Canada calls screen scraping ‘unsecure,’ sets Open Banking target for 2023

Re:Canada calls screen scraping ‘unsecure,’ sets Open Bankin... by varenc on Wednesday August 18, 2021 @08:48PM (#28229081)

For future reference the tip off is that YNAB/Plaid asks for your bank account's username and password directly. If they were using some proper API, you'd be redirected to an Authorization page on your bank's domain where you could review the requested permissions and the app requesting, and then choose to grant it.

[ Parent | on HN ]

Re:Canada calls screen scraping ‘unsecure,’ sets Open Bankin... by kryptk on Wednesday August 18, 2021 @09:13PM (#28229245)

Exactly this, Plaid "kindly requests" you violate the ToS you have with the bank and hand over the keys to your finances.

I have never noped out of anything so hard.

[ Parent | on HN ]

Re:Canada calls screen scraping ‘unsecure,’ sets Open Bankin... by amluto on Wednesday August 18, 2021 @09:16PM (#28229255)

It would be interesting if an attorney general went after Plaid for CFAA violation.

[ Parent | on HN ]

Re:Canada calls screen scraping ‘unsecure,’ sets Open Bankin... by varenc on Wednesday August 18, 2021 @09:49PM (#28229436)

I'm conflicted on the issue. Plaid only has to do this insane screen scraping because there's no other way to get my own financial data. The details of how it's done pains me, but I also think I should have freedom of choice with my data.

IMHO, the Canadian proposal seems like the ideal solution. Force the banks to offer a secure and more efficient way for consumers to access their open banking data. (This will also massively lower the barrier to entry for another Plaid competitor)

edit: Plaid's docs mention that banks may detect and block this screen-scraping. They frame it as the bank limiting "your ability to access your financial information", which I think is somewhat valid. They're quite obtuse about the whole scraping thing though: https://plaid.com/trouble-connecting/#:~:text=Your%20financi...

[ Parent | on HN ]

Re:Canada calls screen scraping ‘unsecure,’ sets Open Bankin... by coldacid on Wednesday August 18, 2021 @10:15PM (#28229600)

I'm not conflicted on it at all. Plaid might need to do this for them to work, but there's nothing that makes Plaid required for anything you do with your banking. People keep mistaking convenience for necessity, and that's how we keep ending up with hacked-together services that leak everyone's info and worse.

I'd rather have no convenience than a convenience that hands off the keys to my life behind my back. And so should the rest of us.

[ Parent | on HN ]

Re:Canada calls screen scraping ‘unsecure,’ sets Open Bankin... by underwater on Thursday August 19, 2021 @04:53AM (#28231719)

You're basically saying that if a law makes something impossible, then it's OK to ignore the law?

[ Parent | on HN ]

Re:Canada calls screen scraping ‘unsecure,’ sets Open Bankin... by dageshi on Thursday August 19, 2021 @05:45AM (#28231975)

This is how most old/out of date laws/not fit for purpose laws end up being revised.

[ Parent | on HN ]