191–200 of 257 posts
Earlier quoted context omitted.
I don't know what Plaid is. But the user/password thing sounds insane. How can that be even an idea for a solution?
What else is there, when the bank doesn't provide an API & the ability to do something proper, like OAuth2?
As a developer living in a country that has fully implemented "Open Banking", here's a quick setting of expectations for Canadian developers so they don't get too excited as I did when this was first being introduced. Open Banking is not, in fact, open in almost any sense of the world. It is standardised and the standards are freely available ("open"), but other than that, you still need to have an official "blessing…
> It is standardised and the standards are freely available
Same.
> you still need to have an official "blessing" to actually access a production API endpoint (even for your own account)
Same.
> you need a legal entity that has some highly specific and entirely meaningless certificates that are hard (and potentially expensive) to get
Same though not entirely meaningless.
> you'll still need to negotiate access with each bank individually.
Not same.
It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow,…
Although, knowing how these things usually go, I'm sure the "2023" target is a little optimistic...
Earlier quoted context omitted.
You already know the answer. Ask forgiveness not permission, move fast and break things.
Our profession is such a joke. We're no better than the stereotypical trades worker of yore... a bunch of plumbers scamming and ripping off the every day person that doesn't know any better. Truly pathetic.
The thing is, because software companies have become the most successful businesses in the world, SE principles (move fast, break stuff) are now viewed as "being innovative" and necessary for success. So they are increasingly being applied to other engineering disciplines.
Earlier quoted context omitted.
Plaid is only one security breach away from being utterly destroyed. And they will take out the financial lives of all their customers with them. It’s utterly irresponsible and I have no idea how Plaid hasn’t been shut down. You have no recourse if they are breached. The TOS of your online banking probably says that if you disclose your username and password to any third party then you have no liability protections.
I work at Plaid, and I responded to this on the parent, but because this is pretty highly upvoted I figured I'd respond here too for visibility: the Consumer Financial Production Bureau addressed the fact that a financial institution cannot waive liability responsibilities in a recent Compliance Aid. FAQ 4 says that institutions cannot rely on an agreement with the consumer that waives the liability protections under…
Earlier quoted context omitted.
I haven't used Plaid, but how is this different from Mint or Quicken that have been around for years?
Mint and Quicken are end user applications, Plaid is not. Plaid is an API provider to access financial information from multiple institutions.
When I wrote "how is it different" I meant how is it different in the task it performs which (I assume) Mint and Quicken also perform.
The EU has been moving in this direction with PSD2 and it’s been pretty good. Downside is there’s no defacto standard for APIs and each bank's development skills vary widely.
I work at Nordigen and we integrated with 1,500+ banks in less than 8 months. Some APIs took hours to integrate, some took a few weeks, but the fact that it was possible at all is IMO gamechanging.
Earlier quoted context omitted.
I work at Plaid, and I responded to this on the parent, but because this is pretty highly upvoted I figured I'd respond here too for visibility: the Consumer Financial Production Bureau addressed the fact that a financial institution cannot waive liability responsibilities in a recent Compliance Aid. FAQ 4 says that institutions cannot rely on an agreement with the consumer that waives the liability protections under…
Regulation E does not waive consumers' liability for unauthorized transactions; it merely limits the amount of liability. The liability limit increases sharply if the consumer does not report the fraud within 48 hours.
Earlier quoted context omitted.
You already know the answer. Ask forgiveness not permission, move fast and break things.
Our profession is such a joke. We're no better than the stereotypical trades worker of yore... a bunch of plumbers scamming and ripping off the every day person that doesn't know any better. Truly pathetic.
Earlier quoted context omitted.
Are you sure you're not confusing things? Direct debit usually means just a permission to charge the given account for the specified amount. It's commonly used in Canada and doesn't involve sharing your password.
Wise (formerly TransferWise) has different meanings for "debit" and "direct debit". Their "debit" option works the way you think. You give only your bank card number, expiry date, and CVV. However, their "direct debit" option requires you to enter your bank debit card number and bank password into Wise's web form. It is not a redirect to the bank website. The URL says " https://wise.com/ ..." when you're asked to ent…