Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visa Buys Plaid

wsj.com

Post reply on HN
Print view View original

201–210 of 333 posts

Re: Visa Buys Plaid

#201

Post by Nextgrid »

zelly wrote: post #102
nikolay wrote: post #48

Plaid is terrible! Both Wells Fargo and Bank of America support API integration, but Plaid chooses to screen-scrape and does not work if you have 2FA enabled. Also, you can't even manually enter your bank information. In other words, even if you pay dearly to Plaid, you may block many users who use some of the top banks in the States! There is a bunch of services I cannot use because they rely solely on Plaid, and I'…

The way Plaid works, I'm surprised that they hadn't already been shut down for breaking banks' TOS. It exposes the banks to so much liability for a product that's not even theirs.

I dislike Plaid & similar systems but I disagree.

Enforcing stupid & unreasonable ToS in court is a slippery slope that can be used against users.

You want to use an alternative client to export your data because the official client doesn't allow it? ToS violation and the developer of the alternative client gets sued.

Want to screen-scrape some website to automate some tedious manual behaviour? ToS violation and you get sued.

Etc.

The ability to delegate some manual process (logging into online banking and getting the data) to a third-party (like Plaid) should be a right that we should defend.

Re: Visa Buys Plaid

#202

Post by kccqzy »

sithlord wrote: post #81
nikolay wrote: post #48

Plaid is terrible! Both Wells Fargo and Bank of America support API integration, but Plaid chooses to screen-scrape and does not work if you have 2FA enabled. Also, you can't even manually enter your bank information. In other words, even if you pay dearly to Plaid, you may block many users who use some of the top banks in the States! There is a bunch of services I cannot use because they rely solely on Plaid, and I'…

pretty sure this is false, all my accounts are 2FA, and connected to a few different account aggregators (mint, personalcapital, etc) which i am prettty sure all use Plaid. Handles it fine.

Mint uses its own system I think. Personal Capital uses Yodlee.

Re: Visa Buys Plaid

#203

Post by Nextgrid »

bloodm wrote: post #199
ianhawes wrote: post #193

Earlier quoted context omitted.

Both Bank of America and Wells Fargo do technically have APIs, though they're limited in scope to corporate accounts for treasury purposes. I've applied for access to both and both declined to even a sandbox account.

Think what you want about the EU, but sometimes they have good initiatives. https://www.eu-startups.com/2019/09/open-banking-and-what-it...

This is a sham. You need to go through lots of audits & other administrative BS in order to be declared an "AISP" even if you don't actually process banking data yourself and it never leaves the user's device.

Imagine PCI-DSS compliance but without the exception that you don't have to be PCI-compliant yourself if you don't touch card data and pass it directly to a PCI-compliant payment processor.

Re: Visa Buys Plaid

#204

Post by ablekh »

Abstracting away from this specific case, it is IMO just another example of potential very significant and real risks of being reliant upon cloud or, more generally, technological platforms operated by potentially acquirable companies. While some acquired companies remain relatively independent and continue offering original products (in short-to-medium term), many don't [I have compiled a long list of case studies ...]. And if this (along with IT security) doesn't make most CTOs and/or CIOs to wake up in the middle of the night, then I don't know what does. Industry consolidation is IMO a pretty scary, but probably inevitable, trend. I think that the safest approach (sans some corner cases, e.g., a unique technology) is to build one company's technology platform on an "unacquirable" technology infrastructure (for the cloud, that would be AWS, Azure and, to somewhat lesser extent, GCP). Thoughts?

Re: Visa Buys Plaid

#206

Post by kccqzy »

boling11 wrote: post #178
iask wrote: post #141

Slightly off topic, but worth highlighting. Privacy virtual card use Plaid (well at least the last time I looked at it a few months back). The integration was extremely questionable. They were faking the bank’s login page. So when you enter your credentials, it wasn’t the actual banks page. There was a github issue opened, and after several followed up complaints they blocked further commenting and the removed then t…

(I work for Privacy.com) We do use the Plaid Link widget (as do most other fintechs in the US). We don't touch credentials or handle the bank login page. Commentary about the state of the US banking system aside, Plaid is pretty much the industry standard way to do instant bank account verifications today. However, we also have options to link with debit card and account / routing number if you're not comfortable wit…

What about Yodlee? I'm under the impression that Yodlee is a bigger and much more established player here. Although Yodlee's API certainly isn't great.

Re: Visa Buys Plaid

#207

Post by cowpig »

sdan wrote: post #83

Really don't like Plaid because they normalize phising. Surprised they aren't being condoned for this.

I think you mean "condemned"? To condone is to (often implicitly) approve of something that is ethically or morally dubious.

Re: Visa Buys Plaid

#208

Post by fulldecent2 »

I support this big time.

Plaid is a complete joke -- "give us your bank passwords and we'll validate your account". Banks are an even worse joke -- "20,000 logins today from one IP address, nope that's not a scam".

Plaid customers are the worst. Like Transferwise, you cannot setup a business account with them without giving Plaid your business banking passwords. What company treasurer would allow that?

Now that Visa is holding the bag this fixes two problems:

1. For customers, there is less risk that Visa will steal all your money than some "fintech" startup 2. For Plaid customers, they may realize Visa is buying this for the data and they may think of Visa as a competitor and not want to support them.

---

Because "just give us your sudo password to install software" and "just give us your bank password" to send money is a thing... the obvious dumber people in the future will have to do "just sign this power of attorney to create an account with us."

Re: Visa Buys Plaid

#209

Post by fulldecent2 »

brogrammernot wrote: post #110
nikolay wrote: post #48

Plaid is terrible! Both Wells Fargo and Bank of America support API integration, but Plaid chooses to screen-scrape and does not work if you have 2FA enabled. Also, you can't even manually enter your bank information. In other words, even if you pay dearly to Plaid, you may block many users who use some of the top banks in the States! There is a bunch of services I cannot use because they rely solely on Plaid, and I'…

Not even close to true. We’re one of the larger clients with Plaid and that’s not on Plaid but the service provider to not provide a manual entry. Plaid works great and we’ve ran into next to no issues with customers linking Plaid

No issues with customers linking Plaid.

If your company is ONLY supporting Plaid then your issue is that your smarter customers are leaving.

Re: Visa Buys Plaid

#210

Post by fulldecent2 »

nikolay wrote: post #169
thamer wrote: post #138

Earlier quoted context omitted.

I'm already uneasy with the way Plaid works, I'm not also going to disable 2FA on my account to accommodate the broken way they access accounts (pretending to be a browser instead of using APIs). There are good, secure ways to grant access to resources, and giving your password to Plaid for them to log in to your account with reduced security is definitely not one of them and certainly not an attractive proposition.

Worst of all, it's a full access, not a scope-restricted one. Imagine somebody hacking Plaid and you disabling 2FA, because otherwise you can't use some of the fancy new services you saw on Product Hunt.

Worst of all, is their privacy policy.

> We retain information we collect about you for as long as necessary to fulfill the purposes for which we collected it, unless a longer retention period is required OR PERMITTED under applicable law.

It is not necessary to "hack" Plaid.

Post reply on HN