Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaid paid people $500 for their employer payroll logins

vice.com

Post reply on HN
Print view View original

11–20 of 101 posts

Re: Plaid paid people $500 for their employer payroll logins

#11

Post by jc_811 »

dzdt wrote: post #8

So this sounds like Plaid wanted to learn how to interface with the client-facing web interface of these payroll systems. So it paid people who have their own payroll on the system for access to that individual's login to study the user interface in order to develop a system that can interoperate with it. This sounds... not so bad?

I think the biggest issue is that they were paying employees for login credentials to sensitive systems. Imagine you’re an IT manager and you find out that an employee is giving the company’s* usernames and passwords - to a 3rd party at their own discretion. I think this is a HUGE deal. Unless the employees had explicit permission from the employer (the article strongly insinuates they did not), I don’t see how this is anything besides a giant mess.

*if you log into a company system, with a company provided username and password, those credentials belong to the company

Re: Plaid paid people $500 for their employer payroll logins

#13

Post by FractalParadigm »

hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

Hell even here in Canada we have the Interac system, which from what little I know of the US banking system, is consistently 10+ years ahead of the game. I've had "Chip & PIN" on my cards since at least 2008, and distinctly remember getting my first "tap" card in ~2011 or so. I genuinely couldn't tell you the last time I inserted my card into a machine because anything under $100 (>99% of my in-store purchases) can be tapped for, and >99% of businesses support tap (looking at you, Walmart and Pilot/Flying J. Get with the times!). From what I understand tap is still barely on the docket at a lot of the US banks.

The big kicker for me is Interac e-Transfers, where you simply log into your banking and can email (or text) money to anyone in the country - they click the link in the email/SMS they receive, log into their bank account, and choose where the money is deposited. We've had this system in place since at least 2014? Hell I pay my rent and buy weed just by sending e-transfers, they're treated the same as cash and happen instantly. I reminds me of something that happened recently, I stumbled into a conversation with some of my American friends trying to figure out how the one person was going to pay the other >1000 miles apart; it was absolute lunacy listening to them decide between PayPal, Cash App, Venmo, etc., trying to figure out who had the lowest fees for both parties, factoring in the time it takes for the transaction to happen and transferring to/from their bank account if necessary. It's insane to me how the banking system underlying the world's largest economy is so far behind the times.

Re: Plaid paid people $500 for their employer payroll logins

#14

Post by tablespoon »

tehwebguy wrote: post #12

On the consumer side I can’t imagine ever giving my bank credentials to Plaid or any other company. Super unnerving that this is even a thing, it’s like the number one rule of passwords.

> On the consumer side I can’t imagine ever giving my bank credentials to Plaid or any other company. Super unnerving that this is even a thing, it’s like the number one rule of passwords.

Yeah, and it's also the number two and three rules with bank passwords.

I sold Bitcoin for the first time a few months ago on Coinbase. Their only bank integration is via Plaid, and I did a double-take and noped the fuck out of that right away. It boggles my mind that's even a thing. Luckly I was able to get my money out via Paypal instead without too much hassle.

Re: Plaid paid people $500 for their employer payroll logins

#15

Post by mgarfias »

jc_811 wrote: post #11
dzdt wrote: post #8

So this sounds like Plaid wanted to learn how to interface with the client-facing web interface of these payroll systems. So it paid people who have their own payroll on the system for access to that individual's login to study the user interface in order to develop a system that can interoperate with it. This sounds... not so bad?

I think the biggest issue is that they were paying employees for login credentials to sensitive systems. Imagine you’re an IT manager and you find out that an employee is giving the company’s* usernames and passwords - to a 3rd party at their own discretion. I think this is a HUGE deal. Unless the employees had explicit permission from the employer (the article strongly insinuates they did not), I don’t see how this…

I got the impression it was the employee side of the app. As in me logging into ADP so they can figure out how to scrape ADP

Re: Plaid paid people $500 for their employer payroll logins

#17

Post by caseyf7 »

tehwebguy wrote: post #12

On the consumer side I can’t imagine ever giving my bank credentials to Plaid or any other company. Super unnerving that this is even a thing, it’s like the number one rule of passwords.

When your company uses Carta you'll be forced to use Plaid under time pressure to exercise your stock options. Companies need to stop enabling Plaid because they are too lazy to implement their own payment systems.

Re: Plaid paid people $500 for their employer payroll logins

#18

Post by KingMachiavelli »

> https://www.eff.org/cases/facebook-v-power-ventures

While it is bad and unethical to encourage sharing credentials, I really hope we don't continue to criminalize intermediary services that act on the user's behalf. User's should be able to use whatever product and services they want. If you don't want consumer's to use third party tools then either improve your own tools or implement better security.

On the bright side it sounds like in the Power Venture's case they did a few other things to sort of 'impersonate' Facebook in order to encourage user's to use their product. So maybe things haven't escalated too far yet... the outcome of this & Plaid will certainly be interesting.

Re: Plaid paid people $500 for their employer payroll logins

#19

Post by throwkeep »

hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

Crypto innovation is mostly coming from the US, which is in the process of replacing the financial system.

Re: Plaid paid people $500 for their employer payroll logins

#20

Post by [deleted] »

hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

[deleted]
Post reply on HN