P2P banks, 1 line of code | Hacker News Reader

P2P banks, 1 line of code

blog.dwolla.com

Not sure why all the comments here are harping on the "one line" thing.

The point is that you can transfer money with one command and no pre-existing state. That's pretty great.

And no security. That's not so great.

EDIT: What I mean by this is that if you give me your account number so that I can deposit into it, then I can also withdraw out of it (not through the Dwolla API, but trivially by other means -- see http://perimetergrid.com/wp/2008/01/01/checks-the-most-dange...)

It's a problem with ACH in general. However, debits from consumer accounts (or, more accurately, those initiated with a "PPD" code) can be refuted for something like two years.

By submitting a file straight to the networks, I could also debit a nonexistent account for $20m and have it show up in my account the next morning. Wouldn't hang around for long though.

You can always refute it. Whether you'll get your money back or not is an entirely different matter. The consumer protections on ACH are much weaker than credit cards, so it's pretty much up to the discretion of your bank.

It's not that their that much weaker. You have 60 days as an individual to dispute a debit, but it's seriously painful. You will likely have to go into a branch and fill out a physical document. In comparison, Amex has a link that says "dispute" next to each transaction.

This is an inherent flaw in the system though, right? Not anything new.

Not quite. This makes ACH more accessible than it was before, which makes it that much easier to commit ACH fraud. Also, it is possible to layer a secure layer on top of ACH, but Dwolla didn't do that. They either chose not to, or they don't know how. They just exposed the ACH functionality directly.

Because people can feel there's something deeply wrong with this, but can't quite pinpoint what it is. They've forgotten that the whole philosophy of the Internet [SRC81] was to get rid of middlemen, not just to create new ones.

Great. If you get a timeout, though, what do you do? You will either end up with the possibility of double transactions or no transactions, depending on how you try to recover...

Is anyone else annoyed at the mix of parameter naming conventions, or is it just me? (e.g. client_id, emailAddress, client_secret, firstName).

If by mixing conventions you mean careless foul practice of trying to please everyone by partially satisfying all of their preferences which only ends up annoying them all, then I am certainly against it. But, if by mixing conventions you mean the joyous unsegregated joining of every person's vision into a creation that is greater than the sum of its parts, then I am certainly for it. This is my stand. I will not retreat from it. I will not compromise.

What an insufferably obnoxious response.

I've got to remember this marketing spin. "A curl to an http endpoint with a plethora of parameters" == Only 1 line of code!

It's similar to many jQuery plugins I've seen. "LOOK, you can do all this with one line of code!"

    $("#mydiv").someplugin();

But then they show all the HTML adjustments you have to make to get the plugin functioning. Just tell me straight!

But, credit to the author, I always like seeing how people use the command line to accomplish things. One day, I'd like to make a "get_subs" command that orders Jimmy Johns for me.

We (Balanced - YC W11) did the same thing :/. We'll I guess we called it a single curl command not a single line of code:

http://news.ycombinator.com/item?id=5026802

It's not really "P2P" if it's going through a central authority...

P2CA2P?

If only "2CA" was an identity.

Conveniently arranged here in our article in 15 lines!

How is this different from saying that communication via Switft messages is really only one line of code at the end that's important?

I prefer Bitcoin

I'm waiting for someone to create a service on top of this. Think Stripe for ACH transfers.

I badly want to use this but the required BSA/AML and CIP compliance are too much for my startup. I would gladly pay someone to handle this compliance and just let me call an API.

Balanced is discussing this here: https://github.com/balanced/balanced-api/issues/2

We're thinking we'll have a beta in a few weeks time.

1. Create fraudulent product page with billing form.

2. Add 1 line of code

3. ...

4. Profit!

"No, at this time Dwolla is only available for use within the United States." That is unfortunate, would have liked to try it out.

1 line of code in marketing speak.

yay, easier fraud and still no guarantees against chargebacks or merchant protections

Looking for where someone mentions http://www.opentransact.org but can't find it so I'll mention it.

Bruce Schneier would be proud.

It's good to see the world catching up and putting the emphasis on security.

[/sarcasm]

Because curl and a command line with 13 "arguments" is so much easier to use than a website.

Because writing a program to simulate a person using a web site is so much easier to do than calling an API.

er, what? this is an API for developers, not an out-the-box solution for clients.

Reply on news.ycombinator.com