Fintech startup Plaid raises $250M at a $2.65B valuation • Hacker News Board

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#41

Post by darkerside » Tue, Dec 11, 2018, 3:22 PM UTC

rco8786 wrote: post #35

jka wrote: post #28

Earlier quoted context omitted.

Hi William, This may be true - but you do still normalize users to the practice of entering their banking login credentials into a web form which is sent to a third party (i.e. yourselves). In addition I believe the developer gains access to the users' bank transaction history - not just for the duration of their login session, but long-term, which is likely something that users aren't fully aware of in most cases. A…

I have my own issues with Plaid, but I think you’re reaching a bit here. Everything Plaid does is opt in by the end user. They’re not selling data unbeknownst to the user (assuming co-founder above is being genuine), the user is giving another service permission to use their data. As for bank logins...that’s been around since long before Plaid. But I agree there must be a better way. Though I don’t have any great pra…

Do users have any idea exactly what they're giving up here though? Do they have fine-grained permissions to allow read-only vs write access, and to choose between transaction and account level data? And is there anything that prevents those second-party developers from then turning around and selling data to third parties (besides their own TOS with Plaid)?

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#42

Post by colinsidoti » Tue, Dec 11, 2018, 3:28 PM UTC

chatmasta wrote: post #29

Plaid is a great idea, but the implementation worries me. My understanding is that, for most banks, you give Plaid your username and password, and Plaid scrapers on their servers log into your online banking account. Even worse, Plaid obfuscates this behavior from users by replicating their banks login window and making it appear that you are logging directly into your bank. I'm not sure how to feel about this, becau…

To add an interesting layer, financial institutions are investing in these solutions. Goldman previously invested in Plaid, and Fidelity invested in Quovo which takes a similar approach.

At some point I think it's on the banks to offer OAuth APIs, then Plaid can swap out one-by-one (if it hasn't already started).

Nylas is facing the same challenge in the email space. They have oauth for gmail, but user/pass for Exchange/SMTP.

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#43

Post by siamakfr » Tue, Dec 11, 2018, 3:28 PM UTC

astura wrote: post #26

eurothrow wrote: post #22

Can anyone point to a list of apps/services that use this? For privacy reasons, I'd prefer to avoid anything of the sort.

You would know if you're being asked for your banks username and password by a third party and can decide if you want to share that information; it's not something that you really need to know anything about ahead of time to be able to avoid. The apps I know who use Plaid are Drop and Venmo. Some banks use it to instantly link external accounts without having to do trial deposits.

That's not entirely true. They try and imitate your bank's branding on the log in page and do not make any mention of Plaid. For example, when setting up Venmo, I thought I was logging into something my bank had created.

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#44

Post by curiousDog » Tue, Dec 11, 2018, 3:29 PM UTC

astura wrote: post #26

eurothrow wrote: post #22

Can anyone point to a list of apps/services that use this? For privacy reasons, I'd prefer to avoid anything of the sort.

You would know if you're being asked for your banks username and password by a third party and can decide if you want to share that information; it's not something that you really need to know anything about ahead of time to be able to avoid. The apps I know who use Plaid are Drop and Venmo. Some banks use it to instantly link external accounts without having to do trial deposits.

There’s a bunch on their website. Amex, betterment seem to use them as well

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#45

Post by dublidu » Tue, Dec 11, 2018, 3:30 PM UTC

eurothrow wrote: post #22

Can anyone point to a list of apps/services that use this? For privacy reasons, I'd prefer to avoid anything of the sort.

As a user, it would be pretty hard to tell if the app is using Plaid or Yodlee.

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#46

Post by eropple » Tue, Dec 11, 2018, 3:36 PM UTC

SilasX wrote: post #36

chatmasta wrote: post #29

Plaid is a great idea, but the implementation worries me. My understanding is that, for most banks, you give Plaid your username and password, and Plaid scrapers on their servers log into your online banking account. Even worse, Plaid obfuscates this behavior from users by replicating their banks login window and making it appear that you are logging directly into your bank. I'm not sure how to feel about this, becau…

That ... sounds like it violates every bank's ToS out there, and not the abusive buried-in-fine-print part, either. Every bank could, quite reasonably, cut off your access for this.

They could, but they won't (barring a change in the ecosystem). Basically everyone does exactly this when a bank doesn't have a federated login system. Take, for example, Personal Capital.

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#47

Post by pmart123 » Tue, Dec 11, 2018, 3:37 PM UTC

whockey wrote: post #14

akarma wrote: post #4

There's been a whistleblower or two on HN about how Plaid scapes and sells your bank account transaction history to third parties. It seems more unethical than most selling-user-data strategies in that the users don't even know Plaid is involved in the transaction whatsoever ; they're just a hidden middle layer. I'd be interested to know if this is still part of their monetization strategy, or if anyone at Plaid can…

Co-founder of Plaid here. This is not true, we do not sell transactional data to third parties. We make 100% of our money by letting developers build financial applications[1]. [1] - https://plaid.com/pricing/

I do think these aggregated services are a net benefit to the fintech ecosystem overall. However, any service that uses a Plaid type service still could be selling transaction data to third-parties. For instance, Acorns:

https://www.acorns.com/privacy/

>>> Acorns uses Plaid Inc. (“Plaid”) to gather your data from financial institutions...

>>> Acorns and Empyr will use transaction information from your Acorns debit card in connection with the Found Money Plus program as follows:

... to provide participating merchants or Empyr aggregated and anonymized information relating specifically to registered card activity solely to allow participating merchants and Empyr to assess the results of their campaign(s);

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#48

Post by xtrapolate » Tue, Dec 11, 2018, 3:38 PM UTC

chatmasta wrote: post #29

Plaid is a great idea, but the implementation worries me. My understanding is that, for most banks, you give Plaid your username and password, and Plaid scrapers on their servers log into your online banking account. Even worse, Plaid obfuscates this behavior from users by replicating their banks login window and making it appear that you are logging directly into your bank. I'm not sure how to feel about this, becau…

> "you give Plaid your username and password, and Plaid scrapers on their servers log into your online banking account"

So your username and password are just kept in some internal database somewhere? The scrapers probably decrypt the credentials in-memory.

Also - "scraping" data off of an undocumented API sounds risky. How can I guarantee a "scraper" won't accidentally mess something up for me?

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#49

Post by SilasX » Tue, Dec 11, 2018, 3:39 PM UTC

eropple wrote: post #46

SilasX wrote: post #36

Earlier quoted context omitted.

That ... sounds like it violates every bank's ToS out there, and not the abusive buried-in-fine-print part, either. Every bank could, quite reasonably, cut off your access for this.

They could, but they won't (barring a change in the ecosystem). Basically everyone does exactly this when a bank doesn't have a federated login system. Take, for example, Personal Capital.

So all these services are storing plaintext passwords for the banks?

Re: Fintech startup Plaid raises $250M at a $2.65B valuation

#50

Post by scient » Tue, Dec 11, 2018, 3:42 PM UTC

asianthrowaway wrote: post #25

scient wrote: post #16

Earlier quoted context omitted.

I hope not, because its such a shitshow. You literally give your bank credentials to a third party who then logs in to your account and scrapes info off of it - info that you have no control over. Capital One was smart enough to block them off (which is the bank I use), and now they actually provide proper OAuth based APIs to access your account.

Things are changing with PSD2 regulations. Banks in the EU starting in 2019 will have to provide open (and secure) APIs to third parties.

One can only hope this would make it to the US as well. The problem largely seems to be banks being ancient behemoths in terms of technology, and introducing APIs like this poses a significant risk from security and policy perspective. Plus its not going to be a major source of revenue either, so why bother?