Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaid Deletes GitHub Issue Exposing Imitation of Bank Login UIs

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 47 posts

Re: Plaid Deletes GitHub Issue Exposing Imitation of Bank Login UIs

#11

Post by BillinghamJ »

I feel it's worth bearing in mind that this is normal to the point that the financial regulator in the UK standardised the activity as part of the EU-wide PSD2. It is being phased out in favour of open banking in the next couple of years, now that there's a requirement for more OAuth-like approaches. (In fact, Plaid just launched in the UK on the open banking APIs)

Banks are well aware that this is a thing and they're not that bothered.

If you want to see this improve, maybe push on US regulators to formalise it?

Re: Plaid Deletes GitHub Issue Exposing Imitation of Bank Login UIs

#12

Post by rishirishi »

sschueller wrote: post #6
rishirishi wrote: post #2

Hard delete of an issue over closing it or closing comments... for such a security sensitive issue... under the rug sweeping.

Well, thanks to the fact that you can't delete anything off the internet it will still be presented as evidence in court some day. This confirms to me that staying as far away as possible from plaid is the right move.

What would you recommend for ACH bank account verification?

Re: Plaid Deletes GitHub Issue Exposing Imitation of Bank Login UIs

#13

Post by carlineng »

homero wrote: post #4

The scariest thing is whether they keep downloading transactions or just verify i own the account like they make you think they're doing.

In today’s economy, data is the most valuable asset a company can own, and financial/transaction data is the holy grail. I would be very surprised if their current valuation could be justified purely on their subscription sales alone.

Re: Plaid Deletes GitHub Issue Exposing Imitation of Bank Login UIs

#14

Post by rhizome »

michaelckelly commented on Dec 7, 2018

@skierpage and @briangordon we appreciate your concerns, which is why our compliance team vets anybody who uses Link. As to malicious knock offs, this is a matter that most successful companies lookout for and deal with -- as we and our security team do.

This person should not be allowed to provide services that use bank APIs. Who should do the preventing? Banks.

Re: Plaid Deletes GitHub Issue Exposing Imitation of Bank Login UIs

#15

Post by ryanackley »

Here's my main beef with Plaid: a lot of times when you use it as an end user you have no idea that you're giving one of Plaid's customers full history on all of your transactions, accounts, credit cards, loans, etc. Plaid presents you with a ToS that you will probably never read.

Compare that to something like "Sign-in with Google" or "Sign in with Github". They put it in plain english exactly what the website you are signing into is asking permission for and you explicitly say I'm ok with that.

Re: Plaid Deletes GitHub Issue Exposing Imitation of Bank Login UIs

#16

Post by temp129038 »

robot wrote: post #8
temp129038 wrote: post #3

Plaid needs to be exposed as one of the most unethical companies in SV. If people are worried about online privacy then they should really be worried about a company that is so deceiving and makes it basically impossible to revoke permissions on something as sensitive as access to your bank account and transaction history once granted.

can you revoke by changing your password?

I’m not sure, but does it matter?

I take issue with a product that markets to consumers as an easy way to authenticate for the purpose of pulling or pushing funds, but is actually authorizing developers to scrape years of transaction history in 20 minutes, my real time balance, my phone/email/address etc. without another level of permission. It’s disgusting.

I just wanted an alternative to microdeposits to prove to an app that I own a bank account, not give the app free range to steal all my bank data in the process of doing so.

Re: Plaid Deletes GitHub Issue Exposing Imitation of Bank Login UIs

#17

Post by okigan »

temp129038 wrote: post #3

Plaid needs to be exposed as one of the most unethical companies in SV. If people are worried about online privacy then they should really be worried about a company that is so deceiving and makes it basically impossible to revoke permissions on something as sensitive as access to your bank account and transaction history once granted.

Looks like Betterment & Wealthfront use plaid, which could affect many on HN [1][2].

[1] https://www.quora.com/Why-doesnt-Betterment-or-Wealthfront-u...

[2] https://www.investmentnews.com/article/20190108/FREE/1901099...

Re: Plaid Deletes GitHub Issue Exposing Imitation of Bank Login UIs

#19

Post by jamiek88 »

rishirishi wrote: post #12
sschueller wrote: post #6

Earlier quoted context omitted.

Well, thanks to the fact that you can't delete anything off the internet it will still be presented as evidence in court some day. This confirms to me that staying as far away as possible from plaid is the right move.

What would you recommend for ACH bank account verification?

Micro deposit while cumbersome and slow, works fine.

I don't believe access to all of my most personal data should be ‘frictionless’.

Re: Plaid Deletes GitHub Issue Exposing Imitation of Bank Login UIs

#20

Post by csswizardry »

Hah. This is the only company that has ever f—ked me over. I’m a self-employed consultant who flew out to SF to work with them and was told the gig was off the working-day before we were set to begin. My lawyer said I absolutely had a case but I’d need to be prepared to open an international lawsuit against them (I’m UK-based) and I just couldn’t muster the effort. They got away with it.

They also quite cheerfully asked me ‘Hey! Next time you’re in the area we’d love to look at working together?’ Classy.

Post reply on HN