<story><title>I didn&apos;t get paid, so I open-sourced my client’s project</title><url>https://github.com/TrillCyborg/onefraction</url></story><parent_chain><item><author>burlesona</author><text>Yes, but this is increasingly common in online services. Reputable services like Wealthfront also work like this, requiring your bank login to work. The fact that Plaid has their entire business built around providing “bank logins as a service” speaks to that.&lt;p&gt;I don’t like it either, but I’m not sure how you could get archaic banks and low-tech consumers to adopt something better.</text></item><item><author>Animats</author><text>This thing &lt;i&gt;wants the password for your bank account?&lt;/i&gt; WTF? That&amp;#x27;s way more than it needs. Enough info to authorize an ACH transfer, maybe. But the &lt;i&gt;login password for your bank account?&lt;/i&gt; No way.&lt;p&gt;That voids Bank of America&amp;#x27;s security guarantee.[1] If you provide info for an ACH transfer, and the other party abuses that info, it&amp;#x27;s reversible. If you provide login info and the other party abuses that info, it&amp;#x27;s not.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.bankofamerica.com&amp;#x2F;online-banking&amp;#x2F;online-banking-security-guarantee&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.bankofamerica.com&amp;#x2F;online-banking&amp;#x2F;online-banking-...&lt;/a&gt;</text></item></parent_chain><comment><author>textfoo</author><text>I work at a bank that has a vendor that uses client credentials in order to html scrape their account pages. Most banks refuse to generate consumable methodologies for other financial services to use their data, so they go about it the hackiest way possible.</text></comment>
<story><title>I didn&apos;t get paid, so I open-sourced my client’s project</title><url>https://github.com/TrillCyborg/onefraction</url></story><parent_chain><item><author>burlesona</author><text>Yes, but this is increasingly common in online services. Reputable services like Wealthfront also work like this, requiring your bank login to work. The fact that Plaid has their entire business built around providing “bank logins as a service” speaks to that.&lt;p&gt;I don’t like it either, but I’m not sure how you could get archaic banks and low-tech consumers to adopt something better.</text></item><item><author>Animats</author><text>This thing &lt;i&gt;wants the password for your bank account?&lt;/i&gt; WTF? That&amp;#x27;s way more than it needs. Enough info to authorize an ACH transfer, maybe. But the &lt;i&gt;login password for your bank account?&lt;/i&gt; No way.&lt;p&gt;That voids Bank of America&amp;#x27;s security guarantee.[1] If you provide info for an ACH transfer, and the other party abuses that info, it&amp;#x27;s reversible. If you provide login info and the other party abuses that info, it&amp;#x27;s not.&lt;p&gt;[1] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.bankofamerica.com&amp;#x2F;online-banking&amp;#x2F;online-banking-security-guarantee&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.bankofamerica.com&amp;#x2F;online-banking&amp;#x2F;online-banking-...&lt;/a&gt;</text></item></parent_chain><comment><author>m-p-3</author><text>Yeah, unless banks provide oAuth or APIs to get that information securely and easily revokable, I guess that&amp;#x27;s the best we have.</text></comment>