentially able to MITM all calls on PSD2 endpoints, right? How do you establish trust, and how can you keep the service free?
Look pretty good.
Any plans to add Bank of Valletta (Malta)?
Any plans to add Bank of Valletta (Malta)?
In South Korea (began in 2019):
> It is standardised and the standards are freely available
Same.
> you still need to have an official "blessing" to actually access a production API endpoint (even for your own account)
Same.
> you need a legal entity that has some highly specific and entirely meaningless certificates that are hard (and potentially expensive) to get
Same though not entirely meaningless.
> you'll still need to negotiate access with each bank individually.
Not same.
> It is standardised and the standards are freely available
Same.
> you still need to have an official "blessing" to actually access a production API endpoint (even for your own account)
Same.
> you need a legal entity that has some highly specific and entirely meaningless certificates that are hard (and potentially expensive) to get
Same though not entirely meaningless.
> you'll still need to negotiate access with each bank individually.
Not same.
As a Canadian who has been waiting for the hypothetical ideal situation you describe since Mint and YNAB launched in Canada, that is disappointing to hear. Perhaps there will be a startup that can jump through the hoops and then provide some sort of programmability / webhook access to end users.
Where I am in Europe there are quite a few services that act as gateways, but still the sales process is "talk to us" not just sign up and have instance access.
I guess it makes sense in a way, as it would be easy for scammers to use this ("Oh I need to give access to my bank account to view this Facebook post? Oh sure, why not, moar cats plz").
There are also quite a few budgeting apps here that use open banking, so yes I expect those services will migrate to this when it's available in NA. My only complaint is it takes a few days for them to update the data. I have an accounting program (for my business) which uses open banking and also takes a while to update, so maybe it's a "feature" of open banking?
I guess it makes sense in a way, as it would be easy for scammers to use this ("Oh I need to give access to my bank account to view this Facebook post? Oh sure, why not, moar cats plz").
There are also quite a few budgeting apps here that use open banking, so yes I expect those services will migrate to this when it's available in NA. My only complaint is it takes a few days for them to update the data. I have an accounting program (for my business) which uses open banking and also takes a while to update, so maybe it's a "feature" of open banking?
[deleted]
Sounds like the situation in Australia, which NZ sounds like they’re copying.
Yep, I was excited that I might be able to access my banking data using APIs in NZ, then I found this:
https://www.apicentre.paymentsnz.co.nz/join/api-community-co...
So it's "free for 12 months", but the idea is that I build or create an "innovation".
Not interested, I just want APIs for my data, I'm not interested in building a SaaS, I don't want that kind of responsibility for other people's data.
Back to using my personally developed scraper, driven by puppeteer.
Side-benefits, I can and have adapted my scraper to also pull my data from other institutions, like investments and retirement accounts, and dump it into a database as JSON and normalized form.
https://www.apicentre.paymentsnz.co.nz/join/api-community-co...
So it's "free for 12 months", but the idea is that I build or create an "innovation".
Not interested, I just want APIs for my data, I'm not interested in building a SaaS, I don't want that kind of responsibility for other people's data.
Back to using my personally developed scraper, driven by puppeteer.
Side-benefits, I can and have adapted my scraper to also pull my data from other institutions, like investments and retirement accounts, and dump it into a database as JSON and normalized form.
Hit me up, email in profile.
Working on similar stuff, effectively what you have without the requirement to maintain scrapers.
Working on similar stuff, effectively what you have without the requirement to maintain scrapers.
> What I imagined when I first heard of "Open Banking" was a public OAuth2 endpoint where I can grant my custom script access to just my bank balance and transaction history (possibly with a change webhook) and have it update my finance tracking database.
Banks are dealing in financial stuff. They probably do not want to deal with people having problems understanding OAuth2, API's, sandboxes and such. That is an entire different business.
Banks are dealing in financial stuff. They probably do not want to deal with people having problems understanding OAuth2, API's, sandboxes and such. That is an entire different business.
Well, your expectations were clearly wrong.
“Open” in this case means open standards and access for accredited entities.
Because if you grant access to just anyone, then you’ve created an instant fraudster’s paradise.
The legal requirements in the UK (which you may be talking about, unsure) are not meaningless, they are there to ensure that known parties and known good practice are in use. Open Banking the company is working on ways to help small businesses gain accreditation and may already be able to offer assistance, and while accreditation is not free, it’s only a few £k, hardly enough to break the bank.
As a non-accredited actor, if you have a limited company you can register as a technical service provider for free and develop your product against the sandbox environment.
Oh and you don’t have to negotiate access with each bank either. The whole point is to pre-vet and establish trust ahead of time.
That’s as open as anyone with half a brain should want it to be, given what we know about people’s ability to protect their own finances.
“Open” in this case means open standards and access for accredited entities.
Because if you grant access to just anyone, then you’ve created an instant fraudster’s paradise.
The legal requirements in the UK (which you may be talking about, unsure) are not meaningless, they are there to ensure that known parties and known good practice are in use. Open Banking the company is working on ways to help small businesses gain accreditation and may already be able to offer assistance, and while accreditation is not free, it’s only a few £k, hardly enough to break the bank.
As a non-accredited actor, if you have a limited company you can register as a technical service provider for free and develop your product against the sandbox environment.
Oh and you don’t have to negotiate access with each bank either. The whole point is to pre-vet and establish trust ahead of time.
That’s as open as anyone with half a brain should want it to be, given what we know about people’s ability to protect their own finances.
> if you grant access to just anyone, then you’ve created an instant fraudster’s paradise.
I believe that everyone might get access to their own data and to performing actions on their own account.
Could you clarify how is that supposed to create a fraudsters' paradise?
I believe that everyone might get access to their own data and to performing actions on their own account.
Could you clarify how is that supposed to create a fraudsters' paradise?
Yep, the moment you allow that sort of access people will let the arseholes in one way or another, because people in general don't have a clue about what permissions should be given to people who call up claiming to be, for instance, from the tax office.
Even read only, fraudsters will find ways to exfiltrate private data that's useful for identity theft, blackmail or any number of criminal acts.
People are not security-savvy enough to be given this access safely. You might be, my parents and millions like them aren't.
Even read only, fraudsters will find ways to exfiltrate private data that's useful for identity theft, blackmail or any number of criminal acts.
People are not security-savvy enough to be given this access safely. You might be, my parents and millions like them aren't.
Getting access to a regular web app would be sufficient to perform that kind of abuse. It just would be more difficult to automate.
It seems to me that the difficulty of getting the victim to grant access to the attacker remains the same for both the web app access and the API access.
The advantage for the attacker of getting the API access is that they can more easily automate the performing of subtle frauds over a longer period of time, thereby avoiding the detection. But a determined attacker can automate that via the web app as well.
That is why it seems to me that the difference in fraud capabilities over both channels is, in principle, negligible.
It seems to me that the difficulty of getting the victim to grant access to the attacker remains the same for both the web app access and the API access.
The advantage for the attacker of getting the API access is that they can more easily automate the performing of subtle frauds over a longer period of time, thereby avoiding the detection. But a determined attacker can automate that via the web app as well.
That is why it seems to me that the difference in fraud capabilities over both channels is, in principle, negligible.
Yes, making attacks more difficult is often the point of security. Further, with an accredited intermediary, they have more responsibility to ensure their stuff isn’t compromised, and to stick to good practice. With free for all API access the world is wide open to fraud.
[deleted]
This may be driven by TD's suit against Plaid
From this source https://www.lexology.com/library/detail.aspx?g=8f56092c-ab40...
"Users have complained that after connecting their bank accounts, Plaid stores their credentials and uses them to collect 5 years’ of transactional data and continues to track users’ data in future. Users further claim that the data-gathering scheme is not incidental to Plaid’s business model and is, in fact, its “very purpose.”
From this source https://www.lexology.com/library/detail.aspx?g=8f56092c-ab40...
"Users have complained that after connecting their bank accounts, Plaid stores their credentials and uses them to collect 5 years’ of transactional data and continues to track users’ data in future. Users further claim that the data-gathering scheme is not incidental to Plaid’s business model and is, in fact, its “very purpose.”
Wow, I just assumed Plaid was part of some kind of interbank consortium. I can’t believe a service that big can be based on that model. It’s interesting how HF trading can be so cutting edge while consumer banking is 15-20 years behind.
This came out of a discovery and recommendation process that has been ongoing since 2018 - https://www.canada.ca/en/department-finance/news/2018/09/min...
Holy smokes, that is shady and scary.
It's not shady, its the explicit purpose of these apps, they collect your transaction data and show you more detailed analysis of it. Since there is no API to safely get the data in a read only way, the only option is to screen scrape the banks website.
It is absolutely shady and scary that they store your banking credentials so that they can log in with them. The fact that there isn't a better option doesn't make it any less shady and scary.
They explicitly explain this to the user and apparently even encourage that you instead manually export files and upload them but also provide direct login as a feature.
Yes its not perfect security which you may find scary but I struggle to find what about it is shady when they are very open about what happens.
Yes its not perfect security which you may find scary but I struggle to find what about it is shady when they are very open about what happens.
Probably not? The suit was dismissed. Sorry for the paywall but I can't find a better source: https://news.bloomberglaw.com/banking-law/td-bank-plaid-sett...
[full disclosure: I work at Plaid]
[full disclosure: I work at Plaid]
It’s interesting to me how quickly I’ve soured on the concept of open banking, which on paper sounds fantastic and originally I was very much in favour of. And which I’ve used personally to make it easier to extract my own data for my own use.
However more often than not now I’m seeing it used for really invasive applications. Such as when I rented my most recent apartment and they asked to use open banking to verify our finances, which as far as I know would have given them access to every single transaction going back a decade or so. The agent was confused as to why I wouldn’t go ahead with it and ultimately let us opt out, but I do worry that at some point I won’t have much choice but to accept.
I’ve also seen credit scoring companies that suggest you’ll get a better credit score if you use open banking to hand over your transactions. I have no need to use that but I suspect others who are desperate to increase their chances of getting a mortgage, etc, won’t have much of a choice.
However more often than not now I’m seeing it used for really invasive applications. Such as when I rented my most recent apartment and they asked to use open banking to verify our finances, which as far as I know would have given them access to every single transaction going back a decade or so. The agent was confused as to why I wouldn’t go ahead with it and ultimately let us opt out, but I do worry that at some point I won’t have much choice but to accept.
I’ve also seen credit scoring companies that suggest you’ll get a better credit score if you use open banking to hand over your transactions. I have no need to use that but I suspect others who are desperate to increase their chances of getting a mortgage, etc, won’t have much of a choice.
I feel the same. The convenience will likely outweigh the security concerns in the not too distant future.
What I would like is some middle step - that instead of allowing open access to accounts, I get to choose how the data is summarised and presented. e.g. just show total income and outgoings, fortnightly, over the last 6 months. Things like that.
Yes, I could export the transactions, do some Excel hand waving and make a report, then make a PDF and send it, then they would do data entry into their system summarising what they read. But automating that data sharing step would be fantastic.
I am in the process of applying for a home loan at the moment, and the amount of documentation is significant. If I were able to automate 80% of it in a fairly anonymised data way, that would be really useful.
What I would like is some middle step - that instead of allowing open access to accounts, I get to choose how the data is summarised and presented. e.g. just show total income and outgoings, fortnightly, over the last 6 months. Things like that.
Yes, I could export the transactions, do some Excel hand waving and make a report, then make a PDF and send it, then they would do data entry into their system summarising what they read. But automating that data sharing step would be fantastic.
I am in the process of applying for a home loan at the moment, and the amount of documentation is significant. If I were able to automate 80% of it in a fairly anonymised data way, that would be really useful.
> Such as when I rented my most recent apartment and they asked to use open banking to verify our finances
There was a Launch HN recently that did just this, but for people like Uber drivers wanting to borrow money to buy their own car. They handed over their Uber credentials, and the service scraped their Uber history to determine whether they were a good risk or not.
I'm not usually into slippery slope arguments but what your landlord asked of you is just that little bit worse than their service (worse as they have access to your bank account, not just your payroll data).
I think the moral of the story is that as a provider (Uber, a bank), you should be proactive about providing read-only access to data, removing the need for screen scraping and providing better security to your drivers/customers.
There was a Launch HN recently that did just this, but for people like Uber drivers wanting to borrow money to buy their own car. They handed over their Uber credentials, and the service scraped their Uber history to determine whether they were a good risk or not.
I'm not usually into slippery slope arguments but what your landlord asked of you is just that little bit worse than their service (worse as they have access to your bank account, not just your payroll data).
I think the moral of the story is that as a provider (Uber, a bank), you should be proactive about providing read-only access to data, removing the need for screen scraping and providing better security to your drivers/customers.
This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.
2FA is so seriously lacking here it's not funny.
TD Bank has 2FA which has been SMS-based for a very long time, and they just introduced a 2FA app. FYI.
But yes on Tangerine (and other banks) being so, so behind. Sending a wire online here is pretty much impossible..!
TD Bank has 2FA which has been SMS-based for a very long time, and they just introduced a 2FA app. FYI.
But yes on Tangerine (and other banks) being so, so behind. Sending a wire online here is pretty much impossible..!
As a TD customer, this is mildly infuriating. Is there any legitimate security rationale for forcing me to install their authenticator app instead of simply allowing me to use any industry-standard TOTP app (Authy, Google Authenticator, etc).
Not to mention the fact that they still don't allow hardware tokens / U2F eg. Yubikey.
Not to mention the fact that they still don't allow hardware tokens / U2F eg. Yubikey.
I'd like to know as well. There could very well be some auditing requirement that forces them to explicitly generate the tokens sent to users, and the people enforcing the requirement have sticks up their asses. It wouldn't be the first time that the auditors foul up something because despite working as well or better than what they want, it's not what they know.
> Obviously no 2FA.
Don't worry, you really aren't missing out on much security because the 2FA most banks implement just involves sending you an SMS.
Don't worry, you really aren't missing out on much security because the 2FA most banks implement just involves sending you an SMS.
But sending you an SMS is a lot more security than no 2FA at all, right?
I am aware of attacks that state/very sophisticated actors can use to intercept SMS messages but that's a serious edge case for a normal person, right?
I am aware of attacks that state/very sophisticated actors can use to intercept SMS messages but that's a serious edge case for a normal person, right?
It's not secure at all, as some services (PayPal!) Allow password reset via SMS to your regitered mobile number. So if someone even has control of your mobile number via sim swap for 5 minutes they gain full control of your paypal acct. Heard of enough incidents of this earlier this year through one of the Canadian prepaid mobile flanker brands...
Paypal makes it hard to remove a mobile number from your account once it's on there too...
If a bank "MUST" have a phone number, I lean towards providing my good ol landline number since in theory thats a "little" harder to instantly take over or port out.
Worthwhile to "test" what it takes to reset a password on your various critical services...
Paypal makes it hard to remove a mobile number from your account once it's on there too...
If a bank "MUST" have a phone number, I lean towards providing my good ol landline number since in theory thats a "little" harder to instantly take over or port out.
Worthwhile to "test" what it takes to reset a password on your various critical services...
To reiterate what you said, enabling SMS can make your security much worse on some services. It's counterintuitive. Someone taking control of your phone number can make your excellent password irrelevant.
If you must provide a phone number, another tip is to call customer service on your cellular service provider and ask them to put a "port out block" or "port protect" on your account. Before anyone can do a sim swap on your account, they'd have to call the cellular service provider and give a password or PIN. (It's amazing that this isn't the default.)
If you must provide a phone number, another tip is to call customer service on your cellular service provider and ask them to put a "port out block" or "port protect" on your account. Before anyone can do a sim swap on your account, they'd have to call the cellular service provider and give a password or PIN. (It's amazing that this isn't the default.)
> Heard of enough incidents of this earlier this year through one of the Canadian prepaid mobile flanker brands..
Please explain, sorry I did not hear about this.
Please explain, sorry I did not hear about this.
Depends on where you are - a SIM swap attack is surprisingly easy to do in many places.
But more generally, a sophisticated actor doesn't have to be targeting you specifically. Many people assume that "nobody would put in so much effort to steal from me", but they don't have to be. A sophisticated attacker with the capability to intercept SMS would likely be casting a very wide net. Once people start noticing, they'll be locked out very soon, so they'll be aiming to "hack" as many people as possible.
You might just happen to be one of the N random people that happened to log into their bank on the day of the hack and the spreadsheet happened to be sorted by last login time. Hackers don't discriminate, so as long as you fit "SELECT from account WHERE balance > 0", you'll be on the target list.
But more generally, a sophisticated actor doesn't have to be targeting you specifically. Many people assume that "nobody would put in so much effort to steal from me", but they don't have to be. A sophisticated attacker with the capability to intercept SMS would likely be casting a very wide net. Once people start noticing, they'll be locked out very soon, so they'll be aiming to "hack" as many people as possible.
You might just happen to be one of the N random people that happened to log into their bank on the day of the hack and the spreadsheet happened to be sorted by last login time. Hackers don't discriminate, so as long as you fit "SELECT from account WHERE balance > 0", you'll be on the target list.
This argument seems strange to me.. how many attacks are by someone literally armed with a customer list from a financial institution? The "casting a wide net" seems directly opposed to the effort involved in a SMS intercept attack which requires significant resources. I don't see a practical circumstance where this is a reasonable risk I guess. I just don't know. I would love an article-length explainer out there somewhere I guess, I just haven't seen one.
A targetted SMS interception attack looks like something something SS7 or SIM swap/social engineering, but a wide net attack looks like pwn the telco and get ssh access to an SMS gateway (or logs, or a database with content), or an aggregator, or a middleman SMS provider between aggregator(s) and carriers, or posing as a legit (or grey route) middleman and getting in routing and then snooping on stuff. Or just a highly priviledge position at a carrier or sms aggregator.
If your wide net lets you see 2FA codes, sometimes you can do stuff.
If your wide net lets you see 2FA codes, sometimes you can do stuff.
I guess that's the thing I don't get.. you need to pwn a bank and then pwn a telco.. it feels like if it were a probable scenario all these issues with SS7 would be long fixed, so it must be an improbable scenario?
My recollection is that we had that once incident in Germany with 02, but never really heard how much was lost and it was the result of a bad policy at 02 that they fixed and was particular to 02.
My recollection is that we had that once incident in Germany with 02, but never really heard how much was lost and it was the result of a bad policy at 02 that they fixed and was particular to 02.
If you pwn the telco, and the bank has poor password recovery policiss, you might be able to just recover the password. Or maybe password reuse, etc.
I assume if you pwn a bank, you don't really need 2fa codes, but I dunno
I assume if you pwn a bank, you don't really need 2fa codes, but I dunno
It's better than nothing, I just wish it wasn't conflated with effective 2FA.
It isn't just state-level or sophisticated actors, it's anyone who is dumb enough to commit fraud with computers or via unauthorized access to telecom networks, which includes a lot of fraud rings.
According to The Verge[1], such services are even advertised on illicit marketplaces, so anyone with some Bitcoin and the Tor Browser can potentially be your adversary in such an attack.
[1] https://www.theverge.com/2017/6/13/15794292/ss7-hack-dark-we...
It isn't just state-level or sophisticated actors, it's anyone who is dumb enough to commit fraud with computers or via unauthorized access to telecom networks, which includes a lot of fraud rings.
According to The Verge[1], such services are even advertised on illicit marketplaces, so anyone with some Bitcoin and the Tor Browser can potentially be your adversary in such an attack.
[1] https://www.theverge.com/2017/6/13/15794292/ss7-hack-dark-we...
No, it’s a fairly simple social engineering attack and the telco customer service will do it for you at the cost of a SIM card.
The Canadian Revenue Agency started forcing SMS 2FA on online accounts recently
PayPal in Europe is doing SMS now too. They claim it's for "PSD2" compliance or something. But I already had TOTP 2FA ("Google Authenticator") enabled and I'd prefer to use that instead as it's much safer than SMS. That was never intended to carry secure information. Also, TOTP works even when I have my phone in airplane mode.
Strange thing is it seems to randomly ask for SMS or TOTP now, whichever it feels like at the time.
Still it's weird that an official standard mandates SMS 2FA when more secure methods are available.
Strange thing is it seems to randomly ask for SMS or TOTP now, whichever it feels like at the time.
Still it's weird that an official standard mandates SMS 2FA when more secure methods are available.
It's not weird at all in the context of metadata (phone #).
With Tangerine I have set up the secret question thing where my answers are secure passwords generated with my password manager. Their login asks for the secure question answer before the 4-6 digit useless pin entry, so it has that going for it at least. I refuse to set up SMS based 2FA.
> Tangerine
At least they used to have decent interest rates... now what's the point? they don't even have physical banks.
At least they used to have decent interest rates... now what's the point? they don't even have physical banks.
Low/no fees mostly. A standard bank account at the big banks gives you few Interac transactions, for example, unless you either pay $12.99 a month or have >$3,000 in your account at all times. Tangerine provides unlimited Interac payments on a chequing account with no monthly fee.
[deleted]
I don't know why OAuth tokens aren't the default solution to this. BoA recently added this as an option and it's way more straight forward than giving my login credentials to Personal Capital or, god forbid, Intuit.
edit: Of course it helps if the 3rd parties implement it as well. I revoked access to Intuit but Personal Capital only lets me use my userID and password.
edit: Of course it helps if the 3rd parties implement it as well. I revoked access to Intuit but Personal Capital only lets me use my userID and password.
Some speculation:
- Banks like locking down your financial data since it makes it more likely you'll continue to uses the auxiliary services they provide. Every bank I've used always has a built in send-money-to-friends and budgeting tool. By locking in your data, they help promote these service.
- But mainly, I suspect banks never lose customers because of a lack of an open banking data API. Consumers don't demand it. With no financial incentive, why would they make your data accessible? Also combine that with the increased risk exposure from providing API and it's easy to see why they don't exist.
Funnily, I suspect banks tacitly prefer screen scraping solutions like Plaid since it doesn't require the bank create any new product surface area that needs to be audited and secured. No new API endpoints to create. And in the event of a credential breach, it's easy to point the finger at the user who clearly just gave their password over to Plaid.
- Banks like locking down your financial data since it makes it more likely you'll continue to uses the auxiliary services they provide. Every bank I've used always has a built in send-money-to-friends and budgeting tool. By locking in your data, they help promote these service.
- But mainly, I suspect banks never lose customers because of a lack of an open banking data API. Consumers don't demand it. With no financial incentive, why would they make your data accessible? Also combine that with the increased risk exposure from providing API and it's easy to see why they don't exist.
Funnily, I suspect banks tacitly prefer screen scraping solutions like Plaid since it doesn't require the bank create any new product surface area that needs to be audited and secured. No new API endpoints to create. And in the event of a credential breach, it's easy to point the finger at the user who clearly just gave their password over to Plaid.
One reason is that (fintech) implementors get freaked out by OAuth's ~15min window where your token can be revoked but you still have access to the RP.
It's an issue but a minor one. The alternative, ad hoc per-request session management, is so much worse in almost every way.
It's an issue but a minor one. The alternative, ad hoc per-request session management, is so much worse in almost every way.
It's been awhile since I've seen it done that way. I think you're referring to the situation where the API servers authenticate you just by checking signature of a timestamped access token and when the token expires the client fetches a new one.
For all the OAuth API services I've worked on we'd just look up the access token in the database on each request, so a revoked token becomes useless immediately.
For all the OAuth API services I've worked on we'd just look up the access token in the database on each request, so a revoked token becomes useless immediately.
There’s nothing in OAuth that would make that a limitation. Many people decide to issue JWTs without any sort of blacklisting of revoked tokens, but that’s not really a problem with the OAuth spec.
>blacklisting of revoked tokens
Ah, so a blacklist eh? ...Checked by an ad hoc per-request session mechanism perhaps?
Ah, so a blacklist eh? ...Checked by an ad hoc per-request session mechanism perhaps?
I have some issues with the wording in this article (I work at Plaid and I don't think everything it says about us is accurate) but the report is a good thing. Right now we really are dependent on screen scraping at many banks and we'd much rather use API-based connections to power our services, but so many banks just don't provide APIs. I'm optimistic for an open banking future in Canada and who knows, maybe even the US some day...
not only screen scraping. Plaid also gets around 2FA by asking to forward the bank sms code to them. It happened when i tried using Expensify recently.
That is unacceptable and goes against everything I know.
That is unacceptable and goes against everything I know.
By "forward" you mean that we ask people to submit a 2FA code during login? YMMV, but I would characterize that as "supporting users who have 2FA enabled" rather than "getting around 2FA". Like I said, I'm looking forward to a world where we don't have to ask for credentials at all, but in the current world, we either support 2FA or we don't, and if we didn't, many people would probably turn off 2FA altogether. At a number of institutions, we actually add a layer of 2FA protection and require a SMS-based code if the institution doesn't prompt the user with its own 2FA.
The EU has been moving in this direction with PSD2 and it’s been pretty good. Downside is there’s no defacto standard for APIs and each bank's development skills vary widely.
PSD2 is really bad. It doesn't actually allow you, the customer, to sign in to your banking account using your own application and an API.
It only mandates that regulated thirdparty companies can access your banking account using some API.
Here in Germany PSD2 was a big step back. Previously we had FinTS (https://en.wikipedia.org/wiki/FinTS), an open banking protocol used since the last 90s, and many programs supporting it. Then PSD2 came and broke some use cases of FinTS. Many banks didn't want to both fix FinTS and support new PSD2 APIs, so they just switched off FinTS. Now German bank customers are basically forced to use the banking website because PSD2 doesn't allow them to use an API and the API they had was taken from them by PSD2.
It only mandates that regulated thirdparty companies can access your banking account using some API.
Here in Germany PSD2 was a big step back. Previously we had FinTS (https://en.wikipedia.org/wiki/FinTS), an open banking protocol used since the last 90s, and many programs supporting it. Then PSD2 came and broke some use cases of FinTS. Many banks didn't want to both fix FinTS and support new PSD2 APIs, so they just switched off FinTS. Now German bank customers are basically forced to use the banking website because PSD2 doesn't allow them to use an API and the API they had was taken from them by PSD2.
From what I remember FinTS was a very escoteric protocol and super low level. What PSD2 promises is modern APIs that devs from this millennia are used to to build off of.
It's true that the 6,000 banks in Europe have different standards, but the fact that the APIs exist and work and that the regulator is enforcing the use of real APIs (as opposed to screen scraping) is worth the effort to integrate each of the banks.
I work at Nordigen and we integrated with 1,500+ banks in less than 8 months. Some APIs took hours to integrate, some took a few weeks, but the fact that it was possible at all is IMO gamechanging.
I work at Nordigen and we integrated with 1,500+ banks in less than 8 months. Some APIs took hours to integrate, some took a few weeks, but the fact that it was possible at all is IMO gamechanging.
Yeah. I used to work for a Hamburg based fintech that was one of the first to get its PSD2 license.
We still had to fall back to scraping at some points. Perhaps that’s different now.
We still had to fall back to scraping at some points. Perhaps that’s different now.
The great think about PSD2 is that it comes with a bunch of laws and regulators are generally good at making banks compliant. An API that's not working is a non-compliant API and banks get it. PSD2 came in to force in Sept, 2019 and 2 years later all the major retail banks in all EEA countries work have fully operational APIs.
One major limitation is that PSD2 only regulates access to payment accounts, but doesn't mandate access to credit cards, investment accounts, savings accounts etc. This is why screen scraping (to everyone's dismay) is still used - to "expand" what's possible with real bank APIs.
One major limitation is that PSD2 only regulates access to payment accounts, but doesn't mandate access to credit cards, investment accounts, savings accounts etc. This is why screen scraping (to everyone's dismay) is still used - to "expand" what's possible with real bank APIs.
Given the tech savvy HN user base I'm surprised at all the "I'm surprised these 3rd party services are just impersonating me".
I'd love it if there were API's to access my banking data directly, but failing that I rely on the meager "txn download via csv" my Canadian banks offer (at least).
I'd love it if there were API's to access my banking data directly, but failing that I rely on the meager "txn download via csv" my Canadian banks offer (at least).
Brazil started Open Banking at 2019
https://www.bcb.gov.br/en/financialstability/open_banking
https://www.bcb.gov.br/en/financialstability/open_banking
The planning is there. The second phase started on august 18th and encompasses sharing your info with different parties (consensually). Next phase is actually hiring services and more interesting stuff.
What's open banking? What's the context?
Third-party apps (e.g. budgeting apps) take users' credentials to login and scrape the screen. Open banking is about banks providing APIs instead.
Requiring all banks provide an api to get your data out. The alternative is that 3rd party services ask for your actual bank login details and they log in as you to parse the banks html to get your details out.
[deleted]
Australia is building Open Banking (and generically Consumer Data Standards) APIs on GitHub.
https://github.com/ConsumerDataStandardsAustralia/standards
This is a problem discussed here as well. Generally big banks are advocating getting rid of screen scraping and moving to API but most fintechs are smaller and they don't want to change and there is little appetite from Govt. to force them.
This is a problem discussed here as well. Generally big banks are advocating getting rid of screen scraping and moving to API but most fintechs are smaller and they don't want to change and there is little appetite from Govt. to force them.
The Spectre Salt Edge API does the same. I thought I could use this in Firefly III to automcatically pull my banking data, until I found out they are screen scraping. This is a no go. Unfortunately, the official FinTS APIs available by most banks are incredibly flawed, too. Firstly, a lot of information is not available. Secondly, there is no way to have a "read-only" API key/connection. Why is that? I have no idea. There is an Open Banking project in Europe, but it it is far from being ready.
The UK mandated this, possibly the EU also, but it works very well.
https://www.openbanking.org.uk/what-is-open-banking/
https://www.openbanking.org.uk/what-is-open-banking/
So glad to see this happening. Screen scraping is unsecure and imo a per account APIkey based solution with a read-only access is the way ahead.
As a developer in Canadian Banking, I wonder how this will affect us.
I work for a major bank relevant to this story, and I've honestly not heard anything about it internally.
I work for a major bank relevant to this story, and I've honestly not heard anything about it internally.
I built a shopping app with a headless browser 10 years ago. Fun project until any part of a vendor site changed :\
2023? Australia's might be finished by then
To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about?
I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to upstarts, because right now the only way to be an upstart is to literally ask your customers to violate their bank's terms of service.
I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to upstarts, because right now the only way to be an upstart is to literally ask your customers to violate their bank's terms of service.
This.
As others mentioned, the whole point of an effort towards OpenBanking is that services like Plaid literally store your username/password in their system and impersonate you to do whatever they do. Any software dev worth their salt would instinctively know this is a big security no-no, so to have this happen with your banking credentials of all things and on such a large scale seems insane to me.
An effort to implement OpenBanking is akin to working towards Android-style granular permissions instead of just granting root access to any third party who wants to do something on your behalf.
As others mentioned, the whole point of an effort towards OpenBanking is that services like Plaid literally store your username/password in their system and impersonate you to do whatever they do. Any software dev worth their salt would instinctively know this is a big security no-no, so to have this happen with your banking credentials of all things and on such a large scale seems insane to me.
An effort to implement OpenBanking is akin to working towards Android-style granular permissions instead of just granting root access to any third party who wants to do something on your behalf.
It's actually kind of crazy how a company was able to build a business out of this and get acquired while doing it, too. If someone would've pitched me the idea, I would've been like "it's doable, but it'll never be a viable business."
Goes to show what I know.
Goes to show what I know.
I'm not personally surprised that you could find users to buy into this kind of product - I'm amazed that none of the US regulators came down on them hard and killed them dead five+ years ago.
They are probably not doing anything illegal, sure you break the banks terms of service but you the user willingly gives the login credentials to the third party.
It is not just the problem is password stored in 3rd party system. Occasionally an engineer has to look at the raw intercepted html data if the bank changes their login or data pages.
Intuit (via Quicken) and Microsoft Money were in a position to influence this - they required banks to give access to quicken servers.
Intuit (via Quicken) and Microsoft Money were in a position to influence this - they required banks to give access to quicken servers.
Worse than that plaid places the liability on you so that when their systems get hacked and you lose money it's your fault at your expense for giving them access.
And even that effort demonstrates the incompetency of most financial institutions - anyone with a security team worth their salt would have mandatory two-factor authentication, which would make the approach unworkable.
I guess you're talking to me. I'm not arguing for screen scraping. I'm stating my experience as a Canadian that our oligopolies use legislation like this as a way to discourage competition, under the guise of helping users. And they rely on people like you to talk about how great it is that we're all getting a made in Canada open banking solution when what we'll really get is something that makes new entry impossible and locks users in to the big 5 banks. Look at our vibrant telecommunications sector for a similar example.
Edit: I see this is a losing battle, the comments responding to the parent seem to imply that he is championing open banking against a group that disagree with it. And the replies to me think that I don't want open banking. Enjoy your discussion
Edit: I see this is a losing battle, the comments responding to the parent seem to imply that he is championing open banking against a group that disagree with it. And the replies to me think that I don't want open banking. Enjoy your discussion
As another canadian, here's something that occurred to me recently: we like to sling around the oligopoly argument when talking about telecoms, but when I bothered to look a bit into it, rather than finding some tightly knit mafia-like boys club, what I found is that the landscape is quite fragmented and messy (e.g. look at the scope of Telus' operations in Ontario vs Quebec, or look at how Sasktel operates, or look at companies like Fibrestream)
The big telecom lobbying argument vs CRTC about how urban markets need to subsidize rural infrastructure costs is not something 95% of canadians like to hear, but it kinda makes sense (They say rural infra simply isn't cost effective because Canada is so expansive, but you expect high speed Internet access in your Muskoka cottage, right?)
Banking is kind of in a similar boat in the sense that it's an industry with economies of scale effect, so naturally there are going to be big players. Even smaller players like Tangerine need to make "big boy" investments like call centers. ICBC is another example of a bank that isn't the big 5 and yet has brick and mortar branches to serve a highly specific niche.
OpenBanking doesn't mean that TD et al somehow get to tighten the noose on smaller banks to their own advantage; it's actually on them to implement the APIs. If Tangerine can't keep up with other banks improving their technology, that's their own fault. What the whole thing means is that Plaid doesn't get to have root access to your banking.
The big telecom lobbying argument vs CRTC about how urban markets need to subsidize rural infrastructure costs is not something 95% of canadians like to hear, but it kinda makes sense (They say rural infra simply isn't cost effective because Canada is so expansive, but you expect high speed Internet access in your Muskoka cottage, right?)
Banking is kind of in a similar boat in the sense that it's an industry with economies of scale effect, so naturally there are going to be big players. Even smaller players like Tangerine need to make "big boy" investments like call centers. ICBC is another example of a bank that isn't the big 5 and yet has brick and mortar branches to serve a highly specific niche.
OpenBanking doesn't mean that TD et al somehow get to tighten the noose on smaller banks to their own advantage; it's actually on them to implement the APIs. If Tangerine can't keep up with other banks improving their technology, that's their own fault. What the whole thing means is that Plaid doesn't get to have root access to your banking.
> The big telecom lobbying argument vs CRTC about how urban markets need to subsidize rural infrastructure costs is not something 95% of canadians like to hear, but it kinda makes sense
For some groups (especially reservations where their location to practice independent governance is government mandated) I can absolutely sympathize - but for most of the rest of rural Canada - uh why? Urban centers like Toronto and Vancouver are already paying property taxes far exceeding rural areas - with the residents paying those taxes also being hit by bigger income tax proportions due to the higher wages in the cities.
There is no allowance for rural Canadians to get subsidized access to live operas and plays - choosing to live in a rural area comes with a general acceptance that those sorts of live performances are always going to be inconvenient and expensive since you'll need to travel to the city to get them. Why are we treating internet significantly different? If you choose to live in the middle of nowhere you can pay the actual cost for a company to maintain a line to your cabin in the woods while enjoying the scenery you're immersed in.
On Monday I've got a hookup guy coming to my place to switch our condo over from Telus to Novus - this will drop our price from 100G/$80 to 300G/$50 along with removing data limits and throttling and probably actually getting closer to the advertised rate (we often get about 15-20 down from Telus right now - I've heard much better things about Novus).
Part of the reason Novus can do this is indeed the fact that it doesn't offer service outside of very dense urban areas - and I'm personally quite okay with that.
For some groups (especially reservations where their location to practice independent governance is government mandated) I can absolutely sympathize - but for most of the rest of rural Canada - uh why? Urban centers like Toronto and Vancouver are already paying property taxes far exceeding rural areas - with the residents paying those taxes also being hit by bigger income tax proportions due to the higher wages in the cities.
There is no allowance for rural Canadians to get subsidized access to live operas and plays - choosing to live in a rural area comes with a general acceptance that those sorts of live performances are always going to be inconvenient and expensive since you'll need to travel to the city to get them. Why are we treating internet significantly different? If you choose to live in the middle of nowhere you can pay the actual cost for a company to maintain a line to your cabin in the woods while enjoying the scenery you're immersed in.
On Monday I've got a hookup guy coming to my place to switch our condo over from Telus to Novus - this will drop our price from 100G/$80 to 300G/$50 along with removing data limits and throttling and probably actually getting closer to the advertised rate (we often get about 15-20 down from Telus right now - I've heard much better things about Novus).
Part of the reason Novus can do this is indeed the fact that it doesn't offer service outside of very dense urban areas - and I'm personally quite okay with that.
I think Novus, Fibrestream and friends are good examples that support the idea that the market is healthy and oligopolies don't have the ability to use their position to choke out smaller players.
I'd wager that Canada is still largely a wild west when it comes to physical copper coverage. Meaning big players do project long term profit from rural markets and actively invest in them, but that the projections aren't sustainable below some price threshold, hence butting heads with CRTC to make the math work out.
As for the notion that country bumpkins ought to be satisfied with inconvenience, I'm not sure how to respond other than more and more they expect modern things to be available to them. A customer is never in their right mind going to shoulder a 100k upfront cost to lay fiber to a town, so if someone wants to make the cost benefit analysis, it's most likely going to be one of the big players, IMHO
I'd wager that Canada is still largely a wild west when it comes to physical copper coverage. Meaning big players do project long term profit from rural markets and actively invest in them, but that the projections aren't sustainable below some price threshold, hence butting heads with CRTC to make the math work out.
As for the notion that country bumpkins ought to be satisfied with inconvenience, I'm not sure how to respond other than more and more they expect modern things to be available to them. A customer is never in their right mind going to shoulder a 100k upfront cost to lay fiber to a town, so if someone wants to make the cost benefit analysis, it's most likely going to be one of the big players, IMHO
Because if we didn't since the 90s, the socioeconomics of Canada would have gotten insanely out of whack? Think of it in terms of access to education and information. As someone from the sticks, I can even grok how it would have played out, it would have been a nightmare. The kids from the pulp and paper towns (that I will remind you, very much helped build the Canada you live in today, the woods are nice sure, but the towns are there because of economics Canada is built on, not just because people want nice scenery) would have been drastically disadvantaged comparatively. I understand this is somewhat less true today, but I still think serving the rural infrastructure is disproportionately expensive, and I don't think we should start asking Canadians to move.
Are you really comparing live operas and plays to Internet access? One is a luxury. The other is a necessary utility (that also facilitates other luxuries, but that's beside the point, because there's a lot of things you need the utility for).
> If you choose to live in the middle of nowhere you can pay the actual cost for a company to maintain a line to your cabin in the woods while enjoying the scenery you're immersed in.
When competitors are stopped at the border for dubious pretexts it means that the local monopolies can effectively decide not to wire your property.
Wouldn't it be nice to see an ultra-competitive European carrier laying fiber out there?
When competitors are stopped at the border for dubious pretexts it means that the local monopolies can effectively decide not to wire your property.
Wouldn't it be nice to see an ultra-competitive European carrier laying fiber out there?
> The big telecom lobbying argument vs CRTC about how urban markets need to subsidize rural infrastructure costs is not something 95% of canadians like to hear, but it kinda makes sense (They say rural infra simply isn't cost effective because Canada is so expansive, but you expect high speed Internet access in your Muskoka cottage, right?)
That still doesn't explain why internet service is way more expensive in Canada than pretty much everywhere else in the world.
That still doesn't explain why internet service is way more expensive in Canada than pretty much everywhere else in the world.
I don't mean this to be crass, I presume you've never driven across Canada then? I suspect if you had, you'd very soon realize why it's so expensive. 11 people per square mile, the same as Botswana, except at least in Botswana you can just drive in a straight line for hours, and you don't have snow salt and freezing temperatures to contend with. If a team from Rogers in Toronto had to go to Kenora Ontario to service equipment, they'd have to fly to Thunder Bay, and then drive 12 hours, and then get a hotel, ship gear, etc etc, never mind the winters, and the fact that the skill labour in the telco industry only became marginally more abundant in the last 10/15 years.
Kenora is a two hours drive from Winnipeg, it's not nearly as inaccessible as you're making it out to be.
However, with that said, I saw numbers saying that laying one mile of fiber costs to the tune of $30k, so just connecting Winnipeg to Kenora would cost some $4M. Kenora itself has an area of 80 sq mi and a population of 15k people (though mostly concentrated near Lake of Woods). It's not nothing, but also not exactly a gold mine for telecoms, to be sure.
Timmins might be a better example. It's more than 400 miles north of Toronto, and has some 40k people. Sudbury is half way there and has some 160k people, but still some 250 miles away from Toronto. To give a sense of scale, the distance from Timmins to Toronto is bigger than the distance from Amsterdam (Netherlands) to Berlin (Germany). 200k potential customers is a pretty decent size market (that's a quarter of San Francisco's population, for example), but covering 400 miles w/ fiber at $30k/mile just to reach it comes out to a cool $12M upfront investment. Don't forget this is just to connect two points, there's still last mile coverage and ongoing maintenance which is going to add quite a bit of cost on top. If a single competitor is there, that can cut into the profits pretty deeply.
That's the sort of math that telecoms need to deal with when doing ROI analyses on these markets.
However, with that said, I saw numbers saying that laying one mile of fiber costs to the tune of $30k, so just connecting Winnipeg to Kenora would cost some $4M. Kenora itself has an area of 80 sq mi and a population of 15k people (though mostly concentrated near Lake of Woods). It's not nothing, but also not exactly a gold mine for telecoms, to be sure.
Timmins might be a better example. It's more than 400 miles north of Toronto, and has some 40k people. Sudbury is half way there and has some 160k people, but still some 250 miles away from Toronto. To give a sense of scale, the distance from Timmins to Toronto is bigger than the distance from Amsterdam (Netherlands) to Berlin (Germany). 200k potential customers is a pretty decent size market (that's a quarter of San Francisco's population, for example), but covering 400 miles w/ fiber at $30k/mile just to reach it comes out to a cool $12M upfront investment. Don't forget this is just to connect two points, there's still last mile coverage and ongoing maintenance which is going to add quite a bit of cost on top. If a single competitor is there, that can cut into the profits pretty deeply.
That's the sort of math that telecoms need to deal with when doing ROI analyses on these markets.
Except what matters is the density distribution. 85% of Canadians live within 100 miles of the US border, for instance.
https://www.vox.com/2016/5/5/11584064/canada-population-map
https://www.vox.com/2016/5/5/11584064/canada-population-map
Take the population distribution map and throw it on top of the telecommunications coverage map and put it on a 20 year timeline, I suspect you'll have the answer to your question, as I explained, Kenora is not near Toronto, it's many many many many many many many hours of driving away, places that are literally physically difficult to get to.
I feel like the rural coverage issue is misleading and overused. Look at their coverage maps:
https://www.rogers.com/mobility/network-coverage-map?icid=R_...
Most of my province (BC) is not covered. They cover the urban areas and some wider areas along highways in plateau regions. Where is this burdensome coverage that is keeping them expensive?
https://www.rogers.com/mobility/network-coverage-map?icid=R_...
Most of my province (BC) is not covered. They cover the urban areas and some wider areas along highways in plateau regions. Where is this burdensome coverage that is keeping them expensive?
It's not your province that's the problem, it's Ontario, Manitoba, and Quebec mostly keeping your internet and phone expensive. I don't think people in those provinces are oblivious to that either, and I'm sure they thank you for being a good Canadian, we are after all a country, not say, a collection of states that are "united".
[deleted]
I'm curious what you think you would get from a deregulated banking sector and a deregulated telecom sector? As far as I see it, people in Thunder Bay, Swan River, Bas-Saint-Laurent, or, etc etc wouldn't have had cell service for a long time, maybe even still today, and we might have cheaper cell plans and more data and faster speeds in Toronto and Vancouver. Canadian economy would be in a considerably weaker position with more Canadians in poor financial situations, but we had a wider range of products and services? I can only see deregulation of those sectors being self serving, I don't think it helps all Canadians at large, and I think that's what being a Canadian is all aboot.
Thunder Bay have its very own mobile carrier, which is quite a feat for a town of 100k people.
https://www.tbaytel.net
https://www.tbaytel.net
I was born in Thunder Bay. :) Maybe Fort Frances would have been a better example, basically the cell and internet in Fort Frances was non-existent/didn't work 90% of the time till the province forced Tbay Tel & Shaw to service the region correctly, and we paid the same prices as folks in Tbay, and I'm sure it made little to no economic sense to be servicing that far up north at that time, but I'm sure glad they did.
[deleted]
So to recap, Canada without open banking: 5 big banks, impossible to compete.
Canada with open banking: 5 big banks, impossible to compete.
Canada with open banking: 5 big banks, impossible to compete.
I believe he’s saying that adding this flavor of open banking regulation, on top of the others, further entrenches the incumbents, meaning the situation is not identical as future unwinding of these defenses will have more work to do. In addition, the “open banking” would be implemented in a less than ideal way from the perspective of consumers and squander an opportunity to meaningfully improve retail banking and third party retail financial tools. So the situation would not be as patly identical as you present it.
I find it hard to believe that the current situation could get any worse for consumers.
I don't think anyone is arguing that regulation can't and has never been used to stifle competition. It's fine to be skeptical but that can't be a reason to keep the status quo.
What would a solution look like for you? Would it be that screen-scraping be banned and open banking APIs be encouraged but not mandated? Or mandated within X years for existing banks or within X years of establishing a new bank? Something else?
What would a solution look like for you? Would it be that screen-scraping be banned and open banking APIs be encouraged but not mandated? Or mandated within X years for existing banks or within X years of establishing a new bank? Something else?
Wouldn't this more or less be a protocol for any bank to implement? How would this lock people in to anything?
Not a loosing battle; let's keep the discussion; but honestly I see situations where a oligopoly is preferred.
I lived in states. I banked in First bank of Fairmont ... yes, a city of 11,500 people had its own bank. I could not do ANYthing outside of city. This was a while back of course, but even today that the notion that there are over 5000 banks in USA (down from way over 10k), with complicated inter-state financing laws, from everything I can hear and understand from my USA friends and family, is discouraging both competition and functionality/convenience/sanity, and seems like we are constantly 5-10 years ahead in Canada with basics like Interac, PIN, Chip, Contactless, Interac email transfer, etc. Basically, USA banking system is as strange to me as their health / insurance system.
A bit like, I enjoyed it when Netflix was a monopoly and I could get anything I wanted there. I don't like the "competition" we have now with myriad streaming services that don't interoperate and have different systems and oh yes all want my money.
I guess I am curious: what should I be on the lookout, as a Canadian, that I am missing in our banking system compared to USA? What should I be hopeful a new entry would give me?
(and note, I am talking about banking sector for myself as ignorant consumer; telecom is a whole other ballgame for a myriad different reasons and I'll 100% agree is an area where we are lagging).
I lived in states. I banked in First bank of Fairmont ... yes, a city of 11,500 people had its own bank. I could not do ANYthing outside of city. This was a while back of course, but even today that the notion that there are over 5000 banks in USA (down from way over 10k), with complicated inter-state financing laws, from everything I can hear and understand from my USA friends and family, is discouraging both competition and functionality/convenience/sanity, and seems like we are constantly 5-10 years ahead in Canada with basics like Interac, PIN, Chip, Contactless, Interac email transfer, etc. Basically, USA banking system is as strange to me as their health / insurance system.
A bit like, I enjoyed it when Netflix was a monopoly and I could get anything I wanted there. I don't like the "competition" we have now with myriad streaming services that don't interoperate and have different systems and oh yes all want my money.
I guess I am curious: what should I be on the lookout, as a Canadian, that I am missing in our banking system compared to USA? What should I be hopeful a new entry would give me?
(and note, I am talking about banking sector for myself as ignorant consumer; telecom is a whole other ballgame for a myriad different reasons and I'll 100% agree is an area where we are lagging).
> Edit: I see this is a losing battle, the comments responding to the parent seem to imply that he is championing open banking against a group that disagree with it. And the replies to me think that I don't want open banking. Enjoy your discussion
It would help if you specified a problem with the proposal or with the Advisory Committee on Open Banking in particular. If you can't, then a guess of "Canada's banks are upset about competition" is a really exaggerated immediate post.
It would help if you specified a problem with the proposal or with the Advisory Committee on Open Banking in particular. If you can't, then a guess of "Canada's banks are upset about competition" is a really exaggerated immediate post.
That's not happening in the UK, I don't think it's that difficult to conform to - especially not compared to the financial compliance stuff you're already dealing with as a bank! At the end of the day it's just 'use this API instead of rolling your own', really.
The reason I've soured on it is that it's not that bloody open at all. It should be called 'InteroperableBanking' or something.
The reason I've soured on it is that it's not that bloody open at all. It should be called 'InteroperableBanking' or something.
The process you are describing is ["regulatory capture"](https://en.wikipedia.org/wiki/Regulatory_capture) It isn't Canada specific. It is the rule for everyone, for all people, and for all times. The people with the most incentive to corrupt a corporate governing body are the corporations that are being governed themselves. No one else cares as much as they do.
We have a system like this in Australia already. The benefit of it is its a read only system so if criminals get access to your api key, they can list your details out but they can't take your money or do much useful. So much better than giving a 3rd party your login details.
Unfortunately, Australia's APIs (for anything useful), also have a high barrier to entry for just anyone looking to build an app on top of them:
> To access consumer APIs, you'll need to be accredited by the ACCC and get the customer's consent.
Accreditation [0] has a lot of requirements - my paying child support was considered disqualifying. Parts of accreditation make sense, and should keep things more secure, other parts... Make less.
Mandatory AFCA membership, for example, only makes sense at first glance. The ombudsman can still field complaints without it. Consumer Rights still exist without it. However, the mandatory membership is being used by the ACCC as a replacement for yearly auditing.
[0] https://www.accc.gov.au/focus-areas/consumer-data-right-cdr-...
> To access consumer APIs, you'll need to be accredited by the ACCC and get the customer's consent.
Accreditation [0] has a lot of requirements - my paying child support was considered disqualifying. Parts of accreditation make sense, and should keep things more secure, other parts... Make less.
Mandatory AFCA membership, for example, only makes sense at first glance. The ombudsman can still field complaints without it. Consumer Rights still exist without it. However, the mandatory membership is being used by the ACCC as a replacement for yearly auditing.
[0] https://www.accc.gov.au/focus-areas/consumer-data-right-cdr-...
if anyone has any ideas on utilizing openbanking here in aus, we should get together and make some $$$$$$$$$$$$$$$$$$
Can you share the systems that provide read only API access please? I've tried to find services like them numerous times over the years but have failed at piercing the cloud of opaqueness that seems to surround banking.
OpenBanking at some of the big banks:
+ CommonWealth Bank - https://www.commbank.com.au/developer
+ NAB - https://developer.nab.com.au/docs/open-banking
+ Westpac - https://www.westpac.com.au/about-westpac/innovation/open-ban...
+ CommonWealth Bank - https://www.commbank.com.au/developer
+ NAB - https://developer.nab.com.au/docs/open-banking
+ Westpac - https://www.westpac.com.au/about-westpac/innovation/open-ban...
Up bank has a read only api.
Doesn't Intuit use some read-only mechanism, allowing TurboTax to import your 1099 data? I hope it's read-only. Curious how it works.
18 years ago when working for a shipping company a lot of customers complained about the pain of setting up an address book again, so to help our salespeople entice them to give us their business I wrote some code so if you entered the username and password for one of the other companies it navigated inside that account and pulled all the addresses out. No one I spoke to had ever seen such magical wizardry before and I felt pretty thrilled. We never stored the username and password but I still wondered if we could somehow get into trouble. It amazes me so many people were so happy to use it. Many years later, I’ve faced multiple websites offering Plaid’s help to retrieve data (even Google Pay offers to log into your bank account) but I always refuse.
I'm from the UK and can confirm: open banking has massively helped startups. My local credit union now underwrites based on open banking data, I have a neat budgeting app, I can see all my accounts in one place, and best of all, I can approve or revoke credentials at will. Nobody gets anything but read access. It is mind blowing to me that there are people stuck using screen scraping.
Yeah PSD2 in Europe has been live for a bit and it’s magic.
A lot of people, probably not Canadians, wanting other countries to adopt their failing nonsense ideologies on leaving pie for tech startups.
Nice. Looking forward to 2023.
For those outside of Canada: The Canadian banking industry is highly centralized. This looks like a way to keep more nimble upstarts from actually getting started.
(Not directly related, but Revolut recently retreated from the Canadian market, for example.)
(Not directly related, but Revolut recently retreated from the Canadian market, for example.)
Ya, but exactly what is your claim here beyond something like regulation kills the free market.
Agreed. See the replies to my other comment in this thread. Open banking as a concept is a great idea, in Canada it will be a used strategically as a way to limit competition.
Edit: I'd be happy to be wrong, you can let me know when Canada sees a flood of great new banking startups in the next couple years
Edit: I'd be happy to be wrong, you can let me know when Canada sees a flood of great new banking startups in the next couple years
I'm guessing from this that Canada's banks are upset about getting their grass cut and are looking to regulate new entrants out of business. That's usually what a "made in Canada" solution means.
As a Canadian, I'm strongly in favour of a heavily regulated banking sector[1][2]. The report[3] mostly just describes that banks need to figure out some kinda API that allows me to authorize apps to access everything I could access from the front end. Seems reasonable? The report is good, and the orignal recommendation report from 2019 is also quite good.[4]
[1] https://cba.ca/global-banking-regulations-and-banks-in-canad... (I realize this is effectively banking regulator propaganda, nevertheless, facts are there)
[2] https://www.brookings.edu/research/know-thy-neighbor-what-ca...
[3] https://www.canada.ca/en/department-finance/programs/consult...
[4 ]https://www.canada.ca/en/department-finance/programs/consult...
[1] https://cba.ca/global-banking-regulations-and-banks-in-canad... (I realize this is effectively banking regulator propaganda, nevertheless, facts are there)
[2] https://www.brookings.edu/research/know-thy-neighbor-what-ca...
[3] https://www.canada.ca/en/department-finance/programs/consult...
[4 ]https://www.canada.ca/en/department-finance/programs/consult...
How so? Giving your banking credentials to a third-party for it to login and screen-scrape is not secure. Mandating that banks provide an API instead for third-party apps to use won't necessarily 'regulate new entrants out of business'.
Nope. Canadian gov is just saying users need a way to authorize limited use to my banking data so we can use YNAB and other stuff without resorting to scraping like Plaid or Mint does. Some online banks have setup specific auth codes for these services but most do not.
Would be nice to aggregate my data without giving them keys to my kingdom.
Would be nice to aggregate my data without giving them keys to my kingdom.
The small banks are almost always 10 years ahead of the big banks on apis and open systems.
[deleted]
Hopefully individuals will be able to use the Open Banking APIs to access their own data directly, but it looks like accreditation will be required, so probably not.
Here's the full text of the report: https://www.canada.ca/en/department-finance/programs/consult...