Big Banks Lock Horns with Personal-Finance Web Portals

Re:Big Banks Lock Horns with Personal-Finance Web Portals by snuxoll on Thursday November 05, 2015 @11:09AM (#10514103)

The dumb part is banks are more than willing to support Quicken's Express Web Connect, which literally stores your username/password on Intuit's servers, logs into your online banking portal and downloads the .qfx files you would get if you did it by hand. This is the same company that owns Mint, and it's literally doing the same thing!

Oh well, until banks decide to stop allowing users to manually save .qfx files the worst they can do is make life inconvenient.

[ Parent | on HN ]

Re:Big Banks Lock Horns with Personal-Finance Web Portals by curun1r on Friday November 06, 2015 @12:44AM (#10518016)

I'm not sure about Quicken (which, incidentally, is being divested, so it won't be part of Intuit soon enough), but Mint uses the same internal service for communicating with financial institutions as Quickbooks and TurboTax.

By tokenizing each account, it ensures that if a breach of any of those products were to happen, the bank authentication credentials won't be leaked.

[ Parent | on HN ]

Re:Big Banks Lock Horns with Personal-Finance Web Portals by avemg on Thursday November 05, 2015 @12:35PM (#10514743)

As a (reluctant) Quicken user, I was not aware that Express Web Connect credentials are stored on Quicken servers. Do you have anything to back that assertion up?

[ Parent | on HN ]

Re:Big Banks Lock Horns with Personal-Finance Web Portals by breischl on Thursday November 05, 2015 @12:46PM (#10514831)

From Quicken's security guide (emphasis added):

When using Express Web connect to automate Web connect downloads from your financial institution's Web site, your user name and password are encrypted and, depending on your financial institution's procedures, will be stored on our firewall-protected servers or in your Quicken software. Your financial information is transmitted using secure socket layer technology and is encrypted, so it is unreadable during transmission. It is then stored on our firewall-protected servers and is securely transmitted directly to your desktop computer when you initiate One Step Update. Your information is confidential and is not used for anything other than providing and maintaining the One Step Update service.

http://quicken.intuit.com/support/help/account-transaction-i...

[ Parent | on HN ]

Re:Big Banks Lock Horns with Personal-Finance Web Portals by toomuchtodo on Thursday November 05, 2015 @12:59PM (#10514943)

Yes. They store your credentials at rest in a data store, and the creds are decrypted on demand when API requests are made.

[ Parent | on HN ]

Re:Big Banks Lock Horns with Personal-Finance Web Portals by KirinDave on Thursday November 05, 2015 @02:03PM (#10515434)

This is (probably) not global. Some financial institutions will offer aggregators safer ways of keeping a negotiated connection around. Like most big aggregators, Intuit negotiates with all the major banks individually for both batch and realtime refreshes.

The entire world of aggregation is simultaneously really interesting and rock-boring stupid. I'm surprised we don't see more fintech startups using it more aggressively, even as I am happy this made my former endeavor more acquirable.

[ Parent | on HN ]

Re:Big Banks Lock Horns with Personal-Finance Web Portals by snuxoll on Thursday November 05, 2015 @12:43PM (#10514807)

https://quicken.intuit.com/support/help/bank-download-issues...

Expand the "Express Web Connect / Quicken Connect - Details" section underneath the comparison matrix and you will see this:

* Your login credentials are stored on Intuit-hosted servers. This makes updates faster for you.

* Your financial data is stored on Intuit-hosted servers. This provides a more complete history of your financial transactions than is typical for data stored on financial institution servers.

* We use state-of-the-art security measures to protect your login credentials and your financial data.

----

This is half of why I pay $9.99/mo to use Direct Connect with my Wells Fargo account (that, and having bill pay within Quicken is pretty handy).

[ Parent | on HN ]

Re:Big Banks Lock Horns with Personal-Finance Web Portals by zymhan on Thursday November 05, 2015 @06:42PM (#10516903)

There's really no way around it, if Quicken is going to login to your bank account for you, it needs your password in cleartext somewhere on its server.

[ Parent | on HN ]

Re:Big Banks Lock Horns with Personal-Finance Web Portals by ryanhuff on Thursday November 05, 2015 @03:12PM (#10515828)

Intuit owns Mint. Not sure how the banks are going to know the difference between Mint users and Express Web Connect users. Maybe they shut them all down?

[ Parent | on HN ]