conversation: User (dangerousminority): "Sorry for the title gore. I noticed this on Chase's home page when I went to login today:\n\nhttps://www.chase.com/resources/guard-your-id-and-password\n\nSeems like they don't think these personal finance tools have the proper security measures in place. I stopped using Mint last year, and disconnected all my accounts from Credit Karma, as I couldn't get a complete financial picture using either of them. \n\nObligatory Edit: Woah, this blew up quickly. \n\nI only use Chase for their credit cards, so I think the $0 fraud liability with VISA would protect me no matter what Chase tries to weasel out of. \n\nAlso, thanks for teaching me that my passwords on Chase.com are not secure, since they don't recognize case-sensitivity. "
  Self: "Why doesn't chase provide read-only account log-ins? Instead of attempting to wipe their hands clean with this (good luck), they should add functionality.\n\nAdditionally, mint is from intuit who does Turbotax which is integrated with many brokerages and banks for tax purposes (you use your login information to pull data down). "
  fauxreality (fauxreality): "The read/view only login portion is a lot tricker than it sounds.  At a huge bank like Chase, the profile creation process on the back end is going to be tied to the account opening process in order to generate login credentials. It's not a quick fix to create the ability to add a 2nd login for the same accounts on a view only basis. \n  \nAs for mint being the same as turbotax, that's incorrect. Mint is *now* owned by intuit, but that was a recent acquisition. I believe last year or maybe 2 years ago.  The software/servers/infrastructure is all still going to be completely separate from turbo tax and intuit's other offerings.  Full Integration on acquisitions like that can take 5-10 years and many times don't happen at all unless they go through a complete rebuild of in house CRM software/databases from the bottom up, which rarely happens.  \n  \nSource: I work tech for a bank. "
  X019 (X019): "Also a tech guy at a bank.\n\nThey could create another login that is paired to the GUID with your account and has read only rights to your database. Yes this is very simplified, but it *is* doable. \n\nSome risks that come up right off the top of my head are: More attack vectors since there's an additional log in (doubling the usernames), more server/database load, (l)users calling in freaking out that they can't do something due to them logging in with the read only account instead of the right account."
  vomitingVermin (vomitingVermin): "What about force.com? When applying for a new account, my credit union sent me to creditUnionName.force.com to input my info. force.com is part of an enormous $60B cloud computing company. Seems like this type of security stuff has been worked out. "
  nobody65535 (nobody65535): "If it's like mine, they use it like a crm and you put in your personal info but not your account info. If yours asks for your password and they aren't using something like oauth, you should start going into the branch to open a new account."
  