I didn’t see any link to https://wwws.mint.com/login.event on the landing page, but I’m glad to know that a secure login page is available….somewhere.

However, my original point still stands. HTTPS uses SSL/TLS which provides three important things:

1) Confidentiality. Strong encryption is used between the client and the server. This ensures that nobody can read what is being transmitted.
2) Authentication. Digital certificates and signatures are used to verify the server’s identity. This ensures that the amazon.com you are connecting to is the true amazon.com.
3) Integrity. Message authentication codes are used to verify the data that is being transmitted. Because only the client and the server are able to generate valid messages, these ensure that no attacker is able to modify data while in transit.

The Mint login does not offer #2 or #3 because the landing page is not served over HTTPS. Without HTTPS, it is trivial for an attacker sitting in a Starbucks or a Panera to conduct a man-in-the-middle attack which modifies the contents of http://www.mint.com/ . If the HTTPS submission link is replaced with one that is HTTP, #1 is lost, and the email address and password will be transmitted in the clear for anyone to see.

You can verify this in the page source of the main page.

If anything, you can just bookmark https://wwws.mint.com/login.event for the extra peace of mind. They probably should make the issue more clear though.

The strongest encryption in the world doesn’t matter if it’s never used!

I was eager to set up an account with Mint after all the rave reviews I’ve read, but I was surprised disappointed to discover this flaw, which went unreported.

I still very much want to take Mint for a test drive as I think everyone could benefit from this kind of tool, but this is a dealbreaker! Until this extremely foolish and risky setup is corrected, I won’t be using Mint and will be advising others to stay far away.

Nickel: Man I sure do. Sorry about that.

Cindy: I’ve been using Yodlee’s Money Center (which is also used by Mint) for quite awhile now, and it certainly isn’t perfect. I have a feeling it will never be an error-free experience, but on the other hand, I’m not exactly paying for it so for me personally, it’s not too big of a deal. Main reason why I still keep an excel spreadsheet around, plus I don’t track my money every single day as I use to (when I was in debt).

Matt #2, Jodi and Chris: Security is definitely something everyone should consider whenever they utilize a third party software to access their financial information (whether it’s an online or offline application). Before I go further, I should note that I worked at Mint during the summer, so the viewpoints below may be biased (although I’d like to think that I’m being neutral for the sake of readers).

There’s a few reasons why I’m okay with using services such as Mint. For one thing, Mint uses Yodlee to aggregate financial accounts, which is the same service that Microsoft Money and Bank of America My Portfolio uses. Secondly, Mint doesn’t require personal identifiable information to use the service. You only need to input an email address, zip code, and password of your choice – so you are fairly anonymous when you use Mint. It doesn’t ask for name, birthday, address, and it certainly doesn’t ask for SSN. In keeping with limiting information, financial accounts are also stripped of their accounts numbers on Mint.

As Chris said, it’s true that even big financial institutions have been hacked before, but that’s mainly the reason why Mint limits the collection of personal identifiable information. If someone was able to gain access to the data, they will only know limited information: that is, someone somewhere likes to frequent Starbucks.

The service is also independently verified by Versigin, the privacy policy is TRUSTe certified, and of course it uses SSL encryption.

As for data ownership and rights, the privacy policy and terms of service clearly spells out that your data is yours. Your personal information will never be sold or rent to anyone, for any reason, at any time.

In regards to physical data protection, Mint’s servers are in an unmarked, secure facility and access requires multiple levels of authentication, including biometrics scanners. Security personnel monitor the system 24/7. In addition, a Network-based IDS (intrusion detection system) provides 24/7 network monitoring and alerts security personnel to any external attacks on the network.

Here’s my personal view and stance on online security: I’m aware of the risk involved in utilizing online services in return for the convenience and easier access to my data. I minimize those risk by keeping an eye on my accounts (by using said services, which is a bit ironic because they may potentially expand the risk). I limit the spread of my personal information, I change my passwords frequently, I read EVERY privacy/security policy of every service I use, I’m aware of the necessary steps to take when I suspect fraud or problems, and I only utilize accounts/brokerages where transfer capability are behind a separate password than those of login password.

At the end, all of this is fairly moot if you are not comfortable with online banking or utilizing online financial service (completely understandable). I highly encourage everyone to read Mint’s or any other service’s legally binding policy, terms and condition so they understand the rights and protection they have when they use services like these to handle sensitive data.

P.S. Sorry for the late response. Have been out of town.