201–210 of 257 posts
This sounds so futuristic which is awesome but at the same time banks like Tangerine, which otherwise I have nothing but praise for, don't even allow be to use a password more secure than a 4-6 digit numeric passcode. Obviously no 2FA. Sorry, that has little to do with the submission, I just had to vent about banks.
Tangerine recently launched 2FA but it is SMS based only.
Earlier quoted context omitted.
Mint and Quicken are end user applications, Plaid is not. Plaid is an API provider to access financial information from multiple institutions.
Ok, but it's like the portion of Mint or Quicken that interfaces with financial institutions, and it enables end user applications, right? When I wrote "how is it different" I meant how is it different in the task it performs which (I assume) Mint and Quicken also perform.
They later moved off of Yodlee to Intuit APIs, post acquisition, although those also do screen scraping [2], and thus carry the same risks.
The EU has been moving in this direction with PSD2 and it’s been pretty good. Downside is there’s no defacto standard for APIs and each bank's development skills vary widely.
It's true that the 6,000 banks in Europe have different standards, but the fact that the APIs exist and work and that the regulator is enforcing the use of real APIs (as opposed to screen scraping) is worth the effort to integrate each of the banks. I work at Nordigen and we integrated with 1,500+ banks in less than 8 months. Some APIs took hours to integrate, some took a few weeks, but the fact that it was possible…
We still had to fall back to scraping at some points. Perhaps that’s different now.
Earlier quoted context omitted.
Are you sure you're not confusing things? Direct debit usually means just a permission to charge the given account for the specified amount. It's commonly used in Canada and doesn't involve sharing your password.
Wise (formerly TransferWise) has different meanings for "debit" and "direct debit". Their "debit" option works the way you think. You give only your bank card number, expiry date, and CVV. However, their "direct debit" option requires you to enter your bank debit card number and bank password into Wise's web form. It is not a redirect to the bank website. The URL says " https://wise.com/ ..." when you're asked to ent…
Earlier quoted context omitted.
It's true that the 6,000 banks in Europe have different standards, but the fact that the APIs exist and work and that the regulator is enforcing the use of real APIs (as opposed to screen scraping) is worth the effort to integrate each of the banks. I work at Nordigen and we integrated with 1,500+ banks in less than 8 months. Some APIs took hours to integrate, some took a few weeks, but the fact that it was possible…
Yeah. I used to work for a Hamburg based fintech that was one of the first to get its PSD2 license. We still had to fall back to scraping at some points. Perhaps that’s different now.
One major limitation is that PSD2 only regulates access to payment accounts, but doesn't mandate access to credit cards, investment accounts, savings accounts etc. This is why screen scraping (to everyone's dismay) is still used - to "expand" what's possible with real bank APIs.
It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow,…
I think the future is that banks/bank apps will do the budgeting stuff themselves. Most bank apps will now break down your monthly spending by categories. My bank app shows me my weekly and monthly spend compared to previous periods, how much I spent in each category, how much I spent at each business, how much I have spent this month so far compared to the same time last month and etc.
Earlier quoted context omitted.
> YNAB (You Need A Budget) use services like Plaid to...take my username and password and impersonate me to get my banking data WHAT. THE. F. I'm a longtime, happy YNAB user. I had no idea this was going on until just now. I always just assumed there were secure APIs used to import my data. YNAB's Capital One "integration" stopped working a few years ago (possibly because they cracked down on screen scraping?) and I…
Hi! I work at Plaid. We’re strong advocates for API-based connectivity -- our goal is for 75% of our traffic to be committed to APIs by the end of the year. As part of that, we've actually converted our integration with Capital One to be 100% API-based and use OAuth for authentication. You can read more here: https://www.capitalone.com/about/newsroom/data-sharing-agree...
It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow,…
Hi! I work at Plaid wanted to share that the Consumer Financial Production Bureau addressed the fact that a financial institution cannot waive liability responsibilities in a recent Compliance Aid. FAQ 4 says that instititutions cannot rely on an agreement with the consumer that waives the liability protections under Regulation E if a consumer has shared their account information with a third party because those are…
It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow,…
FWIW I use Schwab for banking and I was able to connect YNAB to Schwab without entering my password. It looks like Schwab supports read-only API access, and Plaid takes advantage of that to avoid needing your credentials. As an added plus, you can keep 2FA enabled. Schwab does 2FA through an app so it's a touch above SMS-based 2FA (although only a single app is supported, Symantic VIP Access, rather than generic supp…
1) Install pip, a python package manager, using your OS package manager.
2) Install python-vipaccess by executing `pip install --user python-vipaccess`
3) Execute `vipaccess provision -p -t VSMT` - this will print out all the information needed. Note the Symantec ID (it looks like VSMT12345678). It is what goes in the "Credential ID" field when adding a new device on Schwab's website.
4) Save the `otpauth://...` data into data.txt.
4.5) (Optional) Modify the `issuer=Symantec` parameter to read `issuer=Charles%20Schwab` Also change `VIP%20Access:VSMT123456789` to your Schwab online banking username. These are purely aesthetic changes and will only make a difference in the label that shows up in the Google Auth app.
5) Install qrencode using your OS package manager.
6) Execute `qrencode.exe -o qr.png -s 15 7) Scan the QR image (qr.png) with your google auth app.
8) Go to Schwab -> Service -> Security Center -> Manage Two-Step Verification -> Add another Security Token and input the Symantec ID from step 3 (it looks like VSMT12345678) and the current rolling TOTP code from the Google Auth App. (If you use Authy you may have to type it manually)
[0] https://github.com/dlenski/python-vipaccess
[1] https://www.reddit.com/r/personalfinance/comments/hvvuwl/usi...
Earlier quoted context omitted.
Hi! I work at Plaid. We’re strong advocates for API-based connectivity -- our goal is for 75% of our traffic to be committed to APIs by the end of the year. As part of that, we've actually converted our integration with Capital One to be 100% API-based and use OAuth for authentication. You can read more here: https://www.capitalone.com/about/newsroom/data-sharing-agree...
What you did was wrong and you all knew it. It seems to have paid off though, so congratulations. Nobody with half a brain would trust you.
Plaid better have good security!
But I don't see this as unethical in the slightest. In fact, I see it as a company doing the right thing by consumers in letting them get access to their own data.