Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Visa Buys Plaid

wsj.com

Post reply on HN
Print view View original

321–330 of 333 posts

Re: Visa Buys Plaid

#321

Post by huebomont »

billatq wrote: post #232
pininja wrote: post #186

Earlier quoted context omitted.

Mint used to sync with Chase and Wells Fargo through sketchy scraping, but those banks have since then integrated with Mint over APIs. Mint then disabled syncing until customers reestablished the connection with the new, more secure, method (which I thought was a good move)

For a while they were using Yodlee for the backend (which did all sorts of weird stuff), but I think they rewrote it after Intuit bought them.

They definitely use Plaid or a similar service to scrape data. The few banks that offer APIs do have it.

Re: Visa Buys Plaid

#322

Post by choopchik »

thamer wrote: post #138
dude3 wrote: post #115

Earlier quoted context omitted.

You can remove 2FA, login with Plaid, and re add it. This worked for me.

I'm already uneasy with the way Plaid works, I'm not also going to disable 2FA on my account to accommodate the broken way they access accounts (pretending to be a browser instead of using APIs). There are good, secure ways to grant access to resources, and giving your password to Plaid for them to log in to your account with reduced security is definitely not one of them and certainly not an attractive proposition.

It's all in the way Plaid connects to the banks - they do not systematically support MFA in their bank connectors; hence the issues you are seeing.

Re: Visa Buys Plaid

#323

Post by smabie »

mritchie712 wrote: post #302
TremendousJudge wrote: post #293

Earlier quoted context omitted.

So a single point of failure then? It also means you are holding your cards on your time all the time you use your phone on the street, which is prime time for somebody to come and snag it out of your hand

it looks like a normal case, you can't see the cards. not a single point at all, it's just a couple cards in the slot.

So now if you lose your phone you also lose your wallet and are really screwed. It’s better to hedge your risk and keep important stufd in different places. It might increase the chance of losing something but mitigates the risk of losing everything. I think most people would prefer to mitigate the big risk instead of the small ones.

Re: Visa Buys Plaid

#324

Post by Nextgrid »

raesene9 wrote: post #289
Nextgrid wrote: post #203

Earlier quoted context omitted.

This is a sham. You need to go through lots of audits & other administrative BS in order to be declared an "AISP" even if you don't actually process banking data yourself and it never leaves the user's device. Imagine PCI-DSS compliance but without the exception that you don't have to be PCI-compliant yourself if you don't touch card data and pass it directly to a PCI-compliant payment processor.

Why is it a sham? TPPs (who are either AISPs and/or PISPs) process banking information for customers of participating banks. A TPP will typically provide some kind of service like a unified view of customer finances, and as part of that they're processing customer banking info. It would be an unusual TPP where the data never left the customer's device. Usually there'll be a web service/web app provided by the TPP and…

> It would be an unusual TPP where the data never left the customer's device.

Why? The scenario you mention (providing an unified view of a person's multiple accounts & credit cards) can perfectly be done on the device itself and negates plenty of concerns regarding security, the need for a backend, etc. I personally made an app to display my balance & transactions on my Apple Watch. It's purely local and doesn't even have a backend. Yet, I can't actually launch it "by the rules" because I need to become an AISP even though I never come in contact with actual banking data.

> 3rd parties getting full banking creds for customers.

This is clearly a stop-gap solution until something better comes around, and frankly it isn't the worst solution if you trust the third-party. At least it becomes the user's choice whether to share credentials instead of the bank or some other entity deciding who can and can't have access based on potentially stupid or anti-competitive reasons.

Re: Visa Buys Plaid

#325

Post by Nextgrid »

moviuro wrote: post #271
bagacrap wrote: post #220

Earlier quoted context omitted.

Most manual processes, I agree, automate away. But not the ones that have negative implications for security. I don't care whether it's the TOS or some other means that's used to prevent pw sharing, but it should be prevented. It is the bank's duty to protect its users, not to tolerate services that actively discourage safe practices like 2fa.

In the EU, we're getting DSP2 [0] which requires banks to publish usable APIs to: get account information, and initiate money transfers. That's huge, though only at a baby stage for the moment. [0] https://ec.europa.eu/commission/presscorner/detail/en/IP_15_...

This is a sham. You need to go through a certification process which costs $$$ before you can get access to those APIs even if the banking data is processed locally, which will only empower the incumbents while locking out open-source solutions and indie developers (remember that a lot of tools & products we use started as someone's side-project; this regulation locks those out by default).

At least with credential sharing & screen-scraping nobody can lock you out. Does it suck? Yeah. But I'd rather take a solution that sucks than no solution at all.

Re: Visa Buys Plaid

#326

Post by cookiecaper »

dmoy wrote: post #319
cookiecaper wrote: post #148

Earlier quoted context omitted.

Sounds like a great reason to relocate to a state that is more reasonable about income taxes than CA.

imo the cap gains treatment from CA is pretty normal compared to the majority of states. The part where CA chases your stock grants/options for years after you leave the state is a bit less reasonable to me. (But I'd guess some other states do the same)

Right, the taxation mechanism is typical, but it's the amount that's onerous. CA has the highest state income tax rate in the nation. If states are going to tax capital gains as income anyway, it's all the more reason to move to a state with low or non-existent state income tax.

Re: Visa Buys Plaid

#327

Post by jiofih »

Tankenstein wrote: post #262
jiofih wrote: post #254

Earlier quoted context omitted.

It might look dreary to you from a distance, but for us on the ground, it is working. My bank is already offering to show any other banks’ statements along my accounts.

It's only working for large, existing players, is his point. For me wanting to build automatic syncing to my budget tools, I'm still out of luck. They don't even let you access your own data.

That’s kind of expected, isn’t it? An integration you make could be potentially used/abused by others and must be thoroughly vetted. For personal use my bank offers daily CSV downloads.

Re: Visa Buys Plaid

#329

Post by raesene9 »

Nextgrid wrote: post #324
raesene9 wrote: post #289

Earlier quoted context omitted.

Why is it a sham? TPPs (who are either AISPs and/or PISPs) process banking information for customers of participating banks. A TPP will typically provide some kind of service like a unified view of customer finances, and as part of that they're processing customer banking info. It would be an unusual TPP where the data never left the customer's device. Usually there'll be a web service/web app provided by the TPP and…

> It would be an unusual TPP where the data never left the customer's device. Why? The scenario you mention (providing an unified view of a person's multiple accounts & credit cards) can perfectly be done on the device itself and negates plenty of concerns regarding security, the need for a backend, etc. I personally made an app to display my balance & transactions on my Apple Watch. It's purely local and doesn't eve…

Purely on a customer device would be extremely difficult as the OAuth keys for obtaining the consent would need to be stored on the device, which isn't a solution that scales past one user, from a security standpoint.

The problem of customer choice is that customers are very badly informed about the relative security of services, so there's a market for lemons. If the bank has no liability, that's possibly fine (although it could be argued the bank has some responsibility to advise the customer), but if the bank has any liability for issues resulting, then they get a say in the outcome.

Re: Visa Buys Plaid

#330

Post by Nextgrid »

jiofih wrote: post #327
Tankenstein wrote: post #262

Earlier quoted context omitted.

It's only working for large, existing players, is his point. For me wanting to build automatic syncing to my budget tools, I'm still out of luck. They don't even let you access your own data.

That’s kind of expected, isn’t it? An integration you make could be potentially used/abused by others and must be thoroughly vetted. For personal use my bank offers daily CSV downloads.

> For personal use my bank offers daily CSV downloads.

Can you automate this? This is my point. Manual CSV exports are not a solution. Open Banking was supposed to solve this but it's a complete sham that is only there to make them look like they're doing something and benefit the existing incumbents.

Post reply on HN