Quicken Community is moving to Single Sign On! Starting 1/22/21, you'll sign in to the community with your Quicken ID. For more information: http://bit.ly/CommunitySSO

Express Web Connect keeps credentials...how to turn off?

My connection to one of my banks has changed to express web connect without my permission. I reset the account and it came back already set to EWC. That, apparently, means my credentials for that account are kept by quicken. I have my own password manager and I don't want Quicken to keep any credentials and to the best of my knowledge I have explicitly tuned off the safe feature. The security on my password manager is very good but I have no idea what Quicken is doing with this information and, frankly, once I get control back OI'll change the password and then I don't care what the hell they do with it. What made the program think it was ok to capture my credentials and keep it? I need to turn this option off and never have this happen again! Help, please.

Best Answer

Answers

  • Sherlock
    Sherlock SuperUser ✭✭✭✭✭
    edited July 2020
    If you do not want Quicken to keep any credentials, I suggest you deactivate the Online Services of each of the registers using the Express Web Connect connection method: open the register, press Ctrl + Shift + E, select the Online Services tab and Deactivate.
  • Boatnmaniac
    Boatnmaniac SuperUser ✭✭✭✭
    edited July 2020
    @quickenbabalooey - I'm not sure what might have caused your account to switch the connection method to EWC.  Go to the Online Services tab of Account Details and see if an improved connection method is available.  If it is available you can try to upgrade your connection to DC.  If it is not available, it means that your FI does not offer DC.
    The EWC process requires that our FI login information is saved in our Quicken Cloud Account.  That information is retained there because the aggregator updates EWC accounts at night and the aggregator can't do that without being able to access that login information.
    If you don't want your EWC FI login information saved in your Cloud Account then you need to switch to either DC or WC.  Or if your FI does not support DC or WC you can deactivate your EWC account(s) and manually enter your transactions into your register.  Sorry, this might not be what you wanted to hear but it is what it is.
    (QW Premier Subscription: R32.12 on Windows 10)
  • babalooey
    babalooey Member ✭✭
    Well, I'm not happy about the answers, that's for sure. Keeping credentials in the cloud is absolutely what I don't want to happen and I never gave permission to do that! I'll find some other software--even tho quicken has few competitors--before I let this continue! I don't care how much security the provider claims to have, they are on the defensive and a giant target for all of the bad actors in the world. Stupid! Thanks to you both for the help.
  • Boatnmaniac
    Boatnmaniac SuperUser ✭✭✭✭
    @babalooey - I was incorrect about EWC login information being saved in your Quicken Cloud Account (unless, perhaps, if you have the Mobile and Web option turned on).  It is, however, saved on the EWC aggregation server.  I'm guessing you don't find this acceptable, either, but I thought you should know.
    DC connections do not save login information anywhere (unless you choose to save them in PW Vault) and WC does not involve login information at all (other than you need to log in separately to your online account).  So, if your EWC FIs offer either of these connection methods then you can maintain the security of your login information the way you want to.
    (QW Premier Subscription: R32.12 on Windows 10)
  • yetanotherdave
    yetanotherdave Member ✭✭
    EWC was activated for one of my accounts when I installed a 2020 subscription update on 7/30. R27.42. I do not want my encrypted password stored in an EWC aggregation server. I deactivated/reactivated and reset my back accounts. No matter when I do, the default for online services seems to be EWC=ON with password stored by default. Back to @babalooey 's original question: How do I turn off EWC password aggregation?? The answer previously provided does not work.
  • yetanotherdave
    yetanotherdave Member ✭✭
    This sounds like a change that is supposed to be good for me. I'm not sure I like it but there is no workable alternative. It certainly reinforces my dislike for the subscription model. No choice there either.

    I'll just hunker down and go with the new regime. At least I now know that it was not an error I caused by inadvertently changing some setting.

    I appreciate your quick rely.
  • babalooey
    babalooey Member ✭✭
    Thank you all for your interest in helping to solve this problem.

    As I stated earlier, I think it's insane to have credentials in a server. The bad actors always have the advantage of offense and no matter what the defensive measures they are exposed. Even the multi-factor authentication using sms msgs is exposed (SS7 is very old with known flaws and, to my knowledge, has never been fixed) and the idea that email is somehow safe is just stupid. The only real advantage we have is that there are many millions of us and targeting any one of us is very hard. They have to rely on phishing attacks and the like and if you have a good set of defenses on your personal system(s) the odds are in your favor but not so on rich targets like Quicken servers. Maybe I'm paranoid but, obviously, I don't think so. So, end of soapbox.

    Here's what I did. The account in question is with Citi and they don't support DC any more as far as I can tell. Their unwillingness to pay whatever Q wanted to charge them probably caused the switch to EWC. I, of course, changed the password and deactivated the account thus I lost any pointer to what was already downloaded. The lost pointer was a pain since I now have multiple copies of some transactions that Quicken thought were "new" instead of "matched." One, apparently can't just reactivate and select something else....Q wanted to work with a new account. So, I kept it in its deactivated state and just logged into my account on the web and used their export to QFX and established the link to the existing Q account. A minor pain but security is worth it to me. At least I found it possible but VERY ANNOYING to 1) find out what had happened--again thank you all--and 2) to recover.
  • Boatnmaniac
    Boatnmaniac SuperUser ✭✭✭✭
    edited August 2020
    @babalooey - You are not alone in not feeling uncomfortable with the security of EWC. Everyone needs to use the connection method(s) they feel most comfortable with and it sounds like you have done just that.
    BTW, I did some checking into Citibank and it is true that they discontinued offering DC back in 2015.  But if your Citi account is a credit card then you are in luck because DC is available for credit cards at no cost.  Just be sure to use the Citi Cards link during online services setup (not the link for Citibank) and your setup should default to DC.
    (QW Premier Subscription: R32.12 on Windows 10)
This discussion has been closed.