Pie Palace

In my mind, one of the defining characteristics of “Web 2.0″ is the idea that a website should be a forum for users to create and share content they care about. It isn’t about technologies (such as AJAX, CSS, and tags), it’s about the user model.

The first foray of Web 2.0 that I’m aware of is Wesabe. The gimmick behind it is that it watches your accounts at various financial institutions, and provides you with a common way to browse all of those accounts. Their privacy policy states that the good people of Wesabe will happily sell and anonymized version of your financial history to third parties. In return, users get to pay for the privilege of seeing their account information aggregated into one place, and they get to see tips that other users write.

It’s a nifty idea, but I’m not entirely sure what’s in it for the user. When I originally heard about the service, I assumed that it was aimed more at investing, rather than personal account management. What kind of tips can people give me? The demo shows really enlightening stuff like “Don’t shop at Trader Joe’s when you’re hungry!” and “Keep a tally of the cost of the stuff you put in your cart!” Granted, those are only placeholders for real advice that will come from users, but still, I have a hard time seeing how the advice could be that much better.

On top of the $5 a month that the user is supposed to spend so that they can see little bar graphs of their expenditures, the user must also give Wesabe access to their financial accounts. The weird thing about Wesabe is that the account monitoring is performed on the user’s machine. The user installs a program on their box, which they feed with their account details. The program hits the websites as requested, before dumping the semi-anonymous and (theoretically) secure information onto the Wesabe server. Although this probably makes the user feel good (”Hey! My account details stay on my home computer!”), I suspect that the average home machine is probably much less secure than a well run corporate data centre. Then again, I wouldn’t trust Wesabe to store my financial details any more than I trust my home machine to store them.

Regardless where the data is kept, it’s ripe for wholesale theft. In the case of being stored on a corporate server somewhere in the middle of nowhere, the attacker would have to be technically knowledgeable about the defending infrastructure. In the case of being stored on user’s machines, the attacker needs to be able to craft a virus or worm capable of looting that data. In either case, once the data has been stolen, it’s up to the users to play damage control. If half of your savings suddenly disappear out of your account, too bad: it’s your problem, not the institution’s or Wesabe’s.

I guess it comes down to this: what are little bar charts and brain-dead tips worth to you? What portion of your current bank balance? How will your bank react when you tell them that you shared your account information with an anonymous company that accepts no responsibility for the problems with their software? Will they say “Shucks! That $2k that was just wired out of your bank account wasn’t worth much to us! Here, have it back, and here’s an extra $1k for being a Web 2.0 kind of person. Go buy yourself a new iPod, you crazy hipster!” or will they say “That violates the usage agreement of our service. We accept no liability for your losses. Your willingness to give away financial information indicates that you’re a bit of an idiot. Would you like to sign up with our brokerage?”

Financial institutions should provide two kinds of electronic access to accounts: read-only access to records, and owner access to control monetary transactions. Each would require a separate username and password. That way, services like Wesabe could still charge users to read their own records; without exposing the folks that use those services to risk of theft.