undefined | Better HN

0 pointscurun1r10y ago0 comments

My main concern in using sites like this is that they'll leak my banking credentials. Mint uses Intuit's service for communicating with financial institutions, which is also used for Quickbooks and TurboTax. Credentials are encrypted and housed in a datacenter owned by Intuit. The Mint application only ever stores a token representing the account and uses the service to pull transactions from a read-only service. While I'm still uneasy about this setup, the isolation of the systems combined with the scale and the resources devoted to keeping it secure provide some piece of mind.

Can you talk about the measures that you use to protect banking credentials so that I might feel similarly safe about giving them to your service?

0 comments

dontmitch10y ago

There are actually three major players in the transaction aggregation space: Intuit, Yodlee, and Plaid. We use Plaid, but it works the same as Intuit. In fact, Plaid has a partnership with Intuit to backfill support for bank accounts.

We never store any credentials on our system, and our access is read only. I can go on for days about why I think our system is more secure than, say, Chase[0], but if you trust Mint's practices it's probably sufficient to say that we use an almost identical system.

[0] https://en.wikipedia.org/wiki/2014_JPMorgan_Chase_data_breac...

curun1rOP10y ago

Thanks! That was exactly what I wanted to know.

kvcrawford10y ago

That's... moderately comforting. I recently started using Mint and it's proving very helpful for tracking my spending and budgets. It's really worrying having to hand over my bank account username and password, though.

I really wish banks could provide a read-only API token instead.

sdrider10y ago

Good ones do. I use CapitalOne360 as my primary bank exactly for this reason.

j / k navigate · click thread line to collapse