We have been working hard to provide fully automatic synchronization for a broader set of financial institutions. Last night we took a big step forward in this direction. Buxfer now supports fully automatic and secure synchronization with any financial institution in the world. Well, at least the ones that let you download statements in Quicken/MS Money format.

For around 300 institutions, we already supported synchronization via our web interface. However, you had to login and manually synchronize each account. We now provide you with two options for automatic synchronization:

• Automatic sync every night: You can choose to encrypt and store your username/password on our server, and your account will be automatically synchronized every night.
• Automatic sync on every login: You can store your username/password offline on your computer using Google Gears. Every time you login, new transactions will be automatically downloaded into your account.

For institutions that can not be synced from the web interface, we have released Firebux, a Firefox add-on which automates the process of downloading your bank statement and uploading it into your Buxfer account.

• Automatic: Show Firebux once how to download a statement from your bank’s website, and thereafter Firebux will do it automatically
• Secure: Store private data securely on your computer, and never share it with our servers
• Convenient: Quickly access account balances, analysis charts and budgets

Transactions in your bank or credit card statements which are actually account transfers show up as expenses (sometimes in multiple accounts). Its quite a hassle to manually mark each one of these transactions as an account transfer. Last night, we released a feature which gets makes this a lot easier:

• Mark as account transfer: The ‘Actions’ menu for each transaction contains an action to quickly edit a transaction into an account transfer
• Automatic account transfer detection: You can automate the rule for detecting account transfers. For example, you can set up a rule which says

  always mark transactions matching ATM Withdrawal as transfers from my Checking account to my Wallet

We have changed our API in an important way in order to prevent Cross Site Request Forgery attacks. APIs which use implicit authentication - e.g., HTTP Basic authentication or cookies - are vulnerable to such attacks.

What’s the change?

1. We have added an explicit ‘login’ command which returns a “token” for the session if the login is successful.
2. Subsequent commands in the session must all include this token in order to be processed.
3. The token expires after a “reasonable” time-out — on the order of 10 minutes or so.

I hope it will not be too much of a hassle for you to adapt your scripts. Security is paramount when it comes to handling finances.

No its not an April Fools gimmick. We have added an easy way to synchronize all your bank and credit card accounts. Click on the ‘Synchronize all’ link you see on your account summary page, and you will see a list of your accounts that can be automatically synchronized. You can login to them all at once, and download all your new expenses in one go. You can use Google Gears to store these credentials offline on your computer, so next time you don’t even have to type in your username and password.