Why doesn't an Express Web connect update require a vault password but a direct update does?

JB

I noticed the other day after I first opened Quicken and wanted to update the transactions for one of my EWC accounts, it didn't require me to enter a vault password as it would have if I'd been updating a Direct connect account or a OSU. And No I hadn't already entered the vault password earlier. This was the first time for any updates during this session.
Is there something special about the EWC that a vault password isn't required?

mrzookie

@JB

The nature of EWC/EWC+ is that account passwords are stored on the servers. As such, they would not be in the vault. Its been this way for quite some time.

splasher

Up until a couple years ago, Quicken kept them in the vault, but they weren't needed there since as explained by @mrzookie, they are stored on the data aggregator's servers and aren't needed in Quicken on the desktop, so Quicken removed them and confused a bunch of users.

GeoffG

JB said:

Is there something special about the EWC that a vault password isn't required?

I would look at it the other way, is there anything special about DC? Yes, DC connections are the only method that facilitates money movement for banking accounts. You can transfer money from checking to savings as an example. EWC/EWC+ only allows transaction downloads.
A side "benefit" to banks continuing to drop DC for EWC+ is Update now can be done without passwords.

JB

> @GeoffG said:
> I would look at it the other way, is there anything special about DC? Yes, DC connections are the only method that facilitates money movement for banking accounts. You can transfer money from checking to savings as an example. EWC/EWC+ only allows transaction downloads.
> A side "benefit" to banks continuing to drop DC for EWC+ is Update now can be done without passwords.

With EWC a password is still being used correct? So isn't it still of interest to user to know what password was setup for that EWC connection? The vault was a good place to maintain that info locally on the user's PC. There's nothing more alarming than getting random messages the server didn't recognize your ID and PW please enter again. Could be a phishing bot. I like to see what ID and PW the system is trying before I provide anymore info.

Chris_QPW

JB said:

> @GeoffG said:
> I would look at it the other way, is there anything special about DC? Yes, DC connections are the only method that facilitates money movement for banking accounts. You can transfer money from checking to savings as an example. EWC/EWC+ only allows transaction downloads.
> A side "benefit" to banks continuing to drop DC for EWC+ is Update now can be done without passwords.

With EWC a password is still being used correct? So isn't it still of interest to user to know what password was setup for that EWC connection? The vault was a good place to maintain that info locally on the user's PC. There's nothing more alarming than getting random messages the server didn't recognize your ID and PW please enter again. Could be a phishing bot. I like to see what ID and PW the system is trying before I provide anymore info.

You might say that it is was a change of "opinion".  Express Web Connect always stored the username and password on the Intuit server (Quicken Inc's aggregator) so that it can log in as you.  When they decided to put Quicken servers into the flow they changed from storing them both in the Password Vault and on the Intuit server to just on the Intuit server.  I suspect that it was a bit more than just an "opinion" on how it should work, for whatever reason it probably caused problems in the new flow so they changed it.

Old Express Web Connect flow:
Quicken (program) -> Intuit -> financial institution

"New" (about 2 years old):
Quicken (program) -> Quicken server (Sync to Quicken Cloud dataset) -> Intuit -> financial institution

Note that Express Web Connect + doesn't use the username and password and as such there certainly wouldn't be a reason to store them in the Password Vault.  Express Web Connect + uses a rotating security token between Intuit and the financial institution.