Blog writers have problem problems.
I'm not just annoyed by the title. The "problems" are generally feature requests sold as bugs.
GitHub Has a Permission Problem
61–70 of 130 posts
Re: GitHub Has a Permission Problem
#62This is obviously a subject the author cares passionately about, because the article uses a lot of exclamation marks. But this tidbit struck me as hilariously out of touch: > Let's imagine your bank let you sign in to 3rd party services in a similar manner. How many people would click through on "Let ACME corp act on your behalf on your Citibank Account". I think most people would be super scared of permissions like…
The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more money. People talk about this like your online banking password is protecting your money... it’s not. If someone adds an online bill pay recipient from the web portal it triggers loud and slow verifications and confirmations. If someone submits an ACH transacti…
It's not, though. The legal system, and your bank will protect you in this scenario.
You would report the fraud, and you would get your money back.
In the case of plaid almost every bank has somewhere in their terms of service that you are responsible for protecting your online banking password, and they are not liable if you have a loss as a result of a third party getting your password from you.
Which means if Plaid is a bad actor, or if they lose your password on accident, and your money is taken, the bank will disclaim all liability, and will not be obligated to make you whole.
So, while it might be easier for money to flow out of your account due to ACH fraud, it'll be a lot harder to get that money to come back if it's due to your own password handling mistakes.
Re: GitHub Has a Permission Problem
#63Earlier quoted context omitted.
I don't know how this insanity still exists. Sharing login data with third parties is likely violation of bank ToS and might deprive you of fraud protection (bank might argue that you were grossly negligent by sharing credentials). I guess acceptance of that crazy scheme is regional thing. Paypal tried to pull that over here but they backed out after a week of extensive backlash. And EU mandates that banks provide AP…
I recently needed to add a personal Chase account to a business Chase account to send a transfer. I kid you not, their own account linking flow used Plaid to collect my Chase(!) personal credentials and verify my Chase(!!!) personal account, within their own web UI while actively signed into my account. Granted, there is capability in that UI to link any external account, so you can sign into other banks. But I mean…
This may be a case of an external account in practice. There are many banks running the retail and business accounts under a similar corp name, but in practice they're separate entities which don't share infrastructure or processes.
(I'd love to know the reason, I'm sure someone here knows the details)
Re: GitHub Has a Permission Problem
#64I noticed this before but didn't really give it much thought like "worst comes to worst they delete all my repos, so what?" but I realize now that someone could literally rewrite the commit history and inject a virus into a popular repo without anyone noticing. This is terrifying and definitely needs to be addressed.
Re: GitHub Has a Permission Problem
#65> How many people would click through on "Let ACME corp act on your behalf on your Citibank Account" Banking is a terrible example because it's literally how it works. Try to link a bank account to PayPal or TransferWise, they'll ask you your username and password for your online account to that bank, and the next screen asks for the verification text you got as they literally log in as you. And ACH, the system your…
> Try to link a bank account to PayPal or TransferWise, they'll ask you your username and password for your online account to that bank I don't remember having to do that for paypal. I do remember them asking for the routing and account number and that they asked me to verify the cash amount of a deposit they made in order to confirm the account. I went through a similar procedure when I added my bank account as an e…
They use that Plaid thing to try to instant link and Plaid asks for your credentials! But fortunately Plaid crashes, throws errors all over the JS console and ultimately fails, leaving you with threes day verify vis ACH. Many Plaid failed because i blocked the trackers, which is another thing ...Plaid asks for U/P on page that's loading trackers - leaking my credentials maybe?
When I see Plaid on something, I'm Noping out of there
Re: GitHub Has a Permission Problem
#66Earlier quoted context omitted.
The actual money movement “API” is by far the scarier part of this. Any entity you’ve ever paid has your account number, and that’s all they need to pull more money. People talk about this like your online banking password is protecting your money... it’s not. If someone adds an online bill pay recipient from the web portal it triggers loud and slow verifications and confirmations. If someone submits an ACH transacti…
> the money just flies right out. And then flies right back in once you report the fraud. The system works not by making it hard to steal money, but by making it easy to get back. This is like credit cards... yes, a shady store can steal money from you.... but then you get it back and they go to jail.
ACH fraud is not that simple to detect or revert. How soon would you know if $500 exited your checking account? If it's a small-business account, with most banks, you have 24 hours to report each debit that you want reversed. If it's a personal account, you may have up to a month. But the same merchant account can debit your account again, even while you are reversing their previous debits. You can't block them with a personal or basic small-business account, you have to upgrade to an account that you always keep $100K in.
The banks' suggestion? Close the account, open a new one, and never give anyone the account and routing numbers. Never write a check from that account. Use the bank's web site to initiate bill payments – they'll get checks from the bank's account.
Re: GitHub Has a Permission Problem
#67Earlier quoted context omitted.
> the money just flies right out. And then flies right back in once you report the fraud. The system works not by making it hard to steal money, but by making it easy to get back. This is like credit cards... yes, a shady store can steal money from you.... but then you get it back and they go to jail.
> The system works not by making it hard to steal money, but by making it easy to get back. In other countries the system works by making it hard to steal money: I'm in New Zealand, and you can't do really anything with my account number, except pay me. Direct debit does exist, but it's a lot harder to setup (I have to send the bank original signed documents if I want to setup a direct debit from my account) to the p…
Right, and that is why I kinda prefer the American system.... it is very easy to use and set up direct deposit and direct payments, and most of the time nothing bad happens. The few times something bad happens, it is fixed.
I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money.
Re: GitHub Has a Permission Problem
#68Earlier quoted context omitted.
I don't know how this insanity still exists. Sharing login data with third parties is likely violation of bank ToS and might deprive you of fraud protection (bank might argue that you were grossly negligent by sharing credentials). I guess acceptance of that crazy scheme is regional thing. Paypal tried to pull that over here but they backed out after a week of extensive backlash. And EU mandates that banks provide AP…
I mean PayPal still right now today does it for the “verify your bank account” feature.
I don't think they do in Australia... how odd.
As far as I recall this article is accurate. They send two small amounts and ask you to type it in to confirm it came through.
https://www.paypal.com/au/smarthelp/article/how-do-i-confirm...
Re: GitHub Has a Permission Problem
#69Earlier quoted context omitted.
> The system works not by making it hard to steal money, but by making it easy to get back. In other countries the system works by making it hard to steal money: I'm in New Zealand, and you can't do really anything with my account number, except pay me. Direct debit does exist, but it's a lot harder to setup (I have to send the bank original signed documents if I want to setup a direct debit from my account) to the p…
Right, and that is why I kinda prefer the American system.... it is very easy to use and set up direct deposit and direct payments, and most of the time nothing bad happens. The few times something bad happens, it is fixed. I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money.
> I'd rather take the occasional having to wait a few days to sort out a fraud charge than have to be inconvenienced every time I want to send or receive money.
Bank of New Zealand online banking doesnt seem that inconvenient, or different, from the American system. add payee, enter amount, click pay then confirm.
https://www.bnz.co.nz/support/internet-banking/payments/addi...
Re: GitHub Has a Permission Problem
#70Yes GitHub has this problem, but it's not a GitHub problem, it's an oauth problem.
Oauth is better than the previous state of the art (either app-specific passwords that can do anything you can do or else literally just your own username and password), but it has a huge UX problem around least privilege.
In general it's very opaque what the requested permissions can be used to do. Some companies get this pretty right but there are tons that don't.
Let's say the requested permission is very straightforward like "append rows to your existing spreadsheets". It's also generally impossible to grant access using oauth to just a subset of whatever resource it is, like only spreadsheets A, B, and C, but not X.
I wish sandstorm had caught on much bigger than it had, it brings a fine-tune grained capabilities-based auth system.