Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenAI is connecting ChatGPT to bank accounts via Plaid

firethering.com

Post reply on HN
Print view View original

111–120 of 155 posts

Re: OpenAI is connecting ChatGPT to bank accounts via Plaid

#111

Post by lxgr »

robhlt wrote: post #110
lxgr wrote: post #69

Earlier quoted context omitted.

It’s worse than keys, it’s a persistent read-only view of all account data. At least there is a process for unauthorized ACH debits. For this blatant breach of privacy, there is nothing.

Plaid requires your bank username and password, so they have full read-write access to your account. They can do anything you can do when logged in to the bank's website, and so can anyone else who gains access to Plaid's database.

> They can do anything you can do when logged in to the bank's website

Which is hopefully nothing beyond looking at transaction data without 2FA.

Re: OpenAI is connecting ChatGPT to bank accounts via Plaid

#113

Post by robhlt »

lxgr wrote: post #111
robhlt wrote: post #110

Earlier quoted context omitted.

Plaid requires your bank username and password, so they have full read-write access to your account. They can do anything you can do when logged in to the bank's website, and so can anyone else who gains access to Plaid's database.

> They can do anything you can do when logged in to the bank's website Which is hopefully nothing beyond looking at transaction data without 2FA.

Plaid's login flow also requires a 2FA code if your bank requires it. The same 2FA code that banks say to never provide to anyone else.

They're literally proxying the bank's login page just like a phishing site would, and I assume they're also selecting the "trust this computer" option so their access is more persistent. My bank does require re-2FA for larger transfers, but there's still a lot of damage I can do on a "trusted" computer without triggering another 2FA prompt.

Re: OpenAI is connecting ChatGPT to bank accounts via Plaid

#114

Post by lxgr »

robhlt wrote: post #113
lxgr wrote: post #111

Earlier quoted context omitted.

> They can do anything you can do when logged in to the bank's website Which is hopefully nothing beyond looking at transaction data without 2FA.

Plaid's login flow also requires a 2FA code if your bank requires it. The same 2FA code that banks say to never provide to anyone else. They're literally proxying the bank's login page just like a phishing site would, and I assume they're also selecting the "trust this computer" option so their access is more persistent. My bank does require re-2FA for larger transfers, but there's still a lot of damage I can do on a…

To be honest, that's on the bank then.

Doing re-2FA for every outbound transfer, and mentioning the consequences of entering the 2FA code out of band (e.g. "enter code 123456 to confirm transfer of x$ to y" or "press OK to confirm transfer..." in a mobile app) should be the bare minimum these days.

Re: OpenAI is connecting ChatGPT to bank accounts via Plaid

#116

Post by rurp »

binarymax wrote: post #16

I’ve been asked to sign up to plaid by clients three times. Each time I’ve said no. I’m not giving a 3rd party access to my bank account. I don’t understand how people enable this total loss of friction for direct account egress. There needs to be friction.

I was repeatedly pressured to hand my bank account logins over to plaid when I bought a house. People always seemed surprised when I refused. Maybe they were just acting that way to pressure me into making their sale process slightly easier, but I got the impression most people just go along with it.

Handing my finances over to a company like that is a hard no for me, I can't imagine ever doing business with someone who required it.

Re: OpenAI is connecting ChatGPT to bank accounts via Plaid

#117

Post by lazide »

lxgr wrote: post #105
lazide wrote: post #75

Earlier quoted context omitted.

Uh, debit cards are the worse as they (technically) don’t allow you to dispute charges like in a credit card. Money comes right out of your account first, and then you have to try to get it back. Don’t use debit cards online.

> debit cards are the worse as they (technically) don’t allow you to dispute charges like in a credit card. That's a commonly propagated falsehood. Both legally (Regulation E) and practically (all large card networks require issuers to extend a zero-liability policy to debit cards), consumer protections are very similar. The big difference is that, as you say, with a debit card you're potentially out the money for a…

I once had an issue where they drained the account (transactions weren’t blocked by the bank until the account didn’t have sufficient funds), and it took the bank a full month to investigate and refund.

It’s not a trivial difference.

Re: OpenAI is connecting ChatGPT to bank accounts via Plaid

#118

Post by rurp »

gruez wrote: post #72
kridsdale1 wrote: post #51

Earlier quoted context omitted.

OpenAI is now run by former Meta executives.

Okay, what concrete harms has Meta done with this information? At best you have some creeps using it to stalk their exes, which is bad, but a far cry from the AI takeover scenario implied by OP.

They target toxic ads at people with poor mental health who are especially vulnerable. They do this intentionally because it's profitable.

There's plenty of reporting on this if you care to look it up. It "works" too. Spending more time on Meta products results in having more body issues, poor self esteem, and suicidal ideations.

But if I remember right you work for a big ad tech company and have previously gone to the mat to defend such practices, so I suspect you aren't genuinely asking.

Re: OpenAI is connecting ChatGPT to bank accounts via Plaid

#119

Post by lxgr »

lazide wrote: post #117
lxgr wrote: post #105

Earlier quoted context omitted.

> debit cards are the worse as they (technically) don’t allow you to dispute charges like in a credit card. That's a commonly propagated falsehood. Both legally (Regulation E) and practically (all large card networks require issuers to extend a zero-liability policy to debit cards), consumer protections are very similar. The big difference is that, as you say, with a debit card you're potentially out the money for a…

I once had an issue where they drained the account (transactions weren’t blocked by the bank until the account didn’t have sufficient funds), and it took the bank a full month to investigate and refund. It’s not a trivial difference.

That's unfortunate, and almost certainly a Regulation E violation on their side. They're supposed to provide a provisional credit within 10 business days.

Re: OpenAI is connecting ChatGPT to bank accounts via Plaid

#120

Post by lazide »

lxgr wrote: post #119
lazide wrote: post #117

Earlier quoted context omitted.

I once had an issue where they drained the account (transactions weren’t blocked by the bank until the account didn’t have sufficient funds), and it took the bank a full month to investigate and refund. It’s not a trivial difference.

That's unfortunate, and almost certainly a Regulation E violation on their side. They're supposed to provide a provisional credit within 10 business days.

It was Wells Fargo, and many years ago. It could have been them violating it, or it might not have been a law yet.

It was very irritating!

Post reply on HN