Hacker News Reader

Comment by koolba | Hacker News Reader

Wait what? Did they really ask for your bank login credentials? If so, approximately what date was that?

They use Plaid[1] to verify bank accounts using bank login credentials instead of micro deposits -- which reduces abandoned applications since you don't have to wait a couple days to complete verification.

This is a very common thing for fintech companies to do.

[1] https://plaid.com/

It's so bizarre to me that there isn't proper auth delegation in online banking. You should never have to put credentials for one domain into a form on another domain. Let alone banking credentials!

And that's a huge indicator of why blockchain finance is attractive. The banking system is AWFUL. Exchanges are bridges between banks and blockchains, and it's quite reasonable to want to keep your money in cryptocurrency just for technical usability reasons. I can send cryptocurrency from a shell script -- that's not going to work with bank money in a million years, or if it does it's going to be because of the competition from blockchains. Blockchains enable permissionless innovation in finance, and that's HUGE.

You're talking about the USA banking system, which is pretty much stone age compared to everyone else. (paper checks? really?) For example, in EU the requirement for banks to open up APIs to everyone is coming in force next year, a bit closer than a million years - and it's not happening because of competition from blockchains, it was put in force (before blockchains boomed) for reasons of consumer rights and restricting anti-competitive behavior by banks.

I'm not sure the EU directive will open up APIs to everyone. More likely it will be to a regulated class of businesses, right? If it really means I will be able to directly access and manipulate my own personal and business bank account with curl, then I'm really excited. If I have to go through a bureaucratic approval process, then it's still pretty cool, but not what I really want (permissionless innovation).

Yes, the main intent is not for end-users to access those APIs directly - most consumers don't want that, and the larger business who want it already have such access, pretty much every bank here offers a cash management solution that allows you to automatically access your account data and send transactions from your system to the bank. The big expectation is that it will open up the market to fintech service providers / tool makers who can then provide services using that API to every customer of every bank; but there certainly could be (or you could make) a service provider that offers exactly what you describe - a consumer friendly API for direct access, handling the authentication in some manner that's compatible with isolated curl requests. You wouldn't have to get permission from the involved banks to do that, but you would have to get the permission from the customers, of course.

You can do that with Monzo already

Looks neat, but it'll be years before that's widely available worldwide. Monzo has a waiting list and probably don't offer business accounts. Blockchains right now enable everyone in the world to open however many "accounts" they want instantly.

I think everyone here is super overblowing this.. You're redirected to a new domain (of your bank) for verification. Then directed back.

What the fuck? There is no way, never, ever, that I would even consider doing that. How the hell is it a good idea for any company to try to convince people that it should be normal to share login credentials with a third party for any service, much less something as sensitive as one's bank account? That's just training people to get scammed.

> That's just training people to get scammed.

Yes. All the work of "don't enter your bank password on any website that isn't your bank" went down the bloody trash once this awful workaround to the awfulness that is ACH happened. It's very sad.

I don't disagree, but this takes seconds instead of 2-3 business days in the case of ACH verification. 2-3 business days is an absolute eternity in the world of Bitcoin speculation.

You can do what Gemini does -- credit the account with fake money once the user requests ACH transfer, let them make trades with it, and only let them withdraw any proceeds of it (whether bitcoin or fiat) once the ACH transaction fully settles.

That's a really interesting approach... do they front the money to the user while the deposit is settling?

boy, somebody ought to work on a replacement for that awful ACH system

UK has Faster Payments; which runs 24/7 and has times measured in seconds, unlike ACH (doesn't run on weekends, takes days), and charges no costs to end-users. This is a well-solved problem, the issue is that USian banks make far too much off overdraft fees to want to upgrade their infrastructure at the cost of making less money from parasitic fees.

Hasn't Mint been doing this for ages?

Was about to say this. Pretty much most of services that tie in with a bank account that I've ever used provide this option as an alternative to waiting 3 days for bank account verification. It is truly bizarre how this has become the standard.

Yes, but Mint used a similar approach.

Not sure if this is what they use now, but Mint used a similar (but older) service to Plaid called Yodlee [0] as their backend for accessing bank accounts.

[0] https://www.yodlee.com/

[1] https://techcrunch.com/2009/09/18/mint-is-yodlees-youtube/

I entered one account on Mint and found myself with OP, and decided I didn't want to enter a bunch of different login credentials into a different app.

At least for my bank, it used the same login popup many other sites (including Gemini) use.

It asked me, yesterday.

Reply on news.ycombinator.com