Thanks for the link to your project, looks really useful!
Also, the first link I posted isn't my work, just a nice utility I found. I did roll my own Python for converting OFX to Ledger though, been meaning to clean that up and post it but haven't gotten around to it yet.
I'm pretty sure that doing that in the UK instantly nullifies any protection you have against fraud etc.
E.g. Barclays:
"You must memorise your PIN or password ... Never give them to someone else or let someone else use them, or do anything that would let someone else use them, such as writing them down in a way that might be recognised by someone else, keeping the letter carrying a PIN, or giving someone else access to a device like a mobile phone on which the relevant details are stored."
"If you have either deliberately or with gross negligence: • failed to keep your card, PIN, password, PINsentry or mobile PINsentry generated codes, device or equivalent secure, or • failed to tell us as soon as possible that you have lost your card (especially if you think someone else might have been able to ind it) we will not refund any payments made before you tell us that it’s been lost or compromised."
This does invite the question of why Mint isn't using (or even just offering) OFX read-only credentials... or do they?
I that's the sort of concerns that did in the start-up greplin. They would have access to all your password protected data for any service under the sun.
A big bonus of this approach is that I have complete control over the data, so if an import get screwed up somehow I can fix it manually. Mint's "black box" approach is good when everything works flawlessly, but you're stuck doing weird hacks if anything goes wrong or you want to do something it wasn't designed for.
Ledger, incidentally, is from the same one who is now maintaining Emacs, if I'm not mistaken.
[1] http://captin411.github.io/ofxclient/ [2] http://www.ledger-cli.org