Scraping automates the extraction of website content or data. In screen scraping, a third-party application captures a user’s bank credentials, logs in as that user, and retrieves account details or performs operations. section 10.1
Unrestricted scraping can create security and business problems:
- Exposed credentials give third-party applications broad access to private data and account operations. section 10.1
- Automated scraping can be difficult to distinguish from legitimate activity, enabling attacks against websites and sensitive business flows. section 10.1 section 4.9
- Mitigation can include checking user agents, limiting headless or command-line access, serving CAPTCHA challenges, and measuring timing across multistep flows. section 4.9
Figure 10.1 In screen scraping, bank customers share their account credentials with a third-party application that uses those credentials to log in to the bank’s website by impersonating the customer.
Visualizes how customers hand credentials to a third-party application that impersonates them on a bank website. section 10.1
