Title: The end of BlueVestment?
Post by: Nathan on August 20, 2014, 11:00:00 PM
Post by: Nathan on August 20, 2014, 11:00:00 PM
Attached is the new Lending Club Commercial API Access Agreement.
This is what was sent to myself and a few others yesterday by Lending Club's VP of Retail Investing. I encourage you all to read very carefully. The new agreement for the individual users to sign is almost a copy paste of this. I would like to point out a couple of points which I (as the owner of BlueVestment) am unable to agree to:
"You have instituted adequate and appropriate safeguards and precautions to ensure the security of data and information that you send to or receive from the Site, whether through the API or by other means. You will maintain sufficient procedures to detect and respond to security breaches involving such data and information and agree to inform Lending Club as soon as practicable when you suspect or learn of malicious activity or any other security breach involving such data or information and to take corrective action. You agree to provide Lending Club information regarding the corrective action taken and with such other information regarding the malicious activity or breach as Lending Club reasonably requests. You also agree to assist Lending Club, at your sole expense, with any corrective action Lending Club determines, in its sole and absolute discretion, it is required to take."
- So that means that if a user (falsely or incorrectly) claims that their account was "hacked" and makes a fuss about it to Lending Club, LC can force me to pay for five years of credit card monitoring for all of my customers because they felt it was prudent to protect the Lending Club brand. I'm obviously all about protecting my customers but what is unacceptable is being at the legal and financial mercy of whatever Lending Club feels is best for themselves.
"You have no rights with respect to the API or any portion thereof. Without limiting the generality of the foregoing, you agree that you shall not (i) modify or create derivative works of the API; (ii) sublicense, lease, rent, assign, distribute, repackage, rebrand, or otherwise transfer or disclose the API, any portion thereof or any documentation to any third party; or (iii) cause, assist or permit any third party (including any end-user) to do any of the foregoing."
- Meaning that I cannot help anyone figure out the API for themselves if they need help
"All remarks, discussions, ideas, concepts, know-how, techniques, information, orders, data, strategies, account history, graphics or other submissions communicated to Lending Club or our agents by or through the API (collectively, "Submissions") shall be deemed and remain the property of Lending Club, and Lending Club shall be entitled to use any Submission for any purpose, without restriction or compensation to the individual who has provided the Submission. Lending Club shall not be subject to any obligations of confidentiality regarding Submissions except as expressly agreed by Lending Club or as otherwise required by Applicable Law. Nothing contained in this Agreement shall be construed as limiting Lending Club's responsibilities and obligations under our Privacy Policy."
- How is this acceptable? I submit data to them on my customers' strategies and now that data becomes theirs? Heck it isn't even mine! It belongs to my customers.
[Cannot publish, distribute, post, etc] "any information relating to Lending Club, its products, services or accounts on any webpage or other medium that also displays information relating to products, services or accounts offered by or held with entities that Lending Club determines in our sole discretion compete with, harm, detract from, or otherwise impact Lending Club in any way;"
- This is a big one. This basically means that I couldn't write a blog post or do an interview or make a forum post here regarding how LC might be doing in any negative light whatsoever. How is this going to inspire trust in me from my customers.
"Attempt, directly or indirectly, to dissuade persons or entities from using the Site or Lending Club's products or services"
"Indicate or imply that you prefer, directly or indirectly, any products or services offered by any Competitor of Lending Club;"
"Attempt to persuade or prompt Lending Club investors to use any products or services offered by any Competitor;"
- More of the same. How can people trust me or my business if I'm restricted from voicing my opinion.
"Impose any restrictions, conditions, disadvantages or fees in connection with Lending Club products or services that you do not impose equally on all products or services offered by any Competitor;"
"Promote any products or services offered by any Competitor more actively than you promote the products or services of Lending Club;"
"Engage in activities that harm the business or brand of Lending Club;"
- Lending Club for any reason can do whatever they want in order to protect their brand. Even at the expense of fairness. I'm all about a corporation to want whatever they want, but I as another business owner cannot expose myself and my customers to this risk.
"Make any disparaging statements or representations, either directly or indirectly, whether orally or in writing, by word or gesture, to any person or entity whatsoever, about Lending Club, our affiliates or subsidiaries or our or their respective directors, officers, employees, agents, representatives, consultants, accountants, shareholders, attorneys or advisors."
- The list goes on and on.
"You agree to provide such information as Lending Club may request in writing, within 30 days of your receipt of such request, concerning your use of the API in order to allow Lending Club to verify that such use complies with the terms of the API Documents."
- So now they reserve the right to 'inspect' my systems. YOUR data.
"You agree that any claim or cause of action brought by you shall be brought in an individual capacity and not as a member of a class or representative action, and that you shall not request that any court or tribunal hearing such claim or cause of action consolidate more than one party's claims or causes of action. You further agree that you shall not participate, except by order of the court, in any class or representative arbitration or judicial proceeding involving claims or causes of action arising from or related to the API Documents or the subject matter thereof."
- So if Lending Club commits a violation to the community, the owners of sites like BlueVestment cannot get together and form a class action lawsuit but rather must fight it all out separately.
So my friends and customers... this looks like it may be the end. I'll keep running for the next couple of days but I'm certainly not liking this trend. Do you agree or disagree? Am I making a fuss about nothing or am I pointing out legitimate concerns?
All the best,
Nathan
BlueVestment
This is what was sent to myself and a few others yesterday by Lending Club's VP of Retail Investing. I encourage you all to read very carefully. The new agreement for the individual users to sign is almost a copy paste of this. I would like to point out a couple of points which I (as the owner of BlueVestment) am unable to agree to:
"You have instituted adequate and appropriate safeguards and precautions to ensure the security of data and information that you send to or receive from the Site, whether through the API or by other means. You will maintain sufficient procedures to detect and respond to security breaches involving such data and information and agree to inform Lending Club as soon as practicable when you suspect or learn of malicious activity or any other security breach involving such data or information and to take corrective action. You agree to provide Lending Club information regarding the corrective action taken and with such other information regarding the malicious activity or breach as Lending Club reasonably requests. You also agree to assist Lending Club, at your sole expense, with any corrective action Lending Club determines, in its sole and absolute discretion, it is required to take."
- So that means that if a user (falsely or incorrectly) claims that their account was "hacked" and makes a fuss about it to Lending Club, LC can force me to pay for five years of credit card monitoring for all of my customers because they felt it was prudent to protect the Lending Club brand. I'm obviously all about protecting my customers but what is unacceptable is being at the legal and financial mercy of whatever Lending Club feels is best for themselves.
"You have no rights with respect to the API or any portion thereof. Without limiting the generality of the foregoing, you agree that you shall not (i) modify or create derivative works of the API; (ii) sublicense, lease, rent, assign, distribute, repackage, rebrand, or otherwise transfer or disclose the API, any portion thereof or any documentation to any third party; or (iii) cause, assist or permit any third party (including any end-user) to do any of the foregoing."
- Meaning that I cannot help anyone figure out the API for themselves if they need help
"All remarks, discussions, ideas, concepts, know-how, techniques, information, orders, data, strategies, account history, graphics or other submissions communicated to Lending Club or our agents by or through the API (collectively, "Submissions") shall be deemed and remain the property of Lending Club, and Lending Club shall be entitled to use any Submission for any purpose, without restriction or compensation to the individual who has provided the Submission. Lending Club shall not be subject to any obligations of confidentiality regarding Submissions except as expressly agreed by Lending Club or as otherwise required by Applicable Law. Nothing contained in this Agreement shall be construed as limiting Lending Club's responsibilities and obligations under our Privacy Policy."
- How is this acceptable? I submit data to them on my customers' strategies and now that data becomes theirs? Heck it isn't even mine! It belongs to my customers.
[Cannot publish, distribute, post, etc] "any information relating to Lending Club, its products, services or accounts on any webpage or other medium that also displays information relating to products, services or accounts offered by or held with entities that Lending Club determines in our sole discretion compete with, harm, detract from, or otherwise impact Lending Club in any way;"
- This is a big one. This basically means that I couldn't write a blog post or do an interview or make a forum post here regarding how LC might be doing in any negative light whatsoever. How is this going to inspire trust in me from my customers.
"Attempt, directly or indirectly, to dissuade persons or entities from using the Site or Lending Club's products or services"
"Indicate or imply that you prefer, directly or indirectly, any products or services offered by any Competitor of Lending Club;"
"Attempt to persuade or prompt Lending Club investors to use any products or services offered by any Competitor;"
- More of the same. How can people trust me or my business if I'm restricted from voicing my opinion.
"Impose any restrictions, conditions, disadvantages or fees in connection with Lending Club products or services that you do not impose equally on all products or services offered by any Competitor;"
"Promote any products or services offered by any Competitor more actively than you promote the products or services of Lending Club;"
"Engage in activities that harm the business or brand of Lending Club;"
- Lending Club for any reason can do whatever they want in order to protect their brand. Even at the expense of fairness. I'm all about a corporation to want whatever they want, but I as another business owner cannot expose myself and my customers to this risk.
"Make any disparaging statements or representations, either directly or indirectly, whether orally or in writing, by word or gesture, to any person or entity whatsoever, about Lending Club, our affiliates or subsidiaries or our or their respective directors, officers, employees, agents, representatives, consultants, accountants, shareholders, attorneys or advisors."
- The list goes on and on.
"You agree to provide such information as Lending Club may request in writing, within 30 days of your receipt of such request, concerning your use of the API in order to allow Lending Club to verify that such use complies with the terms of the API Documents."
- So now they reserve the right to 'inspect' my systems. YOUR data.
"You agree that any claim or cause of action brought by you shall be brought in an individual capacity and not as a member of a class or representative action, and that you shall not request that any court or tribunal hearing such claim or cause of action consolidate more than one party's claims or causes of action. You further agree that you shall not participate, except by order of the court, in any class or representative arbitration or judicial proceeding involving claims or causes of action arising from or related to the API Documents or the subject matter thereof."
- So if Lending Club commits a violation to the community, the owners of sites like BlueVestment cannot get together and form a class action lawsuit but rather must fight it all out separately.
So my friends and customers... this looks like it may be the end. I'll keep running for the next couple of days but I'm certainly not liking this trend. Do you agree or disagree? Am I making a fuss about nothing or am I pointing out legitimate concerns?
All the best,
Nathan
BlueVestment
Title: The end of BlueVestment?
Post by: jpildis on August 20, 2014, 11:00:00 PM
Post by: jpildis on August 20, 2014, 11:00:00 PM
I support you 100% and I don't think it's fair the LC is taking such a heavy handed approach. I would probably do the exact same thing, especially since you've been providing your wonderful service for fee.
I plan to light up by account representative on this topic and I encourage others to do so too.
I plan to light up by account representative on this topic and I encourage others to do so too.
Title: The end of BlueVestment?
Post by: rawraw on August 20, 2014, 11:00:00 PM
Post by: rawraw on August 20, 2014, 11:00:00 PM
I understand their intentions, but this is absurd. I've been thinking of switching to a paid service as of late, but hadn't because it didn't seem Bryce has partnered with any of them. Guess it's time to start looking again, right after I send an angry email to Lending Club.
Title: The end of BlueVestment?
Post by: BlueVestment on August 20, 2014, 11:00:00 PM
Post by: BlueVestment on August 20, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: Randawl on August 20, 2014, 11:00:00 PM
Post by: Randawl on August 20, 2014, 11:00:00 PM
Wow.I'll be in contact with LC as well about this one. You can count on that.
. . . And I thought Google's T&C/agreements were ridiculous.
Title: The end of BlueVestment?
Post by: Fred93 on August 20, 2014, 11:00:00 PM
Post by: Fred93 on August 20, 2014, 11:00:00 PM
Lawyers gone wild.
Title: The end of BlueVestment?
Post by: TravelingPennies on August 20, 2014, 11:00:00 PM
Post by: TravelingPennies on August 20, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: BruiserB on August 20, 2014, 11:00:00 PM
Post by: BruiserB on August 20, 2014, 11:00:00 PM
I hope you can find a way to keep your service going and I will be making my disapproval of this known to Lending Club. However, I do understand that you can't take on personal liability for a service you provide for free. Since you are not charging, I would argue that you aren't a "commercial" service at all.
Sent from my iPad using Tapatalk
Sent from my iPad using Tapatalk
Title: The end of BlueVestment?
Post by: brycemason on August 20, 2014, 11:00:00 PM
Post by: brycemason on August 20, 2014, 11:00:00 PM
I appreciate the intent, but I don't think this was the right approach. Nathan, I think we should gather up the 3rd-party players, have a conference call, and pound out a revision and pass it by them. If everyone groups together, then we have some leverage in that if nobody agrees to use the API, there is no third-party ecosystem.
Title: The end of BlueVestment?
Post by: TravelingPennies on August 20, 2014, 11:00:00 PM
Post by: TravelingPennies on August 20, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 20, 2014, 11:00:00 PM
Post by: TravelingPennies on August 20, 2014, 11:00:00 PM
Take a chill pill and reply all to my email. Let's make it happen.
Title: The end of BlueVestment?
Post by: TravelingPennies on August 20, 2014, 11:00:00 PM
Post by: TravelingPennies on August 20, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: mchu168 on August 20, 2014, 11:00:00 PM
Post by: mchu168 on August 20, 2014, 11:00:00 PM
I'm a big fan of the BlueVestment service. As a decent sized retail investor, let me know what I can do to help - I would be more then happy to lodge a complaint with LC. Please don't go!
Title: The end of BlueVestment?
Post by: TravelingPennies on August 21, 2014, 11:00:00 PM
Post by: TravelingPennies on August 21, 2014, 11:00:00 PM
What is the plan? Do you want to do your group thing or do you want us to complain as well? I got an API guy looking for feedback. But I'm just a foot soldier :-)
Title: The end of BlueVestment?
Post by: TravelingPennies on August 21, 2014, 11:00:00 PM
Post by: TravelingPennies on August 21, 2014, 11:00:00 PM
Right now is the time for the third-party players to make a counter proposal. It's premature for retailers to complain, IMO.
Title: The end of BlueVestment?
Post by: BruiserB on August 21, 2014, 11:00:00 PM
Post by: BruiserB on August 21, 2014, 11:00:00 PM
Sounds good.....no reason to complain yet. But if/when Lending Club makes it impossible for the third parties to continue, then they will hear from me. I understand their lawyers want them to be protected, but they need to work with the third parties to ensure a secure way of doing business. It would be nice if they would address the deficiencies of the API so that it wouldn't be necessary to give login credentials in addition to the API key. That would go a long way to closing any security holes. Also I thought the agreement for API access I signed already gave up a most of my right to recourse against LC. Lawyers run amok as already stated.....
Sent from my iPad using Tapatalk
Sent from my iPad using Tapatalk
Title: The end of BlueVestment?
Post by: lascott on August 21, 2014, 11:00:00 PM
Post by: lascott on August 21, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 21, 2014, 11:00:00 PM
Post by: TravelingPennies on August 21, 2014, 11:00:00 PM
Exactly.....all kinds of disclaiming and harmless-holding was already agreed to by me. :-)
So if I want to give my API key to a third party site, that's my business, and LC should not be putting further requirements on the third parties.
Sent from my iPad using Tapatalk
So if I want to give my API key to a third party site, that's my business, and LC should not be putting further requirements on the third parties.
Sent from my iPad using Tapatalk
Title: The end of BlueVestment?
Post by: BlueVestment on August 22, 2014, 11:00:00 PM
Post by: BlueVestment on August 22, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: Fred93 on August 22, 2014, 11:00:00 PM
Post by: Fred93 on August 22, 2014, 11:00:00 PM
Appreciate your efforts.
When I interacted with them a few weeks back, I emphasized that their best course of action is to work together with the ecosystem, instead of wage war with it.
When I interacted with them a few weeks back, I emphasized that their best course of action is to work together with the ecosystem, instead of wage war with it.
Title: The end of BlueVestment?
Post by: TravelingPennies on August 22, 2014, 11:00:00 PM
Post by: TravelingPennies on August 22, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 22, 2014, 11:00:00 PM
Post by: TravelingPennies on August 22, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: thezfunk on August 23, 2014, 11:00:00 PM
Post by: thezfunk on August 23, 2014, 11:00:00 PM
I am going to channel my inner 'Core' here and say that this development has confirmed the suspicion I have had for awhile that they don't like these 3rd party sites and would prefer they don't exist. They don't have to outright ban them, just make their lives so miserable they quit on their own.
If I can't use what I want to invest how I want to invest then I will pull out of LC. I can be treated like a second rate investor somewhere else.
Sent from my SCH-I535 using Tapatalk
If I can't use what I want to invest how I want to invest then I will pull out of LC. I can be treated like a second rate investor somewhere else.
Sent from my SCH-I535 using Tapatalk
Title: The end of BlueVestment?
Post by: rawraw on August 23, 2014, 11:00:00 PM
Post by: rawraw on August 23, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 23, 2014, 11:00:00 PM
Post by: TravelingPennies on August 23, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 23, 2014, 11:00:00 PM
Post by: TravelingPennies on August 23, 2014, 11:00:00 PM
Now it makes sense why they are pushing automated investing so heavily, though. You have them scared Nathan 
Title: The end of BlueVestment?
Post by: SBryantMS on August 23, 2014, 11:00:00 PM
Post by: SBryantMS on August 23, 2014, 11:00:00 PM
Have you considered the alternative: Buy out the best Third party tool and shut it down. Non-compete with the original principals. Wait six months and repeat.
Title: The end of BlueVestment?
Post by: wiseclerk_com on August 24, 2014, 11:00:00 PM
Post by: wiseclerk_com on August 24, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 24, 2014, 11:00:00 PM
Post by: TravelingPennies on August 24, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 24, 2014, 11:00:00 PM
Post by: TravelingPennies on August 24, 2014, 11:00:00 PM
I believe the explanation is much simpler.
The folks at LC are largely ignorant of the ecosystem. They don't understand or appreciate the 3rd party sites. How can this be? Well first off, they aren't users of them, as we are.
So they don't see the benefits, but do discuss among themselves and their lawyers fantasy fears.
So I believe first we have to overcome the ignorance.
One of the things I suggested to them is that they form a group of API users, with whom they discuss problems, concerns, website changes, policy changes, etc. I suggested this could be done with a mailing list or forum. This was just an idea for a way to get a dialog going. Such a dialog could help to educate internal LC people about the ecosystem.
The folks at LC are largely ignorant of the ecosystem. They don't understand or appreciate the 3rd party sites. How can this be? Well first off, they aren't users of them, as we are.
So they don't see the benefits, but do discuss among themselves and their lawyers fantasy fears.
So I believe first we have to overcome the ignorance.
One of the things I suggested to them is that they form a group of API users, with whom they discuss problems, concerns, website changes, policy changes, etc. I suggested this could be done with a mailing list or forum. This was just an idea for a way to get a dialog going. Such a dialog could help to educate internal LC people about the ecosystem.
Title: The end of BlueVestment?
Post by: wiseclerk_com on August 24, 2014, 11:00:00 PM
Post by: wiseclerk_com on August 24, 2014, 11:00:00 PM
@Fred93
possible
But at least upper management and marketing department of LC should be aware, as the tools
- are not new
- got some visibility as they were presented at events like Lendit and reviewed on some expert blogs
- as I understand are used by some of the larger/institutional investors which should be in the focus
- do fulfill a need of a segment of investors that LC site-tools seem to leave open (otherwise investors would not use these 3rd party tools)
But Nathan and Bryce should be able to gauge that better than I am.
possible
But at least upper management and marketing department of LC should be aware, as the tools
- are not new
- got some visibility as they were presented at events like Lendit and reviewed on some expert blogs
- as I understand are used by some of the larger/institutional investors which should be in the focus
- do fulfill a need of a segment of investors that LC site-tools seem to leave open (otherwise investors would not use these 3rd party tools)
But Nathan and Bryce should be able to gauge that better than I am.
Title: The end of BlueVestment?
Post by: Fred93 on August 24, 2014, 11:00:00 PM
Post by: Fred93 on August 24, 2014, 11:00:00 PM
What you say sounds logical, but does not match the facts I've observed from my conversations with LC folk.
I think this is an important point, because it directs how we should think about what to say to them.
I think this is an important point, because it directs how we should think about what to say to them.
Title: The end of BlueVestment?
Post by: Simon on August 24, 2014, 11:00:00 PM
Post by: Simon on August 24, 2014, 11:00:00 PM
This is a great discussion - and one that will continue to happen each year. I agree with Bryce that now is the time to make third-party voices heard and not shut out. Lending Club needs to know that they stand to benefit, not lose, from a vibrant p2p lending ecosystem, and a generous API agreement (that still maintains their security requirements, etc) is a part of how that ecosystem is catalyzed.
If you guys want this covered in an article on LendingMemo send me an email.
If you guys want this covered in an article on LendingMemo send me an email.
Title: The end of BlueVestment?
Post by: thinkfastsuit on August 24, 2014, 11:00:00 PM
Post by: thinkfastsuit on August 24, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: AnilG on August 24, 2014, 11:00:00 PM
Post by: AnilG on August 24, 2014, 11:00:00 PM
The early employees at LC are well aware of ecosystem. I have been using API at PeerCube for almost 2 years. Every time I had issues with them, they always have been quick to respond. But it helps to show respect as you would show to anyone else.
Their current challenge is that they are growing much faster, new people unaware of the culture, gaps in communications, and rapid developments to get ready for IPO.
Personally, I believe publicly complaining about API agreement before contacting LC staff is not the right way to go about doing business and building good rapport.
Also, LC is right to worry about security aspects of commercial services. I was surprised the API agreement didn't call for tougher security measures.
Quote"> from: Fred93 on August 25, 2014, 04:32:52 PM
Their current challenge is that they are growing much faster, new people unaware of the culture, gaps in communications, and rapid developments to get ready for IPO.
Personally, I believe publicly complaining about API agreement before contacting LC staff is not the right way to go about doing business and building good rapport.
Also, LC is right to worry about security aspects of commercial services. I was surprised the API agreement didn't call for tougher security measures.
Quote"> from: Fred93 on August 25, 2014, 04:32:52 PM
Title: The end of BlueVestment?
Post by: Fred on August 25, 2014, 11:00:00 PM
Post by: Fred on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: rawraw on August 25, 2014, 11:00:00 PM
Post by: rawraw on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: BlueVestment on August 25, 2014, 11:00:00 PM
Post by: BlueVestment on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: lascott on August 25, 2014, 11:00:00 PM
Post by: lascott on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: BruiserB on August 25, 2014, 11:00:00 PM
Post by: BruiserB on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
Yea, you 3rd party guys should pressure LC into having API specific passwords as part of this process. Then it limits the liability of LC and the API guys in case of problems.
Title: The end of BlueVestment?
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: rawraw on August 25, 2014, 11:00:00 PM
Post by: rawraw on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: BruiserB on August 25, 2014, 11:00:00 PM
Post by: BruiserB on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: lascott on August 25, 2014, 11:00:00 PM
Post by: lascott on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
Post by: TravelingPennies on August 25, 2014, 11:00:00 PM
I suggested two factor authentication recently and they forwarded it up. It'd be nice for things like Folio and changing bank
Title: The end of BlueVestment?
Post by: thinkfastsuit on August 25, 2014, 11:00:00 PM
Post by: thinkfastsuit on August 25, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: AnilG on August 26, 2014, 11:00:00 PM
Post by: AnilG on August 26, 2014, 11:00:00 PM
Two factor authentication has its own weakness but it is still a better option for user security. But none of these solutions solve the "insecurity" with third party access to your account. With current username/password or API Key, your security is as good as third party claims, not much IMO. I doubt any of the third party sites will meet PCI compliance audit with storing your credentials typically required for financial transactions and by financial institutions.
What platforms need is a secure way to allow third party to access your account and perform transactions on your behalf. Anything short of token-based system and your authentication information never hitting and stored on third party site, similar to the systems used by Credit Card processors, is opening up Lending Club and third party sites for lot of pain if there were to be a security breach. That has been my recommendation to platforms like Lending Club. If they are interested in having a third-party ecosystem, implement a PCI compliant token based authentication system and share the cost with third party sites. With the early stage of most platforms, I don't see anyone implementing it yet. But LC is in the best position now to set the standard assuming they want a third-party order execution based ecosystem.
from: rawraw on August 26, 2014, 01:43:44 PM
What platforms need is a secure way to allow third party to access your account and perform transactions on your behalf. Anything short of token-based system and your authentication information never hitting and stored on third party site, similar to the systems used by Credit Card processors, is opening up Lending Club and third party sites for lot of pain if there were to be a security breach. That has been my recommendation to platforms like Lending Club. If they are interested in having a third-party ecosystem, implement a PCI compliant token based authentication system and share the cost with third party sites. With the early stage of most platforms, I don't see anyone implementing it yet. But LC is in the best position now to set the standard assuming they want a third-party order execution based ecosystem.
from: rawraw on August 26, 2014, 01:43:44 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on August 26, 2014, 11:00:00 PM
Post by: TravelingPennies on August 26, 2014, 11:00:00 PM
Did you just break your NDA with Lending Club by disclosing this information publicly? If I understood the T&C to participate in REST API program correctly, you were bound by NDA and not to disclose any information related to the program publicly. 
Quote"> from: thinkfastsuit on August 26, 2014, 01:21:20 PM
Quote"> from: thinkfastsuit on August 26, 2014, 01:21:20 PM
Title: The end of BlueVestment?
Post by: refinerr on September 11, 2014, 11:00:00 PM
Post by: refinerr on September 11, 2014, 11:00:00 PM
I was reading through the legal documents LC sent over earlier this week to me when I requested an API for a TPA. Within the agreement it states you agree to not provide your log in credentials to any third party. What are the consequences of this to the everyday end user like myself?
Title: The end of BlueVestment?
Post by: brycemason on September 11, 2014, 11:00:00 PM
Post by: brycemason on September 11, 2014, 11:00:00 PM
You don't provide the username/password, you provide your authorization token.
Title: The end of BlueVestment?
Post by: TravelingPennies on September 12, 2014, 11:00:00 PM
Post by: TravelingPennies on September 12, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on September 12, 2014, 11:00:00 PM
Post by: TravelingPennies on September 12, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on September 13, 2014, 11:00:00 PM
Post by: TravelingPennies on September 13, 2014, 11:00:00 PM
Title: The end of BlueVestment?
Post by: TravelingPennies on October 02, 2014, 11:00:00 PM
Post by: TravelingPennies on October 02, 2014, 11:00:00 PM
Thank you Bruiser and Bryce!