261–270 of 333 posts
Earlier quoted context omitted.
> does not work if you have 2FA enabled Plaid definitely works with BoA + 2FA, at least as of about a month ago when I had to use it.
Just tried again as I don't wanna be accused of making things up: https://ibb.co/KGMhFXF
Earlier quoted context omitted.
This is a sham. You need to go through lots of audits & other administrative BS in order to be declared an "AISP" even if you don't actually process banking data yourself and it never leaves the user's device. Imagine PCI-DSS compliance but without the exception that you don't have to be PCI-compliant yourself if you don't touch card data and pass it directly to a PCI-compliant payment processor.
It might look dreary to you from a distance, but for us on the ground, it is working. My bank is already offering to show any other banks’ statements along my accounts.
>7 points by Rainymood on June 21, 2016 [-]
>I'm going to be really rude here (forgive me) but I feel like every time a security question comes up you dodge the question really hard.
>I want to know one thing: If I log into your service with my bank credentials. Do you store these as plaintext files (or "encrypted" files of which you have the encryption key)? Yes/No.
>Furthermore, congratulations! I've been trying to start something up like this in Europe but I feel like there are way more restrictions in Europe on banking data and this kind of third-party aggregation. Sorry for being so rude.
Here is some previous news on Plaid on HN.
* 2016-06-20 Fintech Firm Plaid Raises $44M (wsj.com)[1]
* 2018-12-11 Fintech startup Plaid raises $250M at a $2.65B valuation (techcrunch.com)[2]
* 2020-01-14 Visa Buys Plaid (wsj.com)
[0] https://news.ycombinator.com/item?id=11939103
I support this big time. Plaid is a complete joke -- "give us your bank passwords and we'll validate your account". Banks are an even worse joke -- "20,000 logins today from one IP address, nope that's not a scam". Plaid customers are the worst. Like Transferwise, you cannot setup a business account with them without giving Plaid your business banking passwords. What company treasurer would allow that? Now that Visa…
Banks (at least the big ones) often block aggregator traffic. This is resolved after speaking with them. The usual resolution is to whitelist specific IPs for massive traffic.
Plaid is terrible! Both Wells Fargo and Bank of America support API integration, but Plaid chooses to screen-scrape and does not work if you have 2FA enabled. Also, you can't even manually enter your bank information. In other words, even if you pay dearly to Plaid, you may block many users who use some of the top banks in the States! There is a bunch of services I cannot use because they rely solely on Plaid, and I'…
Both Bank of America and Wells Fargo do technically have APIs, though they're limited in scope to corporate accounts for treasury purposes. I've applied for access to both and both declined to even a sandbox account.
Earlier quoted context omitted.
No issues with customers linking Plaid. If your company is ONLY supporting Plaid then your issue is that your smarter customers are leaving.
I can confirm this. I really want to use the trading platform Gemini but will never cave to Plaid. Any organization that asks for your personal password is nefariously normalizing this behavior and building complacency in consumers to trust anyone with their private information.
Plaid's product is absolutely absurd. Yes, please train your users to type their username and passwords into third party sites because they're given a legitimate looking sign-in box. US Banking infrastructure is so hopelessly bad that this is hack of a business is considered legitimate fin-tech. My wallet was stolen and before I realized it was gone and could cancel my CCs some dude made like six obviously fraudulent…
Every time Plaid is mentioned on HN, people want to hate. My take is: don't use it if you're scared ? A few of my friends were talking about Plaid the other day, and I told them I like the company/product, but "many people on HN hate it." They were perplexed and when I explained it was because you guys were nervous about entering your bank password into a third-party (yet reputable) company's interface (that's encryp…
I previously worked at a “reputable” company whose main product stores usernames and passwords for third-party sites. It’s a conceptually-similar product to what Plaid offers, but in a different problem space. These passwords were encrypted.
And yet:
* any developer or ops member could trivially have dumped the entire plaintext dataset
* there were multiple bugs discovered that would have allowed dummy accounts to quickly, trivially, and remotely dump the entire plaintext dataset
* if these bugs had been exploited, we would have had no way to know past a few weeks due to log rotation policies
* administrator passwords to systems were often just single English words
If anyone with ill intent had looked at this product for more than an hour, they likely would have discovered some of the bugs mentioned; one was pretty much just a
GET /accounts/$i/passwords.csv
Combine this with the consequences of a breach: if your credentials are stolen from Plaid and used to steal money from you, your bank, brokerage, or other financial institution can point to your use of this product as cause to deny your claim to have your funds returned. Essentially, they can point to Plaid as a violation of their terms of service, and hold you on the hook for any losses as you voluntarily gave your credentials to a third party.
Hell, even if Plaid isn’t breached and your account is compromised through other means, they can use the logs from Plaid regularly logging into your account to make the same case.
Earlier quoted context omitted.
> Any suggestions? Lobby your lawmakers. Banks have no incentive to provide open APIs. For example, in the UK banks did nothing until they were forced to - the market regulator now requires the nine largest banks to provide an open API ( https://www.openbanking.org.uk ).
Open Banking is a sham. It mandates account access for "AISPs" which need to be registered, audited, etc which is unfeasible for a solo developer especially when releasing a free/open-source product. Worse, it doesn't actually mandate your access to your own account, so that still depends on the bank. The modern banks provided APIs even before open banking so we're good, but the legacy ones still don't provide person…
So, pertinent question. I want to move my account to a bank which gives me an API so I don't have to deal with Plaid or Mint. I.e. I want data privacy. I want to build a personal dashboard of where my money is going. Any suggestions?
In the absence of APIs from most banks, it would be nice if there was a client side personal finance web app that allowed uploading .csv or pdf statements, and scraped those for you locally, perhaps with the option of using your own Google Drive or Dropbox as a persistent storage backend beyond browser localstorage.