Chase conversion complete - minor issue and question

Don Awalt

I was presented with the need to change to a new authorization/connection by Chase this morning when I logged into Quicken. It directed me over to the web site, that all went fine. The new account got set up in Quicken fine. The minor issue was, when it connected the new credit card account (all I have with them), it only gave me the option to add the account, not link it to an existing credit card. I think that was because the old credit card account in Quicken already had an online connection. In retrospect or if you are reading this before you have done the Chase conversion, if you get the Chase message you need to re-authorize, if possible stop and Deactivate Online Services for the old credit card (or bank accounts too), then go through the reauthorization process.

So I added the account new, and just copied all the transactions to the new credit card account, did a download - it download transactions from June, that all went fine, and the balance matched the web site reported balance.

So everything seems fine, but I have one question. When I look into the Account List, under "Transaction download" it says "Yes (improve connection [a link])". I did click on that link, and it took me to Chase and ran through the process again, but it saw everything was already set up. So no harm, but is it correct now that the connection reports as "Yes (improve connection)"? Is this a worse connection type than Direct Connect, or does it report that way because it's some special Chase-developed connection?

Thanks!

Sherlock

[Removed - Inaccurate]

Don Awalt

So you are saying the new Chase connection is Express Web Connect+, inferior to the Direct Connect they used to provide, and this is what they are rolling out to everyone as a better service? It doesn’t look like Direct Connect, but that makes no sense?!

Quicken Anja

Hello @Don Awalt,

Thank you for reaching out to the Community.

Express Web Connect+ is a secure API connection with the bank. Once established, it is as reliable as Direct Connect. This change is being made because Chase is discontinuing the Direct Connect service.

I hope this clarifies things! Thank you.

Don Awalt

Thank you @Quicken Anja

Quicken Anja

You're welcome!

Sherlock

[Removed - Inaccurate/Violation of SuperUser Guidelines]

Chris_QPW

Quicken Anja said:

Hello @Don Awalt,

Thank you for reaching out to the Community.

Express Web Connect+ is a secure API connection with the bank. Once established, it is as reliable as Direct Connect. This change is being made because Chase is discontinuing the Direct Connect service.

I hope this clarifies things! Thank you.

To call something more secure than something else you have to be comparing apples to apples, and comparing Express Web Connect + to Direct Connect isn't apples to apples.  They both have their unique security models.

If one is comparing Express Web Connect to Express Web Connect + then the comparison is apples to apples.

Direct Connect has this security model.
Quicken opens a secure connection to the financial institution's OFX server and uses the username and password to log in.  The result is that the username and password only resides in Quicken and the financial institution (provided you don't use sync to Mobile/Web).

With Express Web Connect the username and password is stored in Intuit's server and at the financial institution.

With Express Web Connect + the username and password is neither stored in Quicken or at Intuit.  Instead Intuit uses a rotating token to log in and get the transactions.  This is what makes Express Web Connect over Express Web Connect + more secure.

There is a fundamental difference/possibility of hacking a server like Intuit's and every person's machine/Quicken's Password vault.  I know for a fact that the SuperUsers would consider the likelihood of their machines in comparison to hacking of the Intuit servers far less, but that of course depends on how well one protects their own machine.

As you can see the discussion isn't really apples to apples.  Like it would be for Express Web Connect or any other aggregator getting data from your Chase accounts.

BTW Note that the OFX protocol allows for rotating security tokens and as such if Quicken Inc and the financial institutions wanted that could have been implemented to make Direct Connect even more secure, but that isn't going to happen.  Quicken users are a small percentage of any given financial institution's customers.  "Aggregation" is the norm, so when Chase says that they are going to a more secure method they are really talking about changing how the different aggregators access the data, not really comparing it with Direct Connect.  Direct Connect is going away because it is the exception of how most are doing this these days.  And it is an extra server with extra costs, that are only used by Quicken users or programs that pretend to be Quicken (small competing personal finance software).

As for being as reliable that is also debatable.

It certainly can be, but it is really dependent on everything working correctly.  I believe (but don't really know for sure) that most of the problems with Express Web Connect not being reliable has been the fault of the financial institutions, and certainly standardizing the protocol from Intuit to the financial institutions will help.  But the protocol alone doesn't account for 100% of the problem that might occur at the financial institution, not to mention what might go wrong in Inuit's part, and then there is Quicken servers, also Quicken the program itself.

With Direct Connect there was only Quicken the program, and the financial institution, and what's more since it was logging into the OFX server with a known protocol it wasn't subject to the problems with logging into every changing/unstandardized websites as the user like Express Web Connect does.

So, any engineer will tell you that the likelihood of problems goes up as you add complexity/more "moving parts".

Direct Connect, 2 parts.
Express Web Connect, 4 parts.

Chris_QPW

And I will point out something about Direct Connect or any protocol for that matter. It is only as good as the parties involved.

A direct example of this is USAA.  For decades their Direct Connect never had any problems.  Then last year they changed their security mode and it has had problems ever since.

So just using Direct Connect doesn't ensure that you have reliability.  It just had the fact that it is a mature standardized protocol with only two players involved which upped the likelihood that it would be more reliable.

Don Awalt

Wow thanks @Chris_QPW for the in-depth explanation! That's very interesting and most appreciated, my me and probably many others.

Chris_QPW

BTW I would like to state something.

The two main concerns that people seem to have are reliability and security.

I have personally never ever felt that security was something that I have worried about.
I'm reasonably sure that at least for me that either Direct Connect or Express Web Connect, and especially Express Web Connect + are secure enough.

On the subject of reliability I have seen some Express Web Connect be very reliable, and I have seen Direct Connect not be reliable. It really depends on the financial institution.  When I did had 3 different accounts/financial institutions on it from "not so reliable financial institutions" I would expect about one problem that might last a few hours to a few days every two months or so (between all three).

These in fact, didn't bother me that much.  When I had E-Trade bank accounts which are on Express Web Connect, I never had any problems with those accounts.

But the reliability of the system isn't just the "connection".

I dropped downloading transactions from those accounts when Quicken Inc decided to put their "Sync" to their servers in the process about 2 years ago.

From day one Sync to the Quicken Cloud dataset has been corrupting data files.  At times it is worse than at other times, but it has never been where one could be assured that their data file won't be corrupted. And corrupted in a way that it might not be discovered for a long time, making the backups less likely to ensure a recovery.

When people get their data files corrupted the first thing even the Moderators suggest is turning off Sync to Mobile/Web.  Well, Express Web Connect is also the same sync.

Will every data file get corrupted?  No.
Is it even likely that your data file will get corrupted? No.

But the odds are higher, and that is for sure.