Copy of Letter from Quicken CEO 12-3-2021 (Schwab Issue and etc.)

retird

Attached:  Copy of letter (via e-mail) from CEO about Schwab Issue and etc.

Chris_QPW

I love how he says that for the changes over the last three years have been invisible to Quicken users.
The change over from FDS to QCS as a connection method for Express Web Connect was far from "invisible".

Ps56k2

what were the email message headers - as in the FROM.... as I didn't get a copy -

Chris_QPW

And I wonder if someone has barred him from looking at this forum:


Because when I take even the littlest dip into the threads I see where people can't even get certain accounts downloaded because for the change in policy for any account type not directly managed by the individual (POA, LLCs, View-Only, ...)  And I see people missing bond prices and now transactions being delayed by a day, and other problems.

retird

The ongoing Community posts don't say it's fixed I don't think....  I'm still trying to get issues fixed that are over a year old and continue as I write....  Worked with my bank again just today sending OFX log and screenshots again. Hopefully Quicken, Intuit, and my bank will fix it. I appreciate the CEO addressing the customers and look forward to what he said about the future.  Time will tell...  

retird

Ps56k2 said:

what were the email message headers - as in the FROM.... as I didn't get a copy -

Schwab Connection Change was the Subject...
 quicken@e.quicken.com

Chris_QPW

Ps56k2 said:

what were the email message headers - as in the FROM.... as I didn't get a copy -

I didn't get it either, somehow, they must have filtered the list to people "affected".

retird

Check spam folder... maybe it's there...

Ps56k2

my email server filters all Quicken.com at the front end and deletes it all as a reported spam generator....
never makes it to the Spam folder.

I have to use a GMAIL account just for this forum.

retird

Here is a partial screenshot (with my e-mail address cut...).  You can see the Header, Subject, and etc.

retird

Why would they filter the letter and it seems those in the know here in the Community seem to not have been informed about the letter......

Chris_QPW

retird said:

Why would they filter the letter and it seems those in the know here in the Community seem to not have been informed about the letter......

Bad assumption on my part.  But I have two active subscriptions (Starter just for testing) and neither got the email, not that I care much about such a message.

Note that my domain is serviced by Google so all my email addresses are gmail, and this message definitely didn't make in anywhere near my email boxes. And it isn't like I don't get email from Quicken here is the trash folder of the Starter email.

retird

I thought folks here in the Community would be interested in the letter from the CEO. Many kept wanting to hear from him during this Schwab mess. That's why I posted it..  

Chris_QPW

retird said:

I thought folks here in the Community would be interested in the letter from the CEO. Many kept wanting to hear from him during this Schwab mess. That's why I posted it..  

Yes, that is true, Thank you.  Let's just say I'm skeptical of what he wrote, and surer of what is posted in the forum to understand what is really going on.

Rocket J Squirrel

I can't agree with this:

As a company, we are pleased to be partnering with forward-looking financial institutions such as Charles Schwab, which has taken the initiative and made the technology investments to move to a durable, secure, data connectivity system that will serve Quicken users for many years to come.

Moving from Direct Connect to any form of Express Web Connect is a giant step in the wrong direction. If any of my principal FIs moves from DC to EWC, they will lose me as a client.

Chris_QPW

Rocket J Squirrel said:

I can't agree with this:

As a company, we are pleased to be partnering with forward-looking financial institutions such as Charles Schwab, which has taken the initiative and made the technology investments to move to a durable, secure, data connectivity system that will serve Quicken users for many years to come.

Moving from Direct Connect to any form of Express Web Connect is a giant step in the wrong direction. If any of my principal FIs moves from DC to EWC, they will lose me as a client.

I agree and will do the same.

What's more the statement is completely false.  One might argue that using usernames/passwords like Direct Connect does isn't the most secure way to do it, but that could easily be changed just by how the connection/login is made.  One could switch to OAuth2 which has rotating certificates.  But of course, that would require the financial institutions to start adopting that too, but there isn't any way they are going to do it.  Just like there isn't any way all of the financial institutions are going to go to this new API.

There is a big difference between how the connection is made, and what the underline protocol is.
Not to mention having extra parties brought to the table with aggregators.

Already we are seeing reports that the "mapping of actions" isn't correct.

It takes a lot to perfect a good protocol.  OFX has been around for a lot of years and proven itself.
The same can't be said for whatever the Charles Schwab API is.  In fact, nothing can be said about it, because unlike OFX that is a standard and open to all to view, this API is closed without any standardization.

vdeolali

I got the same letter and I replied telling him the whole thing does not yet work. No response. Who know if the problem is Schwab or Quicken. I don't have any problems downloading from Fidelity. It is just Schwab.

vdeolali

When I try to reset the connection, it says the express webconnect is from Capital One. I don't trust Capital One with my data/credentials. I disconnected all my schwab accounts and will update manually.

Chris_QPW

vdeolali said:

When I try to reset the connection, it says the express webconnect is from Capital One. I don't trust Capital One with my data/credentials. I disconnected all my schwab accounts and will update manually.

My guess would be that the message is wrong.  Capitol One was the first financial institution to Express Web Connect + so they probably hard coded that Capitial One into the message somewhere.

10s_player

> @Chris_QPW said:
> I agree and will do the same.
>
> What's more the statement is completely false.  One might argue that using usernames/passwords like Direct Connect does isn't the most secure way to do it, but that could easily be changed just by how the connection/login is made.  One could switch to OAuth2 which has rotating certificates.  But of course, that would require the financial institutions to start adopting that too, but there isn't any way they are going to do it.  Just like there isn't any way all of the financial institutions are going to go to this new API.
>
> There is a big difference between how the connection is made, and what the underline protocol is.
> Not to mention having extra parties brought to the table with aggregators.
>
> Already we are seeing reports that the "mapping of actions" isn't correct.
>
> It takes a lot to perfect a good protocol.  OFX has been around for a lot of years and proven itself.
> The same can't be said for whatever the Charles Schwab API is.  In fact, nothing can be said about it, because unlike OFX that is a standard and open to all to view, this API is closed without any standardization.

I would like to provide a bit more clarification to this post as there are some important comments worth mentioning.

*One could switch to OAuth2 which has rotating certificates.
---The FDX API is based on the OAuth2 framework. See link: https://financialdataexchange.org/FDX/News/Announcements/FDX_Security_Specification_Boosted_with_FAPI.aspx?WebsiteKey=deae9d6d-1a7a-457b-a678-8a5517f8a474

*It takes a lot to perfect a good protocol.  OFX has been around for a lot of years and proven itself.
---This is correct. OFX has been around for many years. OFX and FDX are now partnering to set data sharing standards: https://www.prnewswire.com/news-releases/ofx-joins-financial-data-exchange-to-accelerate-financial-data-sharing-standards-300889392.html

*The same can't be said for whatever the Charles Schwab API is.  In fact, nothing can be said about it, because unlike OFX that is a standard and open to all to view, this API is closed without any standardization.
---Many of the largest Financial Institutions, Fintechs and Data Aggregators are all members of FDX. See the parties in this link. https://financialdataexchange.org/FDX/The%20Consortium/FDX/The-Consortium/Members.aspx?hkey=362ecd23-b752-48aa-b104-a99e916276c8
---Also, the FDX APIs are available to anyone and represents a standardized structure approved by all parties across FDX.

Chris_QPW

@10s_player FDX looks very promising.  Do you know if this in fact what Schwab is using?

Asking Quicken Inc, Inuit, and financial institutions results in vague answers.

10s_player

@Chris_QPW

Schwab appears to be a Sustaining Member with FDX:
-->https://financialdataexchange.org/FDX/The Consortium/FDX/The-Consortium/Members.aspx?hkey=362ecd23-b752-48aa-b104-a99e916276c8

These links seem to support some involvement with FDX:
-->https://www.schwab.com/legal/public-security-tips-popup
-->https://pressroom.aboutschwab.com/press-releases/press-release/2020/Charles-Schwab-Reinforces-Its-Commitment-to-Customer-Data-Protection/default.aspx

Chris_QPW

10s_player said:

@Chris_QPW

Schwab appears to be a Sustaining Member with FDX:
-->https://financialdataexchange.org/FDX/The Consortium/FDX/The-Consortium/Members.aspx?hkey=362ecd23-b752-48aa-b104-a99e916276c8

These links seem to support some involvement with FDX:
-->https://www.schwab.com/legal/public-security-tips-popup
-->https://pressroom.aboutschwab.com/press-releases/press-release/2020/Charles-Schwab-Reinforces-Its-Commitment-to-Customer-Data-Protection/default.aspx

Thanks.  I think it is good idea that finally the financial institutions are moving towards some standard, but the more I think of it the more I think it is a mixed bag for Quicken users, especially Quicken Windows users.

What use to be a two-party operation is now turned into four-party operation that is clearly problematic.
With Direct Connect OFX, one can look into the log and see pretty much all that is going on.

With Express Web Connect (even Plus) there is no such visibility.

Quicken syncs to the Quicken Connection services with their own syncing system.  Then that turns around and connect to Intuit's servers.  Which in turn connect to the financial institution.

So, when there are problems, it still going to be the same old finger pointing, and lack of information that the Quicken user can use to find who is at fault.

I will note that with this change over it seems that the Quicken Mac developers have a much better handle on the new process than the Quicken Windows developers do.

It in fact matters little if the connection from Intuit to the financial institution is using FDX if the Quicken users can't connect to the same accounts, they have been able to in the past, and if the mapping/transferring of that data doesn't make it into Quicken properly.  And no one can say that this conversion has gone well.  And I might add that Capitial One which went to Express Web Connect + quite a while ago is still one of the most "reported" financial institution for problems.  These two examples certainly don't make one very confident in the process.

10s_player

> @Rocket J Squirrel said:
> I can't agree with this:
> Moving from Direct Connect to any form of Express Web Connect is a giant step in the wrong direction. If any of my principal FIs moves from DC to EWC, they will lose me as a client.

@Rocket J Squirrel Per Quicken: "Express Web Connect + (EWC+) is a new connection method currently only available to Capital One & Charles Schwab customers..."

More products and FI's are moving this direction. You might want to take a look at this FDX list of members. There are quite a few Financial Institutions on this list.
https://financialdataexchange.org/FDX/The Consortium/FDX/The-Consortium/Members.aspx

10s_player

@Chris_QPW - I would agree with you that it introduces a bit of complexity. Usually, the FDX element is only relevant between the FI and the Aggregator. It will take some time for it to be functioning perfectly. After all, screen-scraping is not a perfect process. What I find most concerning is that most of the FIs have some provision that indicates that if you share your information with a third-party, any losses are not covered.

https://www.pnc.com/en/personal-banking/banking/online-and-mobile-banking/online-banking-and-bill-pay-guarantee.html

https://www.fidelity.com/security/customer-protection-guarantee

Chris_QPW

10s_player said:

@Chris_QPW - I would agree with you that it introduces a bit of complexity. Usually, the FDX element is only relevant between the FI and the Aggregator. It will take some time for it to be functioning perfectly. After all, screen-scraping is not a perfect process. What I find most concerning is that most of the FIs have some provision that indicates that if you share your information with a third-party, any losses are not covered.

https://www.pnc.com/en/personal-banking/banking/online-and-mobile-banking/online-banking-and-bill-pay-guarantee.html

https://www.fidelity.com/security/customer-protection-guarantee

Yes, and as a long-time developer I actually expect such growing pains.  But with a good portion of the process not being standardized, and a good portion of the financial institutions not going to it, really seem to me isn't going to get much better for a very long time.

I certainly would hope that "screen-scraping" is done away with when going to this system.  If not, then it is really a total loss.

And yes, I share your concern about the losses not being covered, as I'm sure almost everyone else does.  And the "exposure risk" just went way up.  If was before your machine and the financial institution with Direct Connect, now it is your machine, Quicken's servers, Intuit's servers, and the financial institution.

I do believe that people are fooling themselves with Direct Connect and believing that they are "totally covered from loss".  I'm far from sure that if my machine got hacked and they somehow used it to get at my finances that the financial institutions would easy return that money.  Just look at the pain people go through for identity theft.

My personal view on all of this is a wait and see.  I'm not using Charles Scwhab or Capital One, so I haven't been directly affected.  But certainly, in time I might be.  At that time, I might choose complete drop this whole process.  Not to go to a Quicken competitor, but instead to just use my financial institution's services directly.  Over the next few years, I except to be consolidating to just one financial institution, and I have long been at the point in my life where I could just get away with using what the financial institutions provide.  So, whenever I decide I can just watch all of this from the sidelines.

Tom Young

Chris_QPW said:

I certainly would hope that "screen-scraping" is done away with when going to this system.  If not, then it is really a total loss.

Schwab's stated intent was to eliminate screen-scraping as the method of collecting data but whether this iteration achieves that or not isn't clear.

"As part of this effort, Schwab has joined a growing list of Financial Institutions, including the Financial Data Exchange (FDX), who have contributed and adopted new standards of data exchange with the intent to stop the practice of 'screen scraping'".

Chris_QPW

Tom Young said:

Chris_QPW said:

I certainly would hope that "screen-scraping" is done away with when going to this system.  If not, then it is really a total loss.

Schwab's stated intent was to eliminate screen-scraping as the method of collecting data but whether this iteration achieves that or not isn't clear.

"As part of this effort, Schwab has joined a growing list of Financial Institutions, including the Financial Data Exchange (FDX), who have contributed and adopted new standards of data exchange with the intent to stop the practice of 'screen scraping'".

Note I was responding to this statement:

Usually, the FDX element is only relevant between the FI and the Aggregator. It will take some time for it to be functioning perfectly. After all, screen-scraping is not a perfect process.

I probably should have stated that I there isn't any possible way that the FDX is standard is going to involve screen-scraping.  The process of transferring data from the financial institution to the aggregators isn't "screen-scrapping".

"screen-scraping" is the process of a program (the aggregator's program in this case) downloading a website's pages and scanning them for the information they need.  A program would pretend to be the user and log in as that user and do this.

Clearly this is a bad option for all involved.  And as far as I know it is done only as a last resort when the financial institution will not give them the data in a more structured way.

The whole point of a protocol like FDX or OFX is to give a program a standard way to access the data.
In turn it is up to the financial institution on how to get that data from their systems to input into the flow out to either of these protocols or for that matter in CSV or other kinds of format.  Certainly, one wouldn't expect the financial institution to be "screen-scraping" their own webpages.