> you need to give YNAB your bank username/password

I am constantly amazed by the people that are willing to do this for various value-added finance sites; people that I would normally consider sane. Unless your bank provides (and you used) a read-only account authentication, if something goes wrong and your money disappears from the bank, the bank is going to tell you to take a hike. I can't imagine taking this kind of risk with my money.

Sorry, but there’s no bank in the world that would tell you to simply “take a hike” if your password was breached and your money was stolen.

They will if you literally give your credentials to a 3rd party when they explicity say don't give out your details anywhere, only between you and your bank.

Giving away your password voluntarily and knowingly is not a breach.

For me, the username/password gives you read-only access and any kind of transaction requires 2FA.

That sounds a lot more complicated than just downloading bank statements and uploading them to YNAB and adds a lot more points of failure

Downloading and uploading bank statements is a manual process, unless you're willing to give the service your bank ID/PW, right? Seems to me if you set up your bank accounts to send you notification emails for any balance change, you can automatically reflect the balance without needing to deal with sensitive credentials.

It does, but it also keeps YNAB more in sync with your bank account, since transactions will typically take a couple days to show up in the statement.

> transactions will typically take a couple days to show up in the statement

Wait, in what century do you live that your online banking transaction overview doesn't have up to date data ? Also, your bank allows you to log in with just a username/password ?

A banking "statement" usually refers to a PDF you can download; the electronic version of the thing they'd previously send you by mail.

The online banking CRUD interface might have up-to-date data, but it isn't an API, and being behind some weird proprietary single-sign-on setup makes it pretty hard to scrape, too.

> Also, your bank allows you to log in with just a username/password ?

Yes, this is common in the US (and here in Canada, too.) We sometimes get asked for "security questions", but support for 2FA is extremely rare, and I don't think there's any bank in North America that requires 2FA to login to your online banking. (The "government or bank issues you a smart card that can be used for session encryption; bank issues you an adapter to plug it into your computer" thing doesn't happen here.)

> The online banking CRUD interface might have up-to-date data, but it isn't an API, and being behind some weird proprietary single-sign-on setup makes it pretty hard to scrape, too.

That’a why they also provide an API. They are required by law to do so (https://en.wikipedia.org/wiki/Payment_Services_Directive)

> I don't think there's any bank in North America that requires 2FA to login to your online banking.

This is required by the same law.

Bank of America only added 2FA as an opt-in option starting in 2017. It is most definitely not required... Law or not.

I'm pretty certain it's the same way with every other major US bank.

@Aaargh20318 could've mentioned that he linked to the EU laws about banking.

> > I don't think there's any bank in North America that requires 2FA to login to your online banking.

> This is required by the same law.

FYI: no bank has to follow EU laws in North America.

Regarding statement freshness, derefr already answered. Regarding username/password, in Brazil at least yes (sort of) - you log in with account number and a password, but it's sort of a "read-only password" - you can see statements and stuff with it, but if you want to actually move the money, a different password is required.

Trivia: this is used by a Mint-like company in Brazil called GuiaBolso - you give them just the "read-only password".

Sure, but a database? Isn’t that part of what YNAB provides?

One of the key features of YNAB is using it to actually inform you before you make purchases. By having it near instant (manual, or by this method), your decisions are fully informed when you make them.

Yes, but a DB of "transaction notifications" your bank sent you could still be useful so you can reconcile/debug if needed, much like the actual bank statement.

I do agree that the DB could be removed from the system, adding the transaction directly from the SES-triggered event, and that would work for most cases.

Yeah it could probably do without it, but initially made this for a hackathon so it’s by no means perfect

It probably started as a side project that would specifically let them experiment with those technologies.

It's an amazing job what you have done here. I've been tinkering with exactly the same idea (and same implementation) but haven't had the time to go ahead. Your work will instantly jumpstart my own use case (VISA and Beancount) and I thank you for that. Kudos!

Thank you! Appreciate the kind words

> you need to give YNAB your bank username/password

Why don't they have oauth for this?

What do you do about cash transactions?

Not OP, but there's not much to do about them - best way is to enter manually in the app at the time of purchase or write them down in a notebook and enter them in batch once in a couple days or per week.

If your cash spending is sufficiently small that you don't care much to tracking each cash transaction individually, you can just track money as a category instead of an account - just record an outflow transaction in your bank account when you withdraw.

I don't use ynab anymore, but when I did, I usually just didn't include cash in it. I almost never use cash, and so it made sense to just deduct the money when it became cash.