MintcomIf you read the articles from major news carriers or ezines, mint.com is safe and secure. If you read the security pages on mint.com they have implemented a number of security protocols, and procedures to protect your data. Let me just say this, no system is completely safe. No computer system is 100% foolproof, save the one that is locked in a room and never turned on without any outside connection.

At the same time, should you never use it or similar financial services? A clarifying question is this: Do you ever give your credit/ debit card to a waiter in a restaurant? Do you ever purchase online? Of course you do. So the issue is the risk, and your comfort level with it. What is risk? There are a number of risk formulas most involve the threat, the probability and the vulnerability.

Threat: What is the worst that could happen? More specifically, what individual occurrence could happen that presents intent to do harm?
Probability: Could it happen? What is the likely hood you will be selected as a target? Do you present a more likely target than others?
Vulnerability: How can it happen? That is what could be exploited to cause harm. This can be further qualified by adding a qualitative value, that is, not just how could it happen, but what does it cost me if it does?

You can apply mathematics to this and scaling the results. Most of us do this on a microcosmic level every day. Imagine you are in a cafeteria, having just paid and the school bully is between you and your table. You likely ask yourself these questions: (Threat) what if the bully interferes with me? Can I avoid spilling my soup? (Probability) He/she hasn’t bothered me all week. He/she is staring at me now. (Vulnerability) He/she could trip me. He/she could make fun of my clothing/food choices/etc. If he/she hits/trips me, or I respond with aggression, what will it cost me?

My point is this, given that no system is 100% secure, there is a certain amount of risk inherent to any system, and especially to any system that would connect to your financial and or personal identifying data.

So what are the risks of using Mint.com or any online tool to monitor and track your finances? At a high level you could say:
Threats: Someone could hack their system. Someone could hack my system/device. Someone at my bank could compromise my information.
Probabilities: Target was hacked. U. of Maryland was hacked. Paypal was hacked. All had a data breach this year, what prevents mint.com from suffering the same fate?
Vulnerabilities: In a scene rivalling Mission Impossible the attackers bypass layers of physical security, and then network security and computer security to pick out my account information. They could use phishing or spear phishing emails to glean my account information. They could steal my tablet/phone. It would cost me …?

Let’s take a step back and talk about what mint.com is actually doing. When you register for mint.com you provide them with an email address, password and zip code to create an account. The same data is used for connecting. Once registered, you’ll have to provide your financial institution name, user credentials and password. You can provide checking/savings, investments, loans, mortgage and auto information. You can also provide information on reoccurring bills like insurance, phone bills, etc. Their website says that mint.com will then help you make better financial decisions by categorizing your expenditures and looking for better offers for you. Mint.com’s interface is clean, colorful, and simply designed.

According to mint.com this is read only access, meaning it can see everything but cannot execute a transaction on anything. That is, you cannot transfer funds from your savings to your phone bill. You can also setup email and text alerts that notify you about any large purchases or unusual changes in your accounts. At the same time, access to this data about you, would help any would be attacker gain a great deal of personal information about you, where you keep and where you spend your money.

In reading the security related pages from mint.com, the application does some level of secure communications. They don’t connect your name to your financial data, which should make collecting Personally Identifiable Information (PII) difficult. Without getting ‘under the hood’ of their security we have to make some assumptions about what they say. Likely, they use different application configurations that are complex to setup but provide a great deal of security, or security through obscurity. They encrypt user credentials, and have a complex physical security plan for their servers. 128-bit encryption sounds big, but it is actually the lowest level of three levels in the Advanced Encryption Standard (AES), yet it is still an incredibly complex algorithm. We don’t know how they handle tokens or cookies and other session management.

Their documentation uses the phrase, “We apply bank-level data security standards”, which sounds impressive but is it? There is no standard with that name that I’m aware of, but you’ll see it frequently on sites that collect/use financial data. If a vendor like mint.com referenced compliance with, Payment Card Industry (PCI) Data Security Standard, or ISO 9362 for banking telecommunications, ISO 13616 for International bank account number, or even more generically ISO 27002 Information technology – Security techniques – Code of practice for information security management, that would be notable because those are real standards to be measured against. Ideally, every request within mint.com would include some measure session management and validate/authenticate a user’s credentials. Without looking at their program I don’t know if that is or is not going on.

On a more positive note, they do take a number of measures to ensure security like running their own penetration testing, that is attempting to hack their own site. They scan and test against know threats and techniques, and provide support for suspected phishing attacks. This provides valuable information to aid them in securing your data.

So again, what is the risk? For the sake of argument and avoiding every “what-if” scenario I’ll focus on two possible risks:
Threats:
A) Someone could shoulder surf and know how much I’m spending my money.
B) Someone could steal my credentials and use them to move money against my will.
Probabilities:
A) Shoulder surfing happens all the time.
B) Probability on this occurring via mint.com is very low. More likely users would compromise their credentials exclusive of mint.com
Vulnerabilities:
A) Shoulder surfing in itself is harmless; rude some might say but harmless, it costs me nothing.
B) Should your banking credentials be compromised, of course there is theft, identity theft, and the very real risk that the bank/brokerage would tell you they are not liable should your credential theft be traced back to a site like mint.com. After all, banks and brokerages are constantly telling consumers to never share their credentials with any third parties.

Is mint.com safe? It is surely safer than keeping your financial data in a trapper-keeper® that you carry with you everywhere. Probably safer than that android app with a piggy bank as its logo, but maybe not as safe as the tool your financial institution or brokerage offers.

Related links from mint.com:
Mint security FAQ https://www.mint.com/how-it-works/security/faq/
Mint privacy and security policy https://www.mint.com/how-it-works/security/policy/