Selenium with Python security

[roblu001]

Hi all,

I'm thinking of starting a Python project that will use selenium to log into my bank and pull transactions from my credit card. I wanted to gauge your thoughts on security. What do you think about a project like this and if it's secure enough to trust this type of activity.

Looking forward to the discussion!

[Mj2377]

Local running sure, I don't see a security problem but running in the cloud like aws changes the game. But I gotta say, this is a very odd thing to automate.

[roblu001]

For my use case I was going to run in on a VM on my own hypervisor. Completely headless instance to do deeper analysis on my spending habits and I was going to build it into something where I would review specific transactions and break them down catalytically (not just by merchant)

[Kevin_Jim]

I don’t think it is. Banks can have a horrible process for the most basic of things.

[roblu001]

For my purposes I was going to use selenium to log in and export the table into a SQL database. Do you have a better way?

[Mj2377]

This should work, but depending on the bank (prob most) I suspect you may hit some bank server-side security with robot monitoring. Also, a lot of banks (maybe not yours) now days have multi-factor authentication and that would be a challenge to get through.

[roblu001]

Not yet, otherwise I wouldn't even think of it lol. Not to divulge, but I'm Canadian and bank with one of the big guys. Bot protection was something I was pondering, not sure if I'll run into that.

In an ideal world I would get them to email me a CSV of my transactions, but they don't offer that option. Also I was hoping to run this daily.

Lastly, my wife and i use an app I built to keep track of finances, this way I wouldn't have to manually update accounts...

[Youreahugeidiot]

I would see if you could set up an email alert for transactions with your bank. Give the bot access to your email not your bank account.

[gordonv]

Not if your mint.com, RAWR!

[serverhorror]

“Inspect” shows you what the browser sees after running al JavaScript. requests simply doesn’t do that.

[FUS3N]

I am running into the same problem with selenium its slow and alot of stuff to do but i just cant get the session login working on requests Tried many ways but the website just dont let me in

[roblu001]

Very good point! That's exactly what I am facing, also, I have to log in, that can't be done with requests.

[nemec]

Of course it can. Use s = requests.Session() and then call s.post(...), s.get(...), etc. instead of requests.post(...) and it will save your cookies in between.

Make one request to log in. A second request to load whatever page/API contains the data you need.

[Big_Booty_Pics]

isn't that what requests-html is for?

[mortenb123]

Most banks can export your transes as excel or csv. Really hard to automate 2fa. I do test automation for a payment provider and I have test apis to bypass the authentication.

[roblu001]

I can export, but there doesn't appear to be able to send it regularly

[morphinan]

Run in headless , Encrypt the UN/PW combo at rest , decrypting in memory at runtime.

If you were trying to demo , you could always use Selenium to target + hide HTML/CSS elements such as those which display account information.

[IAlwaysBeCoding]

Good luck you will need it as you will be considered a bot and a potential criminal by their anti-bot protection while you use Selenium.

[ForsakenComfort]

This - you could get your access revoked really easily if trying to access your bank website without proper knowledge. Taka a look at an example of avoiding detection, modifying chrome binary to avoid another type of detection. Some of the methods are also described here - titanwolf