[GNC-dev] Patelco stopped supporting OFX... other options

[jean laroche]

I'll make sure to report once I try it. I just got my keys, so I should 
be able to give that a shot pretty soon.
J.


On 6/17/2020 5:17 PM, John Ralls wrote:
> Yes, I expect Quicken will eventually succeed in freezing us out.
>
> I can't tell from 10 minutes exploring the Plaid website whether they support bank customers retrieving their account transactions. It's also pretty clear that they expect to be paid for their services. Their free account is for testing and it looks like it croaks after processing 100 items. I can't tell if that means downloading 100 transactions, 100 downloads, or something else entirely in the context of transaction download. It obviously does mean something else in other contexts like processing ACH payments.
>
> Regards,
> John Ralls
>
>
>> On Jun 16, 2020, at 8:21 PM, jean laroche <ripngo at gmail.com> wrote:
>>
>> Thanks John,
>> I agree with you than trying to reverse engineer the Web Connect authentication is probably not going to happen. So does this mean that in the not-to-distant future we'll be left with two choices? Manual download or quicken?
>>
>> What about plaid? Does anybody have any experience with that? Their list of supported institutions include my bank, but I don't know whether they too will be locked out. I plan on giving that a shot. https://plaid.com/docs/faq/
>>
>> J
>>
>>> Jean,
>>>
>>>  From https://www.patelco.org/-/media/patelco/pdfs/member-support/digital-banking-services/express-web-connect_windows.pdf it looks like they switched to OFX Web Connect. Unfortunately that's been the trend for the last 10 years, and I imagine that it's an easy sell to the banks considering the weak security offered by OFX Direct Connect. That also means that switching banks is at best a short-term solution because of that trend: The new bank is likely to do the same thing sooner or later.
>>>
>>> I think the only really feasible workaround is to reverse-engineer the Web Connect authentication. That would mean installing Quicken and setting up and using OFX Web Connect while monitoring the traffic with wireshark. https://redflagsecurity.net/2019/03/10/decrypting-tls-wireshark/ might be helpful for decrypting the authentication traffic with the browser. No doubt the quicken connection will also be encrypted so you'll need to find the keys for that too to be able to interpret the traffic--and working out the key exchange between Quicken and the bank will also be necessary. Frankly I would expect a low probability of success without help from a crypto expert.
>>>
>>> Regards,
>>> John Ralls
>>>