Mint.com should be a platform | Hacker News Reader

Mint.com should be a platform

jonah.org

29 pointsjblochjohnson17 comments

I couldn't agree less.

Mint.com is a trusted holder of a LOT of financial data. They should not in any way be a platform.

(To be clear: I work with Jonah, so I share his concerns.) I think jonah skimped on one big point: Mint.com as a service is a security feature.

I want to give some financial information to company X. Right now: The way that I do this is by giving that company ALL OF MY SECRET FINANCIAL INFORMATION. Being able to granularly release only a relevant fraction of my information to a third party is much better.

Sure: Giving secret information away without users' consent (a la google buzz): Bad idea. In this case: That's not the point.

I wouldn't want anyone to be able to pull data from my Mint account, but it would be infinitely useful if they could push data to it.

Ahh ... isn't Mint build off a platform that allows it to do all of the fancy secure financial banking login and information sharing?

In the context of this article, I'd call Yodlee a library, not a platform. He wants to add data to Mint like application developers add data to Facebook. Mint doesn't do anything like that with Yodlee.

How does anyone decide to trust mint.com? It gives me the security hebbie-jebbies and all their claims of security assurances make the jebbies worse. They're still storing accounts and passwords in a form that can be recovered as plain text, right? I would slap any family members that use it and I'm a Buddhist.

When you enter a username and password, they authenticate them with the bank, and receive a token. They store that token, not your credentials.

If I remember correctly, Mint is owned by Intuit, and subject to regular audits by the banks they've partnered with. Considering the relative quality of banking websites, I feel more secure checking my balance on Mint than via the official portal.

And if they try anything, I'll be talking to my bank's fraud department within the hour.

Better off building it with the standards that mint.com uses, that would be OFX or Open Financial Exchange. Now that mint is at intuit they might not be as agile. Also there are pretty big security issues that OFX have solved. Maybe mint.com could expose your data via OFX.

Mint does have providers that they get the OFX data from, these are pluggable. But the product that is mint is all the metadata about the purchases not just the exchange. I can see how this would be beneficial but also how it might harm mint's reputation if anything were to happen with failed security.

mint is built off of yodlee's service (http://yodlee.com/) which does all of the communication with banks. i'm not sure if they're even using OFX anymore because they don't authenticate the same way (mint doesn't require your bank logins).

I didn't realize mint used a third party (Yodlee) for that. Currently many banks only provide that type of access (OFX). I use mint and it requires bank logins though...

Looks like Yodlee uses OFX and screen scraping? Doesn't seem so safe: http://news.ycombinator.com/item?id=830236

I remember hearing a rumor once that Yodlee had any army of employees whose primary job was to update the screen scraping scripts. Make no mistake - getting this data out is very messy. but given a choice between messy and not having it at all, I'd settle for messy :-)

Whether or not it's mint or some middleware, the point is: There're lots of interesting thing you can do with pieces of financial data. There are also lots of security implications. Handing the security problems off to one company (say, mint) and still being able to have access to all the metadata (without the ability to, say, leak your customers' account data) would be dandy. From a consumer standpoint: That's much better than giving all of that secret information to every company that's interested in accessing it.

I don't think mint should add any features like the ones discussed in the article.

I currently use mint and am very happy with it. I chose to use mint.com over some other sites with similar features because of its simplicity. I find the interface and features incredibly intuitive and easy to use. I think that allowing developers to create "apps" for mint.com could potentially pollute the interface and add a lot of unnecessary confusion to the whole service.

This is part of the reason why stores have "frequent shopper" cards — to help understand what people in their stores are buying.

I've done BI/BA work with an agency for major big box retailers (let's call them HomeBuyColaCo). You'd think they'd be monetizing the poop out of that data, but they're not using the data anywhere to the level they could be, should be, or most people think they are.

like...blippy?

What mint should be is a bank not a platform.

Reply on news.ycombinator.com