Hacker News Reader

Comment by marveller | Hacker News Reader

Billguard asks for my online bank username and password, it's a deal breaker for me. Do you really trust them? https://medium.com/@hyphenated/mint-com-and-billguard-are-ly...

View on HN

Billguard uses Yodlee as a backend, so at the very least I do trust that Billguard only has read-only access. I'm less certain how Yodlee functions -- whether they just scrape data and have full access, or whether they get some sort of read-only token from the financial institution.

I am not familiar with Yodlee, but I recently discovered that many banks support OFX [1], which is a format for exchanging financial information.

GnuCash has a list of OFX credentials for major banks. [2] In fact, there are tons of OFX open source libraries out there - I had luck with this one recently in Python. [3]

[1] http://en.wikipedia.org/wiki/Open_Financial_Exchange

[2] http://wiki.gnucash.org/wiki/OFX_Direct_Connect_Bank_Setting...

[3] https://github.com/captin411/ofxclient

Thanks for the references. After some research, I decided to go with YNAB http://www.youneedabudget.com/ it has a desktop and mobile apps and uses your dropbox for syncing data.

BillGuard indeed has only access to data in a read-only fashion. Yodlee does have a mix of web scrappers as well as data feeds for certain financial institutions. They power different features for banks such as bill payment and others but companies like BillGuard don't have access to these APIs.

On its end, Yodlee is heavily regulated. Like a bank and sometimes even more: http://www.yodlee.com/yodlee-security/

Stealing the key should be impossible, it should be on an HSM (which performs the cryptographic operations for you instead of giving you a key)

That's only one part of the article though.

Reply on news.ycombinator.com