Have you MET the rest of humanity? :-) Of course they really care that little. Their primary password is their pet's name or "password1".

Seriously, though-- I know plenty of really smart geeks who used mint. AFAIK, they signed up MILLIONS of users and had exactly zero confirmed (or suspected?) security breaches.

People care a lot more about their immediate needs and desires than potential risks. How many people eat well and exercise? If you ask "how do these sites stay in business?", I assume you're also confused as to why most people are dangerously fat? And why people ride motorcycles when the fatality rate for doing so is about 3x that of cars?

I'm not sure if you don't realize it but the entire purpose and key feature of Mint (and perhaps Wesabe as well, I've never tried it) is to aggregate all of your banking information in one place. Of course to do so they need the credentials to your various accounts, as the banks don't offer any sort of open APIs or OpenID or anything like that.

If you're not comfortable with this then of course the product is not for you. You can read more about Mint's claims of security and privacy at http://www.mint.com/privacy/

Yeah I honestly don't feel safe sharing that kind of info. I would much rather use my bank's "export data" feature once a week or so and uploading it there.

Also, maybe my bank is weird, but how can Mint have access with just the user/pass combination? I can't do anything online without a RSA certificate ...

I don't think it is public info how they accomplish it but it seems that they are simply scraping the site, for a good number of my personal accounts at least. Mint has me answer a number of the individual bank's "security questions" to be able to fully set up the bank account in Mint. If the bank changes the login procedure in anyway, then I have to re-edit the info about the bank that Mint has.

Mint uses Yodlee [1] for website scraping. Wesabe built their own and apparently inferior scraper, and this could be one of the reasons of why they lost to Mint.[2]

[1] http://www.yodlee.com/

[2] http://blog.precipice.org/why-wesabe-lost-to-mint

Apparently after being acquired by Intuit, Mint started using the Intuit aggregation framework. They seem to have made the transition fairly transparent as I had no idea it had switched.

That's intriguing - I thought one of their privacy promises was that they don't hold on to the login information for your various accounts, that it lived with Yodlee.

Seems like to do a transition they'd have to break that promise.

Interesting. I thought my bank's security was lacking, but at least it is impossible to scrape my data off it even if I give you the password. You have to go through the browser's main security certificate thingy to "decode" the RSA key that is then sent to the bank. It's impossible to login without it or get to any sort of data (afaik)

There are solid laws and remedies in place for when someone steals money from your bank account. This happens all the time at banks and they just replace your money without even telling you. Mint and Intuit have every incentive in the world to protect your money.

Giving out your twitter/facebook/gmail password is much more dangerous because there are no easily enforceable laws in place for when someone spams all your contacts, damages your reputation, or locks you out of your web accounts.

What laws are in place? FDIC doesn't cover theft/fraud.

I think theft and fraud both count as laws that are in place.

The FDIC has an entirely different purpose. The banks themselves usually cover customer losses themselves due to hacking. Identity theft can be more difficult to recover from, of course, but if Intuit/Mint/Yodlee had a major security breach, it would need to be cleaned up very quickly.

It is relatively commonplace to prosecute monetary theft compared to prosecuting "gmail theft" or "twitter spamming."

As an aside AFAIK many financial advisors have used aggregation services (CashEdge, ByAllAccounts, uMonitor), which require their clients to log in and provide essentially the same access to their financial institutions, for quite some time. I believe Yodlee was one of the first to make their aggregation services available to a consumer based business vs. an advisor.

In addition the onus of primary security (username/password) rests with the service provider (Yodlee), if I understand things correctly Mint would only store a unique identifier to access a user's information via a Yodlee API call. So after transaction data has been scrubbed it would be extremely difficult for a hacker to access a user's bank account information from Mint.

You're still very much correct if Yodlee has a security slip, but their business depends on securing that information.

This is one reason why Mint would never work in the UK. We have real security on our banking websites - hardware security (You get sent a hardware device to generate codes, or to put your card into etc).

(As an aside, our banks are simply crazy fast now. I logged into HSBC the other day, issued a bank transfer to a Barclays account. Logged out, logged into Barclays less than a minute later, and the money was there. Impressed I was).

Any banking website that simply accepts a username and password would scare the hell out of me.

I still don't quite understand what the value-add of mint is though. I'm guessing that banking websites in the US aren't very useful, or that some users value being able to collect all their financial data into one place (How many banks accounts from different banks do people need?)

> Any banking website that simply accepts a username and password would scare the hell out of me.

That's still most of them, I think. Halifax used to be username+pw+one security question. Now it's username+pw+3 letters out of a second pw (called "memorable information"). And to attempt to stop keylogging (or at least I presume this is why), the select boxes for the 3 letters don't let me hit the letter, I have to use arrow keys or the mouse. Which, frankly, makes me want to club somebody to death with a baby seal, even if it -is- theoretically more secure.

I don't know the technicalities, but I always considered Halifax a 'building society' rather than a grown up bank. That is worrying. And ++ for the irritation of arrow keys+mouse etc I've seen that before on others.

> I still don't quite understand what the value-add of mint is though.

For me personally it meant I could throw out MS Money but still track where my money is going w/ much less effort. Mint is pretty good about correctly categorizing transactions, so I have to spend very little effort manually categorizing transactions.

Wesabe actually used a Firefox plugin that was a macro recorder, you just enter the form and go to the export data part of your banks website, and then Wesabe would replay those actions once a week to get new data. Of course it still could have read your password and sent it off, but it was a little bit more control than mint.

I wish that content aggregators could use something like Kerberos tickets to delegate authentication. That way Mint could have a read-only ticket to access my bank that didn't require my password.

I still use Mint though. I asked them about their security measures in this thread: http://satisfaction.mint.com/mint/topics/can_i_trust_the_sec... . Their response was that you're not liable for fraud if you report it to your bank promptly, and Mint's reporting features make it more likely that you catch the fraud early enough to report it. It seems like a good security tradeoff to me.

US banks are so far in the past security-wise that it'll take aeons for them to adopt something like OAuth; most of them haven't even managed things like using email or telephone calls responsibly.

The thing that kept me from ever using Mint is that they said they then give your username and password to someone else without ever specifying who that is. Now I know that it's Yodlee, but there was no way I'm giving my password to someone when I don't even know who I'm giving it to.

Perhaps people have faith in the disaster recovery routes their credit card / banks provide, whether it's well grounded or not.

What I want to know is why can't these financial institutions provide a read only username/password for users?