# Other bank accounts in your Monzo App? **URL:** \ **Category:** Feedback & Ideas\ **Created:** [12 October 2017 13:26 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231 "2017-10-12T13:26:43Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![alexs](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/alexs/32/2443_2.png) [@alexs](https://community.monzo.com/u/alexs)\ **Post date:** [12 October 2017 20:14 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/41 "2017-10-12T20:14:32Z")
Ok sorry, I hate to be a pain but I don’t think my question was clear. The relevant question is: how many other banks do users bank with - since each bank’s accounts can all be accessed using a single set of credentials - not: how many actual accounts do they have so… _Poll ([view on site](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/41))_ ---
**Author:** ![anon72173902](https://avatars.discourse-cdn.com/v4/letter/a/b38774/32.png) [@anon72173902](https://community.monzo.com/u/anon72173902)\ **Post date:** [12 October 2017 20:15 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/42 "2017-10-12T20:15:23Z")
Including Monzo? … ---
**Author:** ![alexs](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/alexs/32/2443_2.png) [@alexs](https://community.monzo.com/u/alexs)\ **Post date:** [12 October 2017 20:15 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/43 "2017-10-12T20:15:37Z")
No. The assumption is that you’ll be accessing the other bank’s account’s data through the Monzo app so you’ll be using Monzo regardless. That means that having a Monzo account doesn’t increase your exposure. ---
**Author:** ![anon73036778](https://avatars.discourse-cdn.com/v4/letter/a/839c29/32.png) [@anon73036778](https://community.monzo.com/u/anon73036778)\ **Post date:** [12 October 2017 20:58 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/44 "2017-10-12T20:58:40Z")
> [@alexs](#): > > I just have accounts with one other bank so I hadn’t considered that. Even so, surely one of your two banks being compromised is less bad than both? ---
**Author:** ![alexs](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/alexs/32/2443_2.png) [@alexs](https://community.monzo.com/u/alexs)\ **Post date:** [12 October 2017 21:25 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/45 "2017-10-12T21:25:49Z")
Eurgh you’ve just made me realise that the original question’s irrelevant. What matters is how much money is in the other accounts not how many are breached. Oh well 🙂 But as I’ve already agreed, all accounts (if your non-Monzo accounts have money in them) being breached would be worse than just your Monzo account being breached. ---
**Author:** ![anon93718513](https://avatars.discourse-cdn.com/v4/letter/a/d78d45/32.png) [@anon93718513](https://community.monzo.com/u/anon93718513)\ **Post date:** [13 October 2017 00:42 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/46 "2017-10-13T00:42:33Z")
> [@anon73036778](#): > > only a cryptographic hash of it. Nowadays that’s pretty irrelevant, it’s whether they’ve salted the hash function and are using something modern like SHA-2 (Edit: irrelevant as with JTR and some GPUs from AWS it’s trivial to brute force unsalted hashes. Most banks also have very restrictive password policies - 1 number, 1 uppercase etc, users are lazy so only meet the minimum and by feeding the policies into JTR it becomes very, very efficient) ---
**Author:** ![Toblerone](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/toblerone/32/22564_2.png) [@Toblerone](https://community.monzo.com/u/Toblerone)\ **Post date:** [13 October 2017 06:38 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/47 "2017-10-13T06:38:47Z")
I don’t mind this, but I’d prefer development to focus on Pots, Breakdwon etc, improving the Monzo current account before enabling me to view accounts which I use less and less. ---
**Author:** ![rarther](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/rarther/32/11565_2.png) [@rarther](https://community.monzo.com/u/rarther)\ **Post date:** [13 October 2017 07:15 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/48 "2017-10-13T07:15:16Z")
The best implementation of aggregation was Egg Money and that says a lot as they flopped 10 years ago. No matter how awesome you are it is going to be loads of entering passwords, connection errors and long delays while your incumbent accounts load. It is the opposite of a monzo experience and I would be more than happy to wait for psd2. ---
**Author:** ![anon43022926](https://avatars.discourse-cdn.com/v4/letter/a/d6d6ee/32.png) [@anon43022926](https://community.monzo.com/u/anon43022926)\ **Post date:** [13 October 2017 07:19 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/49 "2017-10-13T07:19:06Z")
I wouldn’t touch this until PSD2. ---
**Author:** ![adam.williams](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/adam.williams/32/99333_2.png) [@adam.williams](https://community.monzo.com/u/adam.williams)\ **Post date:** [13 October 2017 07:19 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/50 "2017-10-13T07:19:30Z")
No, this would not be a good use of development time at present given the state of the current account and the missing functionality there. Maybe in a few years. ---
**Author:** ![anon43022926](https://avatars.discourse-cdn.com/v4/letter/a/d6d6ee/32.png) [@anon43022926](https://community.monzo.com/u/anon43022926)\ **Post date:** [13 October 2017 07:25 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/51 "2017-10-13T07:25:08Z")
As far as I can tell - yes - anyone in the EC. ---
**Author:** ![anon94554600](https://avatars.discourse-cdn.com/v4/letter/a/278dde/32.png) [@anon94554600](https://community.monzo.com/u/anon94554600)\ **Post date:** [13 October 2017 08:18 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/52 "2017-10-13T08:18:00Z")
> [@anon73036778](#): > > The difference is that your legacy bank doesn’t actually store your password, only a cryptographic hash of it. So even if their security is completely breached, the hackers don’t get access to your actual password. Monzo, on the other hand, would need to store your actual password to use it to log in. So whilst you may believe that Monzo has a lower chance of being breached, the consequences of a Monzo breach if they did this would be far worse. One partner we’re considering has a great solution for this. They store the credentials encrypted, and we keep the encryption key on your device. It limits the scope of a breach to just 1 user, and attackers would have to break both the PISP/Aggregator AND your individual phone, and even then only 1 user is affected. ---
**Author:** ![anon73036778](https://avatars.discourse-cdn.com/v4/letter/a/839c29/32.png) [@anon73036778](https://community.monzo.com/u/anon73036778)\ **Post date:** [13 October 2017 08:24 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/53 "2017-10-13T08:24:01Z")
Hmm. On first glance, that sounds reasonable, but with security the devil is in the detail, so I’d want to see more detail and think about it a lot more. certainly sounds better than storing plaintext passwords though. ---
**Author:** ![jzw95](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/jzw95/32/5896_2.png) [@jzw95](https://community.monzo.com/u/jzw95)\ **Post date:** [13 October 2017 08:29 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/54 "2017-10-13T08:29:04Z")
Ok, in my [initial answer](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/10), I was clearly underestimating the ability for Monzo to not hold login details centrally, and more generally the thinking that has already gone into the security implications/limiting the fallout from a security breach. The more this thread has gone on, and Simon’s filled in details, the more I think I _would_ use a Monzo aggregator service even if it wasn’t using an API for everything. Especially given: > [@anon94554600](#): > > but PSD2 only covers current accounts I wasn’t previously aware of this, and the account I most want to view in the Monzo app is my credit card account. In a best case scenario, the data from it will be opened up using an API along with the bank’s current accounts, but if not, I would most certainly like to see Monzo come up with a secure, reliable solution to pull these data into the app. One thing I think you will have to consider with a service like this, is the communication about it needs to be very clear (but concise!) to put people’s minds at ease over sharing login details, both from a security standpoint, and not breaking their bank’s T&Cs. ---
**Author:** ![Feathers](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/feathers/32/45868_2.png) [@Feathers](https://community.monzo.com/u/Feathers)\ **Post date:** [13 October 2017 08:34 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/55 "2017-10-13T08:34:30Z")
From the inception of this thread, I was a pretty hard “No” vote. This is something I really want to see but the security concerns push the desire aside. As things have gone on, however, I’m starting to teeter towards a “maybe” depending on how the security stuff pans out. ---
**Author:** ![nanos](https://avatars.discourse-cdn.com/v4/letter/n/c89c15/32.png) [@nanos](https://community.monzo.com/u/nanos)\ **Post date:** [13 October 2017 08:38 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/56 "2017-10-13T08:38:35Z")
> [@anon94554600](#): > > One partner we’re considering has a great solution for this. They store the credentials encrypted, and we keep the encryption key on your device. It limits the scope of a breach to just 1 user, and attackers would have to break both the PISP/Aggregator AND your individual phone, and even then only 1 user is affected. Apart from the fact that I still believe that the only one who is permitted to save passwords using any kind of reversible encryption ever is my password manger, the other problem with that is that you still need to share your password with someone. I have a fundamental problem with that. A password is used to authenticate for a given account, and for nothing else. Never share a password with someone else. It’s just that simple. (Although, even I make one exception to that rule for my wife, but there we go.) Also, never ask your users to share their password for x with them. It’s that simple. And I really think it is **very** irresponsible of any organisation to ask users to share their passwords. That is training them to fall for phishing. Any org that asks users for their password gets immediately downgraded on my internal scale of trust. [That includes Apple](https://www.troyhunt.com/apples-desensitisation-of-the-human-race-to-fundamental-security-practices/). Incidentally, as I have outline elsewhere, [Monzo doesn’t come across as being too good in security to me (2nd-last para)](https://community.monzo.com/t/monzo-source-of-funds/24764/29), so that gives additional cause for concern. ---
**Author:** ![SeMond](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/semond/32/13888_2.png) [@SeMond](https://community.monzo.com/u/SeMond)\ **Post date:** [13 October 2017 09:31 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/57 "2017-10-13T09:31:26Z")
I feel like legacy banks are good at making it feel secure because it’s nearly impossible for me to access my own accounts. I don’t think they’re nearly as secure as they seem. Monzo has great usability and I’m not worried about their security at all. I protect my phone well because there is a lot of sensitive information on it, not limited to banking and I can still phone my bank to freeze cards etc. ---
**Author:** ![adam.williams](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/adam.williams/32/99333_2.png) [@adam.williams](https://community.monzo.com/u/adam.williams)\ **Post date:** [13 October 2017 09:37 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/58 "2017-10-13T09:37:49Z")
> [@anon73036778](#): > > The difference is that your legacy bank doesn’t actually store your password, only a cryptographic hash of it. I don’t believe this, not with RBS doing things like asking for specific characters of the password. I think we all agree they _should_ do this (ideally a slow memory-intensive password focussed hashing function like BCrypt that’s resistant to specialised hardware) but I don’t have a lot of faith. ---
**Author:** ![anon93718513](https://avatars.discourse-cdn.com/v4/letter/a/d78d45/32.png) [@anon93718513](https://community.monzo.com/u/anon93718513)\ **Post date:** [13 October 2017 10:13 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/59 "2017-10-13T10:13:27Z")
> [@adam.williams](#): > > I don’t believe this, not with RBS doing things like asking for specific characters of the password. There is a way to handle this securely with reversible encryption and some complicated hashing functions: [cryptography - How do some sites (e.g. online banks) only ask for specific characters from a password without storing it as plaintext? - Information Security Stack Exchange](https://security.stackexchange.com/a/4835) > [@adam.williams](#): > > ideally a slow memory-intensive password focussed hashing function Why? Slow and memory intensive does not make it secure? MD5 is fairly slow and it’s completely insecure. ---
**Author:** ![adam.williams](https://dub1.discourse-cdn.com/monzo/user_avatar/community.monzo.com/adam.williams/32/99333_2.png) [@adam.williams](https://community.monzo.com/u/adam.williams)\ **Post date:** [13 October 2017 10:30 UTC](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231/60 "2017-10-13T10:30:49Z")
It’s still less secure than a hash that can’t be reversed, even if there’s a HSM involved. You shouldn’t be encrypting passwords with a symmetric cipher, I don’t care how complex your set-up is. There’s just no reason for it and it’s additional risk. And yes, BCrypt being memory intensive and slower _does_ make it secure. MD5 is a poor example comparatively, BCrypt was designed to be difficult to create specialised hardware to brute force passwords with and has a configurable cost to enable you to keep up with Moore’s law. Scrypt is also a good example here because it deliberately uses exponential memory. Take a read of [http://www.sciencedirect.com/science/article/pii/S0167926005000581](http://www.sciencedirect.com/science/article/pii/S0167926005000581) for example and you’ll see how people have implemented other password hashing functions with an ASIC. If you read up on the history behind BCrypt and Scrypt you’ll see they were designed to make this difficult. [Previous page](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231.md?page=2) [Next page](https://community.monzo.com/t/other-bank-accounts-in-your-monzo-app/25231.md?page=4)