Hacker News Reader

Comment by JadoJodo | Hacker News Reader

I was under the impression that they didn’t have access to any APIs but that they simply took your credentials and scraped the bank webpage.

View on HN

I was under the impression it was a little of both, depending on the bank.

They do some of both.

When I link a Capital One account, I get an OAuth-style flow and the ability to select which accounts I share directly on the C1 website. The sites I use this on show up as "Linked Apps" in my security settings in C1.

Others use the credentials-based flow.

Where they aren’t using APIs and instead the scrapers, does that mean they have your banking login credentials? Be curious to hear how they get around MFA.

Yes, they also can monitor and scan your financial transactions. Accepting their T&C and Privacy Policy gives them too much power, consumers are freely giving away access to their financial information for convenience.

> Accepting their T&C and Privacy Policy gives them too much power, consumers are freely giving away access to their <VERB> information for <THING>

So what? Convenience is nice. And I'm willing to pay for convenience when the other options are far less convenient.

When i used Mint at first, they'd just ask you to go to the page with the caphcha or whatever and go through it when you'd update your accounts with the auth scraper method. This was like maybe a decade ago? You could do a similar thing with mfa in realtime.

My experience using plaid with Schwab, on which I have MFA, is that you need to add an MFA code to your password when connecting the two. It works for some duration (a few days?) and then loses sync and you have to re-enter the password+MFA combo.

Do you literally concatenate the two? I've been wondering how to get plaid to work with my accounts that have MFA.

Nah, Plaid's UI handles it natively. If it's required, Plaid will prompt you during the connection process with the same steps and any questions you'd encounter doing it directly on Schwab's website - "do you want a text or call" and then "enter the code" steps.

they do for CIBC. it's a problem when you change your password and they keep trying to login with your old credentials - your account gets locked.

CapitalOne has (not even just for banking standards) an amazing developer platform. https://developer.capitalone.com

CapOne’s API snd docs, technical customer support and their easy to use VCC generation has kept me with them long after I had expected. Other than Amex they’re probably the only big “bank” I’d recommend (and Fidelity for checking).

Reply on news.ycombinator.com