Could mint.com be more secure, and if so, how?

Question

After reading a bit about mint.com on the money stack exchange, I wanted to give it a try. But frankly, it scares me a little bit.

The site has a bunch of links explaining how they're so secure. I bet it's all true and I believe them that they take a lot of security measures. But one thing is misleading. They act like the site is safer because it is "read only". From their security page

Mint is a "read-only" service. You can organize and analyze your finances,
but you can't move funds between–or out of–any account using Mint.
And neither can anyone else.

That's not what I'm worried about. The thing I'm worried about is if somehow someone steals my passwords to my banking sites. Then they can go and do stuff with my accounts.

This got me thinking, is there something better we could push for to make this kind of service more secure? A few things I can think of off the top of my head that might be on the right track:

1. one-time passwords / two factor authentication. I think the main problem with this is that all the services mint is accessing would need to work off the same one-time passwords so that the user would not have to enter each one for n services. This means you need a third party to handle this.
2. Push instead of pull. Other sites would have to add a mechanism to export data to mint. Obviously tough for mint because it requires cooperation -- but seems great for the consumer.
3. Getting special auth tokens to give to mint instead of my passwords. Potentially support a mechanism for mint to be able to prove its identity so you only someone who proves they are mint.com can use the token (so stealing the token is not useful unless you can prove you are mint.com)... I guess I'm in OAuth territory here?

I suppose other things that would make me feel better but aren't truly more secure: if all these money/banking sites could send access notifications. Then I might be able to know when mint is accessing vs someone who stole my data and I might have a fighting chance at reacting.

So I suppose I'm asking: what are your ideas on how this could be better? What would the perfect system look like if all these companies would cooperate? Is there a standard protocol for this kind of thing that could become more widespread so that more specialized services could sprout up like this and people could rest easy knowing their data is safe?

(FWIW, I might try it out anyways. If I do, I'm changing all my passwords just for this experiment, then changing them all again once I'm done trying it out.)

Answer 1

So I just signed up with mint.com and think a combination of Ramhound and this.josh's answers are correct.

For well-supported banks (e.g., I tried ING direct), when you add your account to mint.com you typically give out your account number, plus an "access code" that isn't your typical password. An access code allows financial management tools like mint.com to have read only access to your account information; see: http://helpcenter.ingdirect.com/Topic.aspx?category=FINANCE1

For my small local credit union (9 total branches), mint.com seemed happy to let me add that account as well. However, for this bank they wanted my account number and my password. I am hesitant to give them this, as my password would need to be stored in cleartext (even if its encrypted; for mint.com to be able to use it, the site must be able to unencrypt it and thus any malicious admin their could do something with it) and would be giving mint.com my full online account permissions. Granted, a malicious administrator/hacker who got into mint.com could just as likely be a malicious admin who got into chase.com and managed to do things with my account.

EDIT: Upon further checking; it seems ING direct is the exception -- most types of accounts I've tried (even for big banks like chase) seem to want my passwords.

EDIT2: Anyhow, I decided to give mint.com my account passwords (they are not used anywhere else); I let them authenticate, and then immediately changed my passwords for those banks. Even after the password changes (which do not let me login with the old passwords), I am able to refresh my balances on mint.com despite never giving them the new password; so it seems that they are not using my passwords to login each time (as I initially feared). It seems like they used the passwords to initially create some sort of read-only access code that they can access. (see edit 3)

EDIT3: So apparently they do store your passwords in a recoverable way and use them to authenticate. If you change your password; it stops working. Its funny because; say I set up mint.com at ~10am yesterday; changed passwords at ~10:15am; and at 11:00am could request mint.com to refresh and it appeared to update successfully; however at 6pm I couldn't refresh my accounts. However, when I tried logging in last night it couldn't login to the accounts with the changed passwords and started complaining about authentication. So either the password changes are delayed syncing through the bank's system (e.g., mint.com's read-only login method versus a user's login method) or mint.com will lie about a refresh being successful if you've refreshed your accounts very recently.

I should mention that both banks use a form of two-factor authentication; e.g., first I have to register a computer with questions like "Mother's maiden name/father's middle name" and then can enter my credentials. mint.com doesn't seem to need any information about these security questions; only want my current login credentials. So to get their read-only access they seem to have an alternate login metchanism, that is potentially read-only. However, as security questions have the potential to be able to be researched or guessed, I doubt I'll be using their services.

Answer 2

From what I can see this appears to be an aggregator for financial services. For it to have any useful function, that implies it must, at least temporarily, store your account details and authentication credentials - in which case it is far from "read-only". That the providers then state the exact opposite in the security statement makes me think these are not people to be trusted with my account details regardless of how sophisticated their controls are.

Ramhound suggests that mint.com uses an oath like system - but that still uses a temporary surrogate token for authentication. Ramhound also states You never give Mint your banking information yet the first question in the FAQ is Why does Mint need my bank login information (username and password)?. The FAQ goes on to explain how mint stores this data.

Such aggregation does have an intrinsic value, and one way to add value to such a service would be to provide better authentication security than that enabled on most financial service providers websites - but obviously this is not the case for mint.com. There's also a question of whether such a provider is subject to the same legislative constraints as a source provider.

But unless you're the guy who writes the mint.com software, isn't a question of what it should be like pure speculation?

Answer 3

is there something better we could push for to make this kind of service more secure?

No. I realize that this was a rhetorical question, so give me a few lines to explain.

• mint.com is fundamentally a online service

• mint.com is a business focused on maximizing profit

• security risk mitigation is expensive both in cash outflow and in training, maintenance, administration, and other operational costs

• distributing security risk to individuals makes good business sense

A always online service which holds financial information has maximal exposure. It is always available from any location which can make an internet connection, and these days that is almost anywhere in the world.

It has a high value for adversaries. Financial information is one of the most valuable assets a criminal can steal. This means that all types of threats internal and external will attempt to compromise the mint.com security system. The more skillful and experienced the attacker, the harder it is to defend against them.

They appear to be focused on technical measures.

This is by far the worst indicator. If the history of computer and network security has taught us anything it is that people and policy are more critical to system success than any technical measure.

What should be on their security page:

• Every mint.com employee has passed a background check with specific emphasis on financial questions. Employees are rechecked every three years (or other reasonable period).

• mint.com's policy is to reduce the individual risk of every user and we insure against individual losses up to $10,000,000 (or some very large value)

• mint.com has developed all software used for operation, administration, and maintenance internally and none of the software has been developed by a third party.

• mint.com performs computer and network security check every quarter (or other reasonable and the results of those checks are published to every mint.com user

• mint.com does not use third parties for any security critical work.

1. one-time passwords / two factor authentication.

Authentication could be more secure, but you have to balance that with ease of use and cost. If authentication technology costs too much then the business can not afford to use it. If it is too hard to use then users will either leave mint.com or circumvent the technology.

Passing authentication responsibility to a third party is expensive and potentially dangerous. The third party must be as secure a company as mint.com or moving the authentication makes no sense.

1. Push instead of pull.

This is extremely dangerous as it has the potential for misdirection. An adversary who could masquerade as mint.com for a short period of time could easily acquire financial information from many institutions and for many individuals. Often ease of information flow is in opposition to the confidentiality of the information. The easier it flows the harder it is to secure.

1. Getting special auth tokens to give to mint

Authentication is done three ways: something you know (password), something you have (cryptographic token, physical key), or something you are (biometrics). Cryptographic authentication provides more security in a challenge response protocol than in a unidirectional transfer. Ideally you want a two way challenge response in which both parties are authenticated.

Answer 4

That's not what I'm worried about. The thing I'm worried about is if somehow someone steals my passwords to my banking sites. Then they can go and do stuff with my accounts.

If this happens...They are not going to get it from Mint, since Mint, never actually knows your password.

You never give Mint your banking information. They use a service similar to OAuth. Its the same system the yearly tax program uses to download your information. Mint also does not display your full account information.

I have used this service for almost 2 years. When I first added my account, I was given an Bank of America overlay window over the Mint.com website.

I suppose one could verify how secure their system is by changing the bank password, then trying to refresh your account on Mint.com, if it works like I think it does your account information will still be updated.

I should add the system that Mint uses was not designed by them, it was designed by the banking system, and from my understanding every supported bank uses it. This is of course the reason you cannot add "any" bank.

They have to be able to communicate with the bank.

Answer 5

Addressing the problems you outlined would require support from banks. It's not something Mint can do on their own.

If banks wanted to support this, they could provide OAuth access to their customer's information, and provide a way to give Mint an OAuth token that grants it read-only access to your account. That would be a secure way to go, and it would ensure that even if Mint is compromised, the bad guys cannot steal your money (they can view confidential information about your transactions, but not initiate new transactions). However, that would require banks to change their systems.

For more details about this issue in a broader context, see also Are there a standard method(s) for me to give someone else read-only access to my data?.