Hacker News Reader

Comment by zkms | Hacker News Reader

I used to use coinbase but some godawful KYC/AML thing kicked in and asked me to send them a "selfie" of myself, which creeped me the hell out. I'm a US citizen, am not on any sort of list of prohibited people, and had already given them a photo of my driver's licence and my SSN -- and have had no issues with opening other bank/bitcoin-exchange accounts online previously.

I thus switched to Gemini because I do not want to support this invasive nonsense. It's literally an automated version of "put shoe on head" (the request that /b/tards would make of camgirls that they wanted to troll).

Between that, and the thing where you literally have to enter your BANK'S username/password to ANOTHER WEBSITE (coinbase, in this case) to prove you have that account (of course it chokes on 2FA); the USian banking system is such a scary bad mess -- and i'm pretty sure that that's a significant driver of bitcoin adoption (and there's also the ACH clusterfuck).

View on HN

You don't have to provide your credentials if you don't want to -- it's just much faster that way.

On that page, instead search for your bank, and in the event it or whatever you're searching for doesn't come up, select the "Enter manually" option, and it'll do the old PIN-via-two-sub-dollar-deposits confirmation trick. It'll take a couple days, but it works.

You had to provide your bank user/pass to Coinbase? I only had to provide routing and account numbers, then verify the ACH amounts (edit: and driver's license photo). But I'm only in the shallow end of the kiddie pool here.

Coinbase offers both options: bank username & password or routing & account numbers. If you choose to provide bank username & password, verification is instant. If you choose to provide routing & account numbers, verification via deposit/withdrawal of small amounts takes days.

I must have missed the user/pass option during the sign-up flow.

ACH does not work in read or in write-only mode. Once you provide someone your ACH info, they can deposit you money.. or empty out your bank account!

I had few rough service providers who tried to come up with some magical charges (technical fee of $500 per year) after agreement was signed and had to change bank numbers to make sure they wont take the money out since it would be more than $500 to fight them in court.

The company is called EMS Merchants btw.. you can read horrible stories of merchants screwed by them in this way via ACH on online forums.

So if you write someone a personal check they can empty your account?

Of course. There's no inherent technical countermeasures against someone doing so.

Yep, and this happened to Donald Knuth: http://www-cs-faculty.stanford.edu/~knuth/news08.html

This is just bananas. I always thought the routing/acct would just authorize deposits. I assumed this, because every time I need this info, I look at my checks. (When people wire money to me).

When you write a check, the signature is the authorization to withdraw funds, and the amount and recipient is specified.

I’m shocked that banks would permit a withdrawal without some kind of “anolog” to this authorization pattern.

It makes all these worries about passwords and online credentials seem quaint. These numbers are all over the place, online and off. Why aren’t halfway clever hackers draining accounts right now?

It’s a huge risk mitigated by the banks being a mostly-trusted network. If someone abused ACH they’d lose access to the network quickly, and your bank can build checks in on their side so if a transaction arrives from a foreign bank they might call you to confirm (when I bought my house the down payment was large enough to trigger a confirmation visit).

Yes but I believe with ACH you have 60-days to dispute the fraudulent debits.

It is like transactions are in P-time and disputes are in NP-time.

Not unless they either have physical check from you, OR are enrolled into MSP (merchant service provider). But MSPs will monitor fraudulent activity just like providing CC in any online store gives them access to empty your CC doesnt mean they will get away with it :)

But isn't the same the info you provide to companies like Coinbase (account and routing number) on the bottom of all of your checks? Oh, but if they're a merchant they have different abilities?

Yeah, normal people cannot initiate ACHes but merchants can.

No, all one needs to do is have access to the routing / account number and one can start withdrawing funds, paying bills, etc. There is nothing in place to prevent that and nothing else is needed.

And the police will do nothing about it. Even if the fraudster uses your checking account to pay for their power bill. Good luck getting the police in a big city to head over to the house and investigate.

That might be true in isolated cases with dysfunctional police departments but there are a lot of people in jail for charges like check kiting who’d disagree with you.

It's pretty simple to do a hot/cold account setup at most banks. I've got a checking account which is unlinked to all other accounts and I try to keep it at a $0 balance. The online banking site makes it easy to transfer money into and out of that account from the accounts I keep money in.

It's a little more work to stay on top of transferring out money when it gets deposited and putting it in when I want to spend it, but it gives me a bit more piece of mind when giving out routing/account numbers.

That's an excellent idea. My bank(s) have a so-called Savings Account (separate from the main Checking Account) that yields a microscopic amount of interest, which I never use since I 'save' money elsewhere. That might be a great use case for what you describe.

Wait what? Did they really ask for your bank login credentials? If so, approximately what date was that?

They use Plaid[1] to verify bank accounts using bank login credentials instead of micro deposits -- which reduces abandoned applications since you don't have to wait a couple days to complete verification.

This is a very common thing for fintech companies to do.

[1] https://plaid.com/

It's so bizarre to me that there isn't proper auth delegation in online banking. You should never have to put credentials for one domain into a form on another domain. Let alone banking credentials!

I think everyone here is super overblowing this.. You're redirected to a new domain (of your bank) for verification. Then directed back.

And that's a huge indicator of why blockchain finance is attractive. The banking system is AWFUL. Exchanges are bridges between banks and blockchains, and it's quite reasonable to want to keep your money in cryptocurrency just for technical usability reasons. I can send cryptocurrency from a shell script -- that's not going to work with bank money in a million years, or if it does it's going to be because of the competition from blockchains. Blockchains enable permissionless innovation in finance, and that's HUGE.

You can do that with Monzo already

Looks neat, but it'll be years before that's widely available worldwide. Monzo has a waiting list and probably don't offer business accounts. Blockchains right now enable everyone in the world to open however many "accounts" they want instantly.

You're talking about the USA banking system, which is pretty much stone age compared to everyone else. (paper checks? really?) For example, in EU the requirement for banks to open up APIs to everyone is coming in force next year, a bit closer than a million years - and it's not happening because of competition from blockchains, it was put in force (before blockchains boomed) for reasons of consumer rights and restricting anti-competitive behavior by banks.

I'm not sure the EU directive will open up APIs to everyone. More likely it will be to a regulated class of businesses, right? If it really means I will be able to directly access and manipulate my own personal and business bank account with curl, then I'm really excited. If I have to go through a bureaucratic approval process, then it's still pretty cool, but not what I really want (permissionless innovation).

Yes, the main intent is not for end-users to access those APIs directly - most consumers don't want that, and the larger business who want it already have such access, pretty much every bank here offers a cash management solution that allows you to automatically access your account data and send transactions from your system to the bank. The big expectation is that it will open up the market to fintech service providers / tool makers who can then provide services using that API to every customer of every bank; but there certainly could be (or you could make) a service provider that offers exactly what you describe - a consumer friendly API for direct access, handling the authentication in some manner that's compatible with isolated curl requests. You wouldn't have to get permission from the involved banks to do that, but you would have to get the permission from the customers, of course.

What the fuck? There is no way, never, ever, that I would even consider doing that. How the hell is it a good idea for any company to try to convince people that it should be normal to share login credentials with a third party for any service, much less something as sensitive as one's bank account? That's just training people to get scammed.

Hasn't Mint been doing this for ages?

I entered one account on Mint and found myself with OP, and decided I didn't want to enter a bunch of different login credentials into a different app.

Was about to say this. Pretty much most of services that tie in with a bank account that I've ever used provide this option as an alternative to waiting 3 days for bank account verification. It is truly bizarre how this has become the standard.

Yes, but Mint used a similar approach.

Not sure if this is what they use now, but Mint used a similar (but older) service to Plaid called Yodlee [0] as their backend for accessing bank accounts.

[0] https://www.yodlee.com/

[1] https://techcrunch.com/2009/09/18/mint-is-yodlees-youtube/

> That's just training people to get scammed.

Yes. All the work of "don't enter your bank password on any website that isn't your bank" went down the bloody trash once this awful workaround to the awfulness that is ACH happened. It's very sad.

boy, somebody ought to work on a replacement for that awful ACH system

UK has Faster Payments; which runs 24/7 and has times measured in seconds, unlike ACH (doesn't run on weekends, takes days), and charges no costs to end-users. This is a well-solved problem, the issue is that USian banks make far too much off overdraft fees to want to upgrade their infrastructure at the cost of making less money from parasitic fees.

I don't disagree, but this takes seconds instead of 2-3 business days in the case of ACH verification. 2-3 business days is an absolute eternity in the world of Bitcoin speculation.

You can do what Gemini does -- credit the account with fake money once the user requests ACH transfer, let them make trades with it, and only let them withdraw any proceeds of it (whether bitcoin or fiat) once the ACH transaction fully settles.

That's a really interesting approach... do they front the money to the user while the deposit is settling?

It asked me, yesterday.

At least for my bank, it used the same login popup many other sites (including Gemini) use.

It seems that this was in response to the people trying to game the system - fake ids, fake accounts etc.

Reply on news.ycombinator.com