Mint.com in 2010 - Is it Safe?
jasonowens.com
jasonowens.com
> "To date there have been security concerns and questions identified around mint.com."
Journalism should avoid using "there have been" or "some say"; such phrases signal that what comes next will be an unattributed pot shot.
The first attack is on the zip code requirement. "Presumably this means Mint.com ... will not be able to effectively send you email and text alerts."
On the contrary, this FUD statement was preceded by an attributed statement from Mint: "Mint.com requires your Zip code ... to determine the time zone in order to send timely alerts." If you don't give them the right time zone, your alerts will be no less effective, you just might find them more inconveniently timed.
As for the more complex assertion about categorization, that's because business names are local. A business named "Scissors" might be a tailor in my zip, and a salon in yours. Of course it will be hard to correctly categorize when the locale is unknown.
Interestingly, when I reached the end of the article, I saw this reason was clearly provided by the employee, but not mentioned in the article.
Mint wrote that the ZIP "allows the Service to provide you with accurate automated categorization of your spending by improving our ability to identify merchants both nationally and locally."
I agree that most of the article is FUD, though the author does have some valid points in the “Security Posture” section (e.g. Mint ought to validate your email address before they depend on it for recovering an account).
The author suggests the use of challenge questions; I think on the surface that sounds like a great idea, but most challenge questions can be guessed based on what friends/family know or what a person writes online, and the testing I did with user-provided questions showed that users will write obvious questions or even write a question with an answer that is the question itself.
I’m surprised that the author didn’t write more about who has access to the information. I think that’s a very valid question regarding their security and privacy. Additionally, while their data-retention policies seem reasonable (backups and aggregate data), some guidance as to how long those backups are kept and what aggregate data is collected would be informative.
In short: the article is a good attempt to review Mint’s security policies, but I think the author should have done a little bit more investigation.