Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visa Buys Plaid

wsj.com

Post reply on HN
Print view View original

271–280 of 333 posts

Re: Visa Buys Plaid

#271

Post by moviuro »

bagacrap wrote: post #220
Nextgrid wrote: post #201

Earlier quoted context omitted.

I dislike Plaid & similar systems but I disagree. Enforcing stupid & unreasonable ToS in court is a slippery slope that can be used against users. You want to use an alternative client to export your data because the official client doesn't allow it? ToS violation and the developer of the alternative client gets sued. Want to screen-scrape some website to automate some tedious manual behaviour? ToS violation and you…

Most manual processes, I agree, automate away. But not the ones that have negative implications for security. I don't care whether it's the TOS or some other means that's used to prevent pw sharing, but it should be prevented. It is the bank's duty to protect its users, not to tolerate services that actively discourage safe practices like 2fa.

In the EU, we're getting DSP2 [0] which requires banks to publish usable APIs to: get account information, and initiate money transfers. That's huge, though only at a baby stage for the moment.

[0] https://ec.europa.eu/commission/presscorner/detail/en/IP_15_...

Re: Visa Buys Plaid

#273

Post by JensRantil »

nikolay wrote: post #48

Plaid is terrible! Both Wells Fargo and Bank of America support API integration, but Plaid chooses to screen-scrape and does not work if you have 2FA enabled. Also, you can't even manually enter your bank information. In other words, even if you pay dearly to Plaid, you may block many users who use some of the top banks in the States! There is a bunch of services I cannot use because they rely solely on Plaid, and I'…

I work for a popular european competitor of Plaid, Tink (https://tink.com). We don't do screen scraping, but use the banks' own APIs. These days we also ride on the european bank directive "PSD2" which gives us the right to aggregate financial data from financial providers such as banks. That means we aren't breaking an Terms of Services with banks!

...and yes, we support 2FA. ;)

Re: Visa Buys Plaid

#274

Post by angry_octet »

nikolay wrote: post #253
judge2020 wrote: post #187

Earlier quoted context omitted.

> and does not work if you have 2FA enabled Certainly false, at least for Bank Of America. Just yesterday I connected BofA to privacy.com using Plaid and it asked me to enter the SMS 2fa code.

It works only once as they relay the code for verifying account numbers. But it doesn't always work (both with BofA and Wells Fargo) and certainly not for continuous pulling of data.

Which is how 2FA is supposed to work. Perhaps they try to keep the session from timing out, but that is bound to break.

The solution is regulation to force Banks to provide customer data over an API to an authorized third party (preferably with 2FA on that too, and other security mechanisms, like mutual auth, auditing the security and probity of the subscriber etc).

Scraping is such a 1990s solution, and Plaid's Uber-like disregard for rules made it a non-starter for anyone sensible.

Ironically, while it might get systematic integration with VISA, the privacy implications are far worse.

Re: Visa Buys Plaid

#275

Post by angry_octet »

fulldecent2 wrote: post #210
nikolay wrote: post #169

Earlier quoted context omitted.

Worst of all, it's a full access, not a scope-restricted one. Imagine somebody hacking Plaid and you disabling 2FA, because otherwise you can't use some of the fancy new services you saw on Product Hunt.

Worst of all, is their privacy policy. > We retain information we collect about you for as long as necessary to fulfill the purposes for which we collected it, unless a longer retention period is required OR PERMITTED under applicable law. It is not necessary to "hack" Plaid.

Yeah, it's the users who got hacked when they signed up.

Re: Visa Buys Plaid

#276

Post by pintxo »

nikolay wrote: post #251
orthecreedence wrote: post #247

Earlier quoted context omitted.

Wells Fargo's 2FA uses SMS. Hardly worth enabling.

That's default, but you can buy an RSA hardware token.

Like this one [1]? Seems that it is not necessarily better than SMS.

[1] https://news.ycombinator.com/item?id=4156897

Re: Visa Buys Plaid

#277

Post by mritchie712 »

JensRantil wrote: post #273
nikolay wrote: post #48

Plaid is terrible! Both Wells Fargo and Bank of America support API integration, but Plaid chooses to screen-scrape and does not work if you have 2FA enabled. Also, you can't even manually enter your bank information. In other words, even if you pay dearly to Plaid, you may block many users who use some of the top banks in the States! There is a bunch of services I cannot use because they rely solely on Plaid, and I'…

I work for a popular european competitor of Plaid, Tink ( https://tink.com ). We don't do screen scraping, but use the banks' own APIs. These days we also ride on the european bank directive "PSD2" which gives us the right to aggregate financial data from financial providers such as banks. That means we aren't breaking an Terms of Services with banks! ...and yes, we support 2FA. ;)

does Plaid actually "screen scrape" though? I thought they did the same thing (use the banks API's)

Re: Visa Buys Plaid

#278

Post by mritchie712 »

siliconc0w wrote: post #229

Plaid's product is absolutely absurd. Yes, please train your users to type their username and passwords into third party sites because they're given a legitimate looking sign-in box. US Banking infrastructure is so hopelessly bad that this is hack of a business is considered legitimate fin-tech. My wallet was stolen and before I realized it was gone and could cancel my CCs some dude made like six obviously fraudulent…

I have a wallet attached to the back of my phone and it's the only thing I carry. Makes it tough to forget / not realize it missing since I need it so frequently.

Re: Visa Buys Plaid

#279

Post by mritchie712 »

fulldecent2 wrote: post #208

I support this big time. Plaid is a complete joke -- "give us your bank passwords and we'll validate your account". Banks are an even worse joke -- "20,000 logins today from one IP address, nope that's not a scam". Plaid customers are the worst. Like Transferwise, you cannot setup a business account with them without giving Plaid your business banking passwords. What company treasurer would allow that? Now that Visa…

do you really think a billion+ dollar company (Plaid) would "steal all your money"? That's a pretty silly statement. More realistic to think they have shitty security practices and could be hacked. FWIW, I worked at a large bank for over a decade and a fintech after that, the fintech had better security practices.

Re: Visa Buys Plaid

#280

Post by colourgarden »

JensRantil wrote: post #273
nikolay wrote: post #48

Plaid is terrible! Both Wells Fargo and Bank of America support API integration, but Plaid chooses to screen-scrape and does not work if you have 2FA enabled. Also, you can't even manually enter your bank information. In other words, even if you pay dearly to Plaid, you may block many users who use some of the top banks in the States! There is a bunch of services I cannot use because they rely solely on Plaid, and I'…

I work for a popular european competitor of Plaid, Tink ( https://tink.com ). We don't do screen scraping, but use the banks' own APIs. These days we also ride on the european bank directive "PSD2" which gives us the right to aggregate financial data from financial providers such as banks. That means we aren't breaking an Terms of Services with banks! ...and yes, we support 2FA. ;)

Note that a SSL_ERROR_BAD_CERT_DOMAIN is shown when trying to access tink.com at the moment. Says the certificate is only valid for cloudfront.net.

Edit: the website itself also returns a 403.

Post reply on HN