Hacker News Reader

Comment by asciimike | Hacker News Reader

> That's hyperbole. Having a bird's eye view of every single account, transaction, investments, net worth, etc. is "totally useless"? No.

If you can get it to actually connect to things (I have 2FA on most accounts, and since Mint scrapes the sites and stores passwords in plaintext, it doesn't know how to handle this) and tag everything properly (MCC's vary pretty widely). I think that the promise of Mint is great, but in reality it falls apart as soon as you have more than a few accounts, or start using anything that wasn't originally built in (e.g. 2FA).

That all said, I follow the same general principles: autopay everything in full, invest money first, live within my means (with certain exceptions that are the "budget").

View on HN

I just don't understand giving your banking credentials to a third party. Will your bank even cover fraudulent withdraws if you give your login info to Mint?

This is the main reason I stopped using it. The benefit was too low compared to the risk. Once I started using 2FA and realized how it worked I noped right out of there...

My Sparkasse app (Germany) lets me add other bank accounts and the credentials are stored only in the app. I think there's an EU directive forcing banks to have an open API, which makes it work. Much better than screenscraping.

Is there any such trend in the US?

Giving someone read-only access makes more sense. Even better is like what you mention, a program you run, but open source.

I shared your hesitation as well, but I don't think Mint is storing your bank password in cleartext anymore at least for Chase. I just signed up for Mint the other day and did not see anything like this for any of my accounts. For Chase, they specifically use Oauth to grant read access to the account.

For me, my checking account is the only banking account I really care about. So much so that I don't use my debit card for purchases and only use it for ATM. I really don't care if my credit card gets stolen since that's their problem and not money out of my pocket.

> Mint scrapes the sites and stores passwords in plaintext

Incorrect:

> How secure is my login information I store in Mint?

> Your login user name and passwords are stored securely in a separate database using multi-layered hardware and software encryption. We only store the information needed to save you the trouble of updating, syncing or uploading financial information manually.

Ref: https://mint.intuit.com/how-mint-works/security

In other words, Mint doesn’t store your passwords in plain text, it stores them reversibly encrypted. That is indeed better, because if someone hacks Mint’s database they might not be able to read your passwords. However, it has the same problem as plaintext passwords that if someone at Mint is untrustworthy, they can decrypt your password and pretend to be you. That system makes it inconvenient for you to protect your accounts (you would have to memorize new passwords for all of them) and difficult to apply for restitution later (because it looks like you were the one who logged in).

Reply on news.ycombinator.com