Connected Services & Security

mark miller

As a longtime Quicken user (20 years now) and a tech product guy , i've watched Quicken evolve its product into two area's (for various reasons) that maybe beneficial to Quicken but not to the end user in these (security) related areas:

1. Requiring a user to have a internet connection to open a local file (a longer post and doesn't happen all the time, but a change in the platform) —Also pushing to NOT have a locally installed version.
2. Reason for my post: Changes in connected services and associated security: https://www.quicken.com/support/changes-your-connected-services-quicken/

Now in essence Quicken (Remote/cloud) is managing your 3rd party accounts (your password authentication), with the (BIG) Assumption they aren't selling/brokering your data in some manner, WHEN they are breached (not a matter of IF, but WHEN) and ones accounts are cleaned out (worst case) and/or compromised (best case), what is Quickens Liability?

I see NOTHING specific to this and as of now, am shutting down 3rd party and entering data in. (as man of my 3rd party financial institutions are recommending..esp when you read all the fine print!).

This of course obviates the usefulness of the Quicken application and probably won't be using it much longer.

Interested in others specific input to primarily #2 & the question of Quickens Liability.

Thanks

mark miller

Update point to above given it just occurred (again)…

Quicken/Intuit "Middleman" services, aside from security concerns, yet another failure point. Wells fargo services down 2 days. If i had direct connect, it would have worked just fine.

Interesting no responses to prior post. Indicates a problem.

Quicken Kristina

Hello @mark miller,

The specific article you reference in your original post, https://www.quicken.com/support/changes-your-connected-services-quicken/ , is talking about the shift to the Express Web Connect + (EWC+) connection method that several financial institutions have done. Because you are authorizing through the financial institution's website, Quicken does not see or store your login credentials; the financial institution issues a token which is used authenticate with the financial institution so Quicken can download your account information into your file.

For information about how Quicken protects your financial information, I recommend reviewing this article:

https://www.quicken.com/support/how-quicken-protects-financial-information/

Whenever you go through the Add Account process in Quicken, you should see this screen:

It gives you more information about what data is accessed, as well as a link to our privacy policy, and reminds you that you're able to revoke permission to connect at any time by unlinking your account. It also provides a link to the Quicken Terms of Use.

I hope this helps!

mark miller

It doesn't. I"m aware of that It indicates "With this new connection method, you'll sign in to authorize your accounts directly from Quicken," —so 'man in the middle'. Similar to PLAID approach.

This doesn't address my various concerns/questions as i stated.

Primarily: WHEN they (quicken) are breached (not a matter of IF, but WHEN) and ones accounts are cleaned out (worst case) and/or compromised (best case), what is Quickens Liability?

Secondarily is the issue of going through Quicken Services to the financial institutions, unless you can tell me specifically how to avoid that ??

Also to state perhaps the obvious, its even more Quicken Exposure if NOT using a local install/copy and using Quicken cloud services.

Thanks
Mark