Hacker News Reader

Comment by ceejayoz | Hacker News Reader

They do some of both.

When I link a Capital One account, I get an OAuth-style flow and the ability to select which accounts I share directly on the C1 website. The sites I use this on show up as "Linked Apps" in my security settings in C1.

Others use the credentials-based flow.

View on HN

CapitalOne has (not even just for banking standards) an amazing developer platform. https://developer.capitalone.com

CapOne’s API snd docs, technical customer support and their easy to use VCC generation has kept me with them long after I had expected. Other than Amex they’re probably the only big “bank” I’d recommend (and Fidelity for checking).

Where they aren’t using APIs and instead the scrapers, does that mean they have your banking login credentials? Be curious to hear how they get around MFA.

My experience using plaid with Schwab, on which I have MFA, is that you need to add an MFA code to your password when connecting the two. It works for some duration (a few days?) and then loses sync and you have to re-enter the password+MFA combo.

Do you literally concatenate the two? I've been wondering how to get plaid to work with my accounts that have MFA.

Nah, Plaid's UI handles it natively. If it's required, Plaid will prompt you during the connection process with the same steps and any questions you'd encounter doing it directly on Schwab's website - "do you want a text or call" and then "enter the code" steps.

Yes, they also can monitor and scan your financial transactions. Accepting their T&C and Privacy Policy gives them too much power, consumers are freely giving away access to their financial information for convenience.

So what? Convenience is nice. And I'm willing to pay for convenience when the other options are far less convenient.

> Accepting their T&C and Privacy Policy gives them too much power, consumers are freely giving away access to their <VERB> information for <THING>

When i used Mint at first, they'd just ask you to go to the page with the caphcha or whatever and go through it when you'd update your accounts with the auth scraper method. This was like maybe a decade ago? You could do a similar thing with mfa in realtime.

they do for CIBC. it's a problem when you change your password and they keep trying to login with your old credentials - your account gets locked.

Reply on news.ycombinator.com