Comment by gingerlime | Hacker News Reader

Comment by gingerlime | Hacker News Reader

Parent Full thread

The most useful thing I have is a little script that logs into my bank, downloads a CSV and sends me the latest transaction via email daily. Saves me time to login to online banking, and also serves as a useful way to search for previous transactions inside my mailbox from time to time.

Besides that I use Home Assistant[0] with a few simple automations. For example, when the lights are on in the bathroom, and it's after dark, increase the heating/towel warmer (using Tado[1]).

Tado has its own home/away detection, plus some schedule for the heaters. It's supposed to save on energy costs.

When we're on holiday, I switch on/off various lights (with some random offset) at night... Or some times I might leave a radio on timer / connected to an IoT power switch. (I don't use any burglar alarms, cameras etc, but I try to deter them with those simple fake occupancy tools)

Philips Hue has a nice way to slowly turn the lights on. Useful to wake up during the dark winter months.

[0] https://www.home-assistant.io/

[1] https://www.tado.com/

For your banking script, are you able to use an API with a limited access token? Or does it use your normal credentials. I don't save my various banking credentials anywhere, not even 1password, as they're so sensitive, curious how you do this.

Your banking password isn't that sensitive, because banks are used by regular people who don't have any conception of good security practices. The worst case scenario of your bank login credentials leaking are really not that bad.

Your personal email account is probably a million times more sensitive. It contains enough personal information to get your identity stolen a thousand times over, and once your email has been compromised there is no way to ascertain the damage.

Couldn't agree more. See my comment above. My online bank only provides readonly access with a password. Anything else requires a one-time-password anyway.

I'd be much more worried about my email getting hacked though.

Your banking password isn't that sensitive, because banks are used by regular people who don't have any conception of good security practices. The worst case scenario of your bank login credentials leaking are really not that bad.

Huh? The worst case scenario of your bank login details is... someone depositing all your money to their account, surely.

Nope, the login in (some? many?) banks is just a first step, to actually perform transactions they require a second stage auth. Most they can do is transfer money to some of my family members (I've disabled the second stage for a few specific destinations).

Most banks request a second auth factor (SMS, code, phone call) before executing a transfer to a new recipient.

I don't hear often about banks providing API access. Only big companies on special contracts may get something like that, but it is usually very limited - talking from my personal experience, but what I learnt from the internet - it's the same everywhere.

But... In Europe thanks to just another EU laws we should have every bank offering an API access for everyone starting from September 2018 IIRC. That would help a lot with automation, I hope generating few api keys with different access permissions would be possible with that.

I'm going to be so amazed if the API (PSD2 if you want to Google it) turns out to be what we want.

I'm fully expecting banks to throw extreme security hurdles and probably registration fees in the way if they can.

Hopefully I will be wrong.

PSD2 is not what you think it is. It has API access, but not for the end user. Only 'integrators' will have access to these APIs. You will need to request permission to write/deploy software using the APIs. This involves massive bureaucratic overhead and in some cases permission from your country's national bank.

Automated GDPR requests for personal data...

Can you please give some more info about this eu regulation? I'm really interested to see if my bank has an API in place.

Look up PSD2 regulations.

There is a system for integrating with larg(er) corporate banking software, but here it seems to require a smartcard, likely with a PIN, and no way to restrict it to be readonly. It's horrible XML protocol stuff though.

My bank gives only readonly access by default with the username/password. Any transaction (transfer, operation) requires a one-time pin (TAN) anyway. So I'm not particularly worried about leaking my password.

I wish they had an API but I just use a selenium script essentially. Luckily(?) logging in to this particular account only requires user/password and no fancy codes etc. I guess when the system is built with readonly default and OTP for anything else, then the login can be kept simple.

> a little script that logs into my bank

I've wanted to do something like this for so long but it just seems so painful. How do you do this with just a little script when there's so much Javascript involved in the page, as well as random interjections like random extra security verification steps? Do you have a particularly scrape-friendly bank?

Try to watch network requests in developer console of your browser. Sometimes there's a simple REST interface behind that JavaScript and all you need is to login and issue one request. Extra security verification steps probably won't let you do that, though, if implemented correctly.

You can emulate a user driven browser using a headless instance of Chrome. Look up some “chromedriver” tutorials. Hooks together nicely with Selenium.

In theory, yeah. I actually did try Selenium and Chrome several months or maybe a ~year ago. I don't remember exactly what the pain points were but I remember it was really painful to figure out how to get it to work. Everything from figuring out how to inject JS into a page to figuring out how to wait for events, etc. it was just a massive pain. I don't think I ever figured it out entirely.

I really want to like Home Assistant, but at least on Windows there's some gnarly concurrency issues with it the last time I looked: it launches two Python processes and one of them fails every time.

Also, there was no auto-discovery of LIFX lights and I was told I needed to re-implement the LIFX protocol from scratch because no extra dependencies were allowed in the discovery module.

Reply on news.ycombinator.com