from Hacker News

Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

by exotree on 8/18/21, 9:51 PM with 248 comments

  • by frosted-flakes on 8/18/21, 10:40 PM

    It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow, is there any recourse?

    Hopefully individuals will be able to use the Open Banking APIs to access their own data directly, but it looks like accreditation will be required, so probably not.

    Here's the full text of the report: https://www.canada.ca/en/department-finance/programs/consult...

  • by franga2000 on 8/18/21, 11:41 PM

    As a developer living in a country that has fully implemented "Open Banking", here's a quick setting of expectations for Canadian developers so they don't get too excited as I did when this was first being introduced.

    Open Banking is not, in fact, open in almost any sense of the world. It is standardised and the standards are freely available ("open"), but other than that, you still need to have an official "blessing" to actually access a production API endpoint (even for your own account), you need a legal entity that has some highly specific and entirely meaningless certificates that are hard (and potentially expensive) to get and even after all of that, you'll still need to negotiate access with each bank individually.

    What I imagined when I first heard of "Open Banking" was a public OAuth2 endpoint where I can grant my custom script access to just my bank balance and transaction history (possibly with a change webhook) and have it update my finance tracking database.

    The "open" part is only relevant to the banks, since they don't have to pay royalties for the standard implementing the APIs. For the rest of us, it might as well be SS7.

  • by manishsharan on 8/18/21, 10:36 PM

    This may be driven by TD's suit against Plaid

    From this source https://www.lexology.com/library/detail.aspx?g=8f56092c-ab40...

    "Users have complained that after connecting their bank accounts, Plaid stores their credentials and uses them to collect 5 years’ of transactional data and continues to track users’ data in future. Users further claim that the data-gathering scheme is not incidental to Plaid’s business model and is, in fact, its “very purpose.”

  • by kaolinite on 8/18/21, 11:11 PM

    It’s interesting to me how quickly I’ve soured on the concept of open banking, which on paper sounds fantastic and originally I was very much in favour of. And which I’ve used personally to make it easier to extract my own data for my own use.

    However more often than not now I’m seeing it used for really invasive applications. Such as when I rented my most recent apartment and they asked to use open banking to verify our finances, which as far as I know would have given them access to every single transaction going back a decade or so. The agent was confused as to why I wouldn’t go ahead with it and ultimately let us opt out, but I do worry that at some point I won’t have much choice but to accept.

    I’ve also seen credit scoring companies that suggest you’ll get a better credit score if you use open banking to hand over your transactions. I have no need to use that but I suspect others who are desperate to increase their chances of getting a mortgage, etc, won’t have much of a choice.

  • by barbazoo on 8/18/21, 10:30 PM

    This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.

  • by llbeansandrice on 8/18/21, 10:28 PM

    I don't know why OAuth tokens aren't the default solution to this. BoA recently added this as an option and it's way more straight forward than giving my login credentials to Personal Capital or, god forbid, Intuit.

    edit: Of course it helps if the 3rd parties implement it as well. I revoked access to Intuit but Personal Capital only lets me use my userID and password.

  • by phoenixy1 on 8/19/21, 3:04 AM

    I have some issues with the wording in this article (I work at Plaid and I don't think everything it says about us is accurate) but the report is a good thing. Right now we really are dependent on screen scraping at many banks and we'd much rather use API-based connections to power our services, but so many banks just don't provide APIs. I'm optimistic for an open banking future in Canada and who knows, maybe even the US some day...

  • by gigatexal on 8/19/21, 4:33 AM

    The EU has been moving in this direction with PSD2 and it’s been pretty good. Downside is there’s no defacto standard for APIs and each bank's development skills vary widely.

  • by canada_dry on 8/19/21, 3:08 AM

    Given the tech savvy HN user base I'm surprised at all the "I'm surprised these 3rd party services are just impersonating me".

    I'd love it if there were API's to access my banking data directly, but failing that I rely on the meager "txn download via csv" my Canadian banks offer (at least).

  • by diogotozzi on 8/18/21, 10:42 PM

  • by jonny_eh on 8/18/21, 10:35 PM

    What's open banking? What's the context?

  • by softveda on 8/19/21, 10:37 AM

    Australia is building Open Banking (and generically Consumer Data Standards) APIs on GitHub. https://github.com/ConsumerDataStandardsAustralia/standards

    This is a problem discussed here as well. Generally big banks are advocating getting rid of screen scraping and moving to API but most fintechs are smaller and they don't want to change and there is little appetite from Govt. to force them.

  • by Helmut10001 on 8/19/21, 4:20 AM

    The Spectre Salt Edge API does the same. I thought I could use this in Firefly III to automcatically pull my banking data, until I found out they are screen scraping. This is a no go. Unfortunately, the official FinTS APIs available by most banks are incredibly flawed, too. Firstly, a lot of information is not available. Secondly, there is no way to have a "read-only" API key/connection. Why is that? I have no idea. There is an Open Banking project in Europe, but it it is far from being ready.

  • by celticninja on 8/19/21, 2:30 AM

    The UK mandated this, possibly the EU also, but it works very well.

    https://www.openbanking.org.uk/what-is-open-banking/

  • by bacan on 8/20/21, 9:50 PM

    So glad to see this happening. Screen scraping is unsecure and imo a per account APIkey based solution with a read-only access is the way ahead.

  • by lostgame on 8/19/21, 3:09 AM

    As a developer in Canadian Banking, I wonder how this will affect us.

    I work for a major bank relevant to this story, and I've honestly not heard anything about it internally.

  • by themantra514 on 8/19/21, 11:24 AM

    I built a shopping app with a headless browser 10 years ago. Fun project until any part of a vendor site changed :\

  • by oliyoung on 8/18/21, 11:51 PM

    2023? Australia's might be finished by then

  • by ohazi on 8/18/21, 10:52 PM

    To everyone in this thread complaining that this is just Canada being Canada and trying to snuff out the upstarts... what the fuck are you going on about?

    I'm a US citizen and I want this screen scraping / credential sharing / whatever you want to call it to die in a fire already. Forcing banks to implement any sort of API access seems both preferable to the dumpster fire we have today, as well as more inviting to upstarts, because right now the only way to be an upstart is to literally ask your customers to violate their bank's terms of service.

  • by brailsafe on 8/18/21, 11:09 PM

    Nice. Looking forward to 2023.

  • by jt2190 on 8/18/21, 10:33 PM

    For those outside of Canada: The Canadian banking industry is highly centralized. This looks like a way to keep more nimble upstarts from actually getting started.

    (Not directly related, but Revolut recently retreated from the Canadian market, for example.)

  • by version_five on 8/18/21, 10:27 PM

    I'm guessing from this that Canada's banks are upset about getting their grass cut and are looking to regulate new entrants out of business. That's usually what a "made in Canada" solution means.