Hacker News Reader

Comment by dontmitch | Hacker News Reader

Mitch here, one of the co-founders.

I don't want to throw Mint under the bus: I used it for ~6 years before starting to work on Penny and it's a great tool for people that enjoy spreadsheets and crunching numbers (myself included). That said, it can be pretty intimidating to just to about everyone else. Penny requires a lot less effort on your part, since the number crunching is all done behind the scenes to generate cool insights.

To answer the specific question of why _you_ might switch: Mint hasn't really improved beyond the addition of more ads in the past four to five years. It's painfully slow (at least for me) and still has not learned that my gym membership is not software.

View on HN

My main concern in using sites like this is that they'll leak my banking credentials. Mint uses Intuit's service for communicating with financial institutions, which is also used for Quickbooks and TurboTax. Credentials are encrypted and housed in a datacenter owned by Intuit. The Mint application only ever stores a token representing the account and uses the service to pull transactions from a read-only service. While I'm still uneasy about this setup, the isolation of the systems combined with the scale and the resources devoted to keeping it secure provide some piece of mind.

Can you talk about the measures that you use to protect banking credentials so that I might feel similarly safe about giving them to your service?

There are actually three major players in the transaction aggregation space: Intuit, Yodlee, and Plaid. We use Plaid, but it works the same as Intuit. In fact, Plaid has a partnership with Intuit to backfill support for bank accounts.

We never store any credentials on our system, and our access is read only. I can go on for days about why I think our system is more secure than, say, Chase[0], but if you trust Mint's practices it's probably sufficient to say that we use an almost identical system.

[0] https://en.wikipedia.org/wiki/2014_JPMorgan_Chase_data_breac...

Thanks! That was exactly what I wanted to know.

That's... moderately comforting. I recently started using Mint and it's proving very helpful for tracking my spending and budgets. It's really worrying having to hand over my bank account username and password, though.

I really wish banks could provide a read-only API token instead.

Good ones do. I use CapitalOne360 as my primary bank exactly for this reason.

Reply on news.ycombinator.com