6 ms·

Billguard asks for my online bank username and password, it's a deal breaker for me. Do you really trust them? https://medium.com/@hyphenated/mint-com-and-billg

Billguard asks for my online bank username and password, it's a deal breaker for me. Do you really trust them? https://medium.com/@hyphenated/mint-com-and-billguard-are-lying-to-you-6cfda5d4cc14 https://medium.com/@hyphenated/mint-com-and-billguard-are-ly...

berberous 12y ago
Billguard uses Yodlee as a backend, so at the very least I do trust that Billguard only has read-only access. I'm less certain how Yodlee functions -- whether they just scrape data and have full access, or whether they get some sort of read-only token from the financial institution.
- memset 12y ago
  I am not familiar with Yodlee, but I recently discovered that many banks support OFX [1], which is a format for exchanging financial information. GnuCash has a list of OFX credentials for major banks. [2] In fact, there are tons of OFX open source libraries out there - I had luck with this one recently in Python. [3] [1] http://en.wikipedia.org/wiki/Open_Financial_Exchange http://en.wikipedia.org/wiki/Open_Financial_Exchange [2] http://wiki.gnucash.org/wiki/OFX_Direct_Connect_Bank_Settings http://wiki.gnucash.org/wiki/OFX_Direct_Connect_Bank_Setting... [3] https://github.com/captin411/ofxclient https://github.com/captin411/ofxclient
  - marveller 12y ago
    Thanks for the references. After some research, I decided to go with YNAB http://www.youneedabudget.com/ http://www.youneedabudget.com/ it has a desktop and mobile apps and uses your dropbox for syncing data.
- raphael_o 12y ago
  BillGuard indeed has only access to data in a read-only fashion. Yodlee does have a mix of web scrappers as well as data feeds for certain financial institutions. They power different features for banks such as bill payment and others but companies like BillGuard don't have access to these APIs. On its end, Yodlee is heavily regulated. Like a bank and sometimes even more: http://www.yodlee.com/yodlee-security/ http://www.yodlee.com/yodlee-security/
iancarroll 12y ago
Stealing the key should be impossible, it should be on an HSM (which performs the cryptographic operations for you instead of giving you a key) That's only one part of the article though.

berberous 12y ago

Billguard uses Yodlee as a backend, so at the very least I do trust that Billguard only has read-only access. I'm less certain how Yodlee functions -- whether they just scrape data and have full access, or whether they get some sort of read-only token from the financial institution.

memset 12y ago
I am not familiar with Yodlee, but I recently discovered that many banks support OFX [1], which is a format for exchanging financial information. GnuCash has a list of OFX credentials for major banks. [2] In fact, there are tons of OFX open source libraries out there - I had luck with this one recently in Python. [3] [1] http://en.wikipedia.org/wiki/Open_Financial_Exchange http://en.wikipedia.org/wiki/Open_Financial_Exchange [2] http://wiki.gnucash.org/wiki/OFX_Direct_Connect_Bank_Settings http://wiki.gnucash.org/wiki/OFX_Direct_Connect_Bank_Setting... [3] https://github.com/captin411/ofxclient https://github.com/captin411/ofxclient
- marveller 12y ago
  Thanks for the references. After some research, I decided to go with YNAB http://www.youneedabudget.com/ http://www.youneedabudget.com/ it has a desktop and mobile apps and uses your dropbox for syncing data.
raphael_o 12y ago
BillGuard indeed has only access to data in a read-only fashion. Yodlee does have a mix of web scrappers as well as data feeds for certain financial institutions. They power different features for banks such as bill payment and others but companies like BillGuard don't have access to these APIs. On its end, Yodlee is heavily regulated. Like a bank and sometimes even more: http://www.yodlee.com/yodlee-security/ http://www.yodlee.com/yodlee-security/

iancarroll 12y ago

Stealing the key should be impossible, it should be on an HSM (which performs the cryptographic operations for you instead of giving you a key) That's only one part of the article though.