Planto - HK personal finance and budgeting app

[goodluckduck]

For the past couple of weeks I have been playing around with this personal finance app which links to your various bank / credit card / MPF accounts which also tracks your spending and provides various other insights.

https://www.planto.hk/en/

It’s not perfect but I’ve linked various accounts (HSBC, credit card, IB and MPF) and just being able to see the balances on one dashboard is worth having IMO.

Disclaimer: I have no financial or other interest in this app or anyone behind it and give no warranty express or no implied regarding the same. I just thought it would be of interest to some of the good people here

[traineeinvestor]

A question from the technologically impaired: does using Apps like this increase the risk of your bank account being hacked?

[shri]

A question from the technologically impaired: does using Apps like this increase the risk of your bank account being hacked?

Give me your password and authorisation to log into your account and call you every afternoon with your balance.

To be fair, I don't know how their authorisation works - how does HSBC (or any other bank) give these apps / organisations access to accounts and how does it audit their security? Does HSBC maintain a regularly updated page/site which tells us which are the latest apps that have been approved and when were they audited last?


Have HSBC terms and conditions been updated to ensure that any loss of funds by giving "read" access to these apps will be covered?

Yes, I understand authentication protocols - authentication, trust and authorisation are quite different issues.

[shri]

Also, as cynical as I sound, I read this a few mins after I posted this... there is hope and I remain cynically hopeful.

A completely random tangent follows...

From an article about a book on the lunar landing..

NASA's demand for integrated circuits, and its insistence on their near-flawless manufacture, helped create the world market for the chips and helped cut the price by 90 percent in five years. NASA was the first organization of any kind -- company or government agency -- anywhere in the world to give computer chips responsibility for human life. If the chips could be depended on to fly astronauts safely to the Moon, they were probably good enough for computers that would run chemical plants or analyze advertising data.

[pin]

There is another app like that, which I did actually try. I deleted it though.

I think all banks now say you should not share data with third party apps.

[traineeinvestor]

Original Post Deleted

I'm glad it's not just the old tablet-and-chisel types (like me) who don't trust these things.

[traineeinvestor]

And on the subject of making life easy for hackers this caught my attention recently: https://www.theinquirer.net/inquirer...cryption-again

[Rob2020]

I am not sure at all about this particular company, but it looks like they may be utilising the open banking API which the HKMA have started rolling out this year (just 10 years later than other countries)

https://www.hkma.gov.hk/eng/key-func...approach.shtml

[mrgoodkat]

Give me your password and authorisation to log into your account and call you every afternoon with your balance.

To be fair, I don't know how their authorisation works - how does HSBC (or any other bank) give these apps / organisations access to accounts and how does it audit their security? Does HSBC maintain a regularly updated page/site which tells us which are the latest apps that have been approved and when were they audited last?


Have HSBC terms and conditions been updated to ensure that any loss of funds by giving "read" access to these apps will be covered?

Yes, I understand authentication protocols - authentication, trust and authorisation are quite different issues.

The app should only need your password to access your account for statistic purposes. HSBC requires additional 2FA to transfer money or add third party accounts. Should be secure enough strictly from a "steal your money" point of view. Not sure how securely they are handling your personal data though.

[shri]

Should be secure enough strictly from a "steal your money" point of view. Not sure how securely they are handling your personal data though.

From a pure "steal your money" perspective you're right. However, knowing your full name and other info while they scrape your account transactions is a huge hole in my opinion.