Banking Technology is in Dire Need of Standartization and Openness
[caption id="attachment_272" align="aligncenter" width="300"]
Old Bank
Photo credit Toby Dickens[/caption]
A few weeks ago Investors Bank in New Jersey overhauled their systems. As a result Mint became incompatible with Investors and Investors customers could no longer view their account in Mint. There is anecdotal evidence1 that Mint uses the Yodlee platform2 for the integration. As it turns out, there is no standard mechanism by which external applications can work with banks. Yodlee's own page states:
While the technology world is moving towards open APIs and standard authentication protocols3 the banking industry continues to rely on proprietary systems and HTML screen scraping. It seems that even using Yodlee platform it is not possible to integrate with banks in any standard way. Each time a bank updates their systems a team of engineers at Intuit must update integration scripts to ensure their customers can continue to use Mint with that bank4:
The way Mint integrates with banks is by asking users to enter and store their bank credentials. Mint expects us to trust their security5. The technology industry, however, has long established a protocol by which an application (like Mint) needing access to an outside resource (a user's bank account) does not need to capture user's credentials. It is called OAuth6.
Had banks implemented OAuth, mint would use the protocol to obtain an authorization from the user to act upon the bank's API on behalf of the user. In the event of a security breach at Mint it would be possible for the banks to invalidate all tokens -- and disable all further access by Mint. Users would gain control over which applications they want to access their data and which they do not.
In 2015 there is no need for HTML screen scraping or proprietary technologies. Would Yodlee platform even be around if the banks used OAuth and standard API7 ? This is an industry that is in dire need of innovation. Banks need to learn how to recruit and retain top talent from the technology companies, not the other way around. They need to look beyond their traditional well accepted consulting vendors and service providers and think outside the box -- especially considering the fact that the technology challenges they face have already been solved by others.
Old BankPhoto credit Toby Dickens[/caption]
A few weeks ago Investors Bank in New Jersey overhauled their systems. As a result Mint became incompatible with Investors and Investors customers could no longer view their account in Mint. There is anecdotal evidence1 that Mint uses the Yodlee platform2 for the integration. As it turns out, there is no standard mechanism by which external applications can work with banks. Yodlee's own page states:
Through a proprietary system of direct data access and HTML parsing, Yodlee delivers financial data from more than 14,000 sources, and growing.
While the technology world is moving towards open APIs and standard authentication protocols3 the banking industry continues to rely on proprietary systems and HTML screen scraping. It seems that even using Yodlee platform it is not possible to integrate with banks in any standard way. Each time a bank updates their systems a team of engineers at Intuit must update integration scripts to ensure their customers can continue to use Mint with that bank4:
When a financial institution updates their system, our engineers have to rewrite the script on our end to match so that we can continue supporting them. Typically, they are notified when this is going to happen and can get it updated pretty quickly. However, please open a ticket by filling out our Contact Mint form to make sure this is on their radar and they can get the script updated as soon as possible.
The way Mint integrates with banks is by asking users to enter and store their bank credentials. Mint expects us to trust their security5. The technology industry, however, has long established a protocol by which an application (like Mint) needing access to an outside resource (a user's bank account) does not need to capture user's credentials. It is called OAuth6.
Had banks implemented OAuth, mint would use the protocol to obtain an authorization from the user to act upon the bank's API on behalf of the user. In the event of a security breach at Mint it would be possible for the banks to invalidate all tokens -- and disable all further access by Mint. Users would gain control over which applications they want to access their data and which they do not.
In 2015 there is no need for HTML screen scraping or proprietary technologies. Would Yodlee platform even be around if the banks used OAuth and standard API7 ? This is an industry that is in dire need of innovation. Banks need to learn how to recruit and retain top talent from the technology companies, not the other way around. They need to look beyond their traditional well accepted consulting vendors and service providers and think outside the box -- especially considering the fact that the technology challenges they face have already been solved by others.
- How does mint.com connect to online banks in order to get or download transaction data? ↩
- Yodlee Platform ↩
- 5 ways APIs will be the workhorses of 2015 ↩
- Mint support: Mint can not sync with my investors savings bank account ↩
- Should You Trust Mint.com? ↩
- OAuth ↩
- The Future Of Coding Is Here, And It Threatens To Wipe Out Everything In Its Path ↩