Having been in fintech for a while, I’ve noticed something in common between the many new startups that come and go. They all require access to personal information. A specific example that comes to mind is the Plaid-like solution we developed while working on amal. We’d ask customers for their bank credentials[ajy] and then proceed to login on their behalf in order to share the resulting account information with the 3rd party application they are using (e.g. for transferring money, tracking their spending, etc). I’ve noticed similar things with companies that try to optimize the checkout experience – almost always by becoming the interface layer that users use, necessarily being exposed to sensitive cardholder information like the card number, CVC and even PIN number in some instances[axo]. The problem in all of these situations is that these apps require users to trust them, but provide no means for verification that this trust is not misplaced. “Trust, but verify” — Russian proverb Is there a better way? Some Assumptions Many throw their hands in the air and point to the protectionist practices of financial institutions that prevent data sharing — without APIs, the only real option for authenticating users is with the same credentials they use themselves. To explore better ways forward, let’s make a few assumptions (and eliminate thorny edge cases that frontload a lot of complexity): The application handles sensitive data It performs a deterministic task (i.e. same inputs result in the same output) It does not rely on state The application doesn’t keep logs (or retains anonymized and desensitized logs to aid in debugging) What we’re after Let’s be clear about what we’re after. If an app holds the assumptions we set earlier, then we should be able to use that app in a way that allows independent third parties to verify that the app is doing exactly what it says it’s doing. In the case of a checkout app for instance, we should be able to verify that it’s not stealing customer’s card details and siphoning them off to the Russian mafia. Front-end applications This is simple-enough to do, to some extent, on front-end applications – because we can inspect the code ourselves (albeit, obfuscated code to an increasing degree). Still, worst case we’d still be able to track network requests being made from the application – as well as any usage of local storage to ensure there’s nothing fishy going on. Backend But what about the backend? They are completely opaque to anyone outside the server; true black-boxes, where only the inputs and outputs can be observed, but not what’s performed inside. This is exacerbated by the fact that front-ends are also the front-lines of the war against all sorts of user-side attacks (CSRF, poisoning, etc). This has resulted in things like CORS, that prevent clients from making HTTP requests that would otherwise work completely fine on backends. Options For Greater Transparency 1. Fatter front-end’s for security [ajy] It’s so sad that it’s come to this. Sharing bank credentials with 3rd parties should never be ok, and yet it seems to be the only practical way that third party apps can communicate with financial institutions.

Been having a hard time lately focusing. It’s like whenever I start doing anything of any significance I get derailed, and fall into this spiral of thought where I reconsider whether what I’m about to do matters, why it would, and whether I could be doing something else that would be more “productive”. The end result is that I end up doing nothing (no, the irony is not lost on me). This is a strange state for me to be in, because it isn’t one I recall having gone through before. I’m usually able to operate at a high cadence, get stuff done and just generally apply myself to projects with high autonomy and little structure. I think it may have something to do with the overall situation around COVID, and that I’ve been effectively operating indoors for the past 9 months (!). Cafes, restaurants and most public places are still take-out only, so this makes it difficult to hang out in person (if you’re not working at an office). I don’t know if these are symptoms of depression, or if they are just general apathy resulting from severely diminished social contact. Maybe it’s a bit of both? Again, don’t recall ever having going through a “proper” episode of depression before, so I’m unsure it is in fact that. I was reading about it on Wikipedia yesterday and came across an article describing negative self-talk, something I definitely encounter alot more as of late. The article suggested Cognitive Behavioral Therapy (CBT) as a solution (in addition to exercise, which I do a few times a week already). CBT is a program often run by a counselor (in-person) and involves examining the Behavior, Thoughts and Feelings of a subject in order to pinpoint the specific behavioral pattern that needs to be changed (either intensified, or diminished). This all sounds great in theory, but finding a therapist that I trust to do this sounds like a real chore - especially in Bahrain. I’ve found online providers that delivery virtual therapy; I’ve also read that CCBT - Computerized CBT (delivered primarily via apps) can be effective if used consistently. And so that’s what I’m doing now - using an app called MoodKit (iOS only) that sends me occasional triggers to jot down what I’m thinking, and walks me through the process of assessing my thoughts to see if they’ve fallen victim to “distortions” (yes, you bet they have!). I’ll report back once I’ve had at least a few weeks of experience with it and let you know how it all went. Of course, I don’t plan to just sit around all day while I wait to get better. I want to apply myself, to express myself creatively, and make something useful. But that’s the operative word: “something”. Like, “one thing”. Not 500.

It used to be that you needed to know Kotlin and Swift to develop apps for both Android and iOS, but those days are long gone. Even the fundamental reasons for doing so have changed — some sort of compromise between performance and speed to deployment. React Native apps were kinda slower than native apps by a smidge, but with the introduction of Flutter — that difference was wiped out almost entirely. With Flutter, you get native app performance because you leave HTML and JS behind. Getting the Basics Flutter has an excellent reference for web developers that I found more useful than alot of the intro guides out there. I don’t need to know what a variable or for loop is — just tell me the concepts I need to hit the ground running. Coupled with this brief high level overview it’s pretty much all you need to understand Flutter conceptually. Getting up and running with Flutter, quickly A great place to start was to quickly paste snippets from the web developer article I mentioned above into DartPad and see the results immediately. This gave me a feel for how things works in Flutter land, without fretting too much about setting everything up locally. A+ Resources Build a sick planet app from scratch. No fluff, all goodness. Loved recreating this myself. Flutter Layout cheat sheet Build a functional Startup Name Generator, start to finish, from scratch Comprehensive reference for more great resources on Flutter 👉 Stay tuned for my first app on Flutter, in a future post!

Yes, that’s right. The best bank in Bahrain is … Meem. This nomination will be especially shocking to those of you that read my last post that ripped the Meem app to shreds. Criteria for ‘best bank’ My criteria for “best bank” isn’t the best user experience or customer support. It’s all about the best bank for buck. There are two main parts to this: What’s the best cashback rate I can get back on my spending? What’s the best profit rate I can get back on my deposits? While I always limit myself to shariah-compliant options, you’ll soon see that the rates Meem offer are actually superior to even the non-compliant options in Bahrain. Cashback 💳 I’m always befuddled when I’m standing in line at the cashier and see the person in front of me whip out a debit card. Why on earth are you paying with a debit card?? Paying with a credit card that has Cashback is literally free money (assuming, of course, that you pay the bill in full at the end of each month). Here are the cashback rates for the Meem credit card[1]: 1% cashback for spending below BD 500 a month 2% cashback for spending between BD 500 — BD 1000 a month 3% cashback for spending above BD 1000 a month (capped at BD 50) Take a second here to recognize how insanely good these rates are! Not just at the local or regional level … even globally. You’d have a hard time finding a card that offers more than 2% cashback in the US; see for yourself[2]. As for Bahrain, no bank even comes close. Here are the cashback rates for a sample of popular Bahrain banks: Ithmaar Bank — 0.2% NBB — 0% Credimax — 0% on local purchases; 1% on international Not. Even. Close. I hit the 3% rate consistently with Meem (since I use my card for paying alot of my online business bills), and this means BD 50 of free money each month, or BD 600/yr. Nuts! Return on deposits 💰 These are typically known in the industry as “fixed-term deposits” (or Fixed Deposits). This means locking up your money for a fixed period between 1 month and 1 year, with a guaranteed rate of return (always quoted per year, regardless of the term you pick). While fixed deposits are not Sharia compliant, Murabaha is — a variant where you purchase something from the bank (usually a commodity, like cement) and sell it back for a profit at the end of the term. Once again, the rates Meem offer are higher than anything I’ve seen offered by any other bank in Bahrain. Fixed deposits are tricky to compare since the rates change during the year (with the change in the base rate by the CBB), and they also vary by currency. Here are the rates for Meem in January, 2020[3]: 2.33% on USD (90 day term) — no minimum 1.17% on BHD (90 day term) — no minimum Obviously, huge difference between BHD and USD — and so you’re better off converting to USD when you deposit. Meem makes this easy by offering multicurrency accounts (the BHD/USD rate is capped by the CBB; Meem provides a significantly better rate of 0.3765 BHD/USD vs the 0.375 BHD/USD that most banks in Bahrain provide). So, 2.33% for Meem. Let’s compare to a few other banks in Bahrain, shall we: KFH: 1.85% BHD (90 day terms) — BD600 min. Citi: 1.75% BHD / 0.85% USD (90 day terms) UPDATE: A friend tipped me off to Jazeel, a Digital Bank launched by KFH, that offers Wakala rates that match Meem’s USD rates but for BHD[4]. Details: KFH Jazeel: 2.3% BHD (90 day terms) — BD1000 min. If you can meet the BD 1,000 minimum then they’d be a better option for BHD deposits than Meem’s. I’m unable to provide more links to banks in Bahrain, because they don’t share the rates online. To my knowledge, the rates are less competitive than those of KFH cited above (and Meem, of course). If you’ve got more numbers for me to include, please let me know. Conclusion Using Meem’s financial products can earn you: BD 600 / year in cashback BD 23 / year for every BD 1,000 you deposit (on a USD denominated Murabaha deposit @ a 90 day term) That’s better than every other bank in Bahrain I’ve come across, and they are Sharia compliant. There you go, folks — you’re welcome! Share this post around if you found it useful. 👣 Footnotes [1] Meem isn’t very forthcoming on their website about the cashback rate, simply saying that they offer “up to 3% cashback” on credit card purchases. Their app provides the breakdown that I shared. [2] Any rates over 2% are usually guarded with multiple qualifiers limiting their utility specifying either merchants or a specific category that is included, and always capped at a very low yearly amount. [3] Not shared on their website, but available in the app. Screenshots below: [4] Not shared on their website, but available in the app. Screenshots below: