Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaid paid people $500 for their employer payroll logins

vice.com

Post reply on HN
Print view View original

41–50 of 101 posts

Re: Plaid paid people $500 for their employer payroll logins

#41

Post by sa46 »

KingMachiavelli wrote: post #18

> https://www.eff.org/cases/facebook-v-power-ventures While it is bad and unethical to encourage sharing credentials, I really hope we don't continue to criminalize intermediary services that act on the user's behalf. User's should be able to use whatever product and services they want. If you don't want consumer's to use third party tools then either improve your own tools or implement better security. On the bright…

Seems a bit counter-intuitive to brand Plaid's behavior as unethical and then argue that users should have agency to share their own passwords.

At a meta-level, using unethical as a qualifier seems like an attempt to bolster an argument without having to provide a logical argument. I think most discussions are cleaner without broaching the thorny topic of ethics. Such discussions usually devolve into ideological battles, which by HN guidelines, "trample curiosity".

Re: Plaid paid people $500 for their employer payroll logins

#42

Post by wikibob »

imgabe wrote: post #37
KingMachiavelli wrote: post #18

> https://www.eff.org/cases/facebook-v-power-ventures While it is bad and unethical to encourage sharing credentials, I really hope we don't continue to criminalize intermediary services that act on the user's behalf. User's should be able to use whatever product and services they want. If you don't want consumer's to use third party tools then either improve your own tools or implement better security. On the bright…

Financial institutions should all be required to provide API with various permissions so consumers can connect whatever 3rd party tools they want. Coinbase has a good API where you can specify read-only access to whichever accounts and wallets you want.

Look up PSD2. Exactly that is required in EU

Re: Plaid paid people $500 for their employer payroll logins

#43

Post by sagarm »

sa46 wrote: post #41
KingMachiavelli wrote: post #18

> https://www.eff.org/cases/facebook-v-power-ventures While it is bad and unethical to encourage sharing credentials, I really hope we don't continue to criminalize intermediary services that act on the user's behalf. User's should be able to use whatever product and services they want. If you don't want consumer's to use third party tools then either improve your own tools or implement better security. On the bright…

Seems a bit counter-intuitive to brand Plaid's behavior as unethical and then argue that users should have agency to share their own passwords. At a meta-level, using unethical as a qualifier seems like an attempt to bolster an argument without having to provide a logical argument. I think most discussions are cleaner without broaching the thorny topic of ethics. Such discussions usually devolve into ideological batt…

The difference IMO is that Plaid is often used for e.g. tenant applications, where the person requiring the use of Plaid and the person forced to disclose credentials are not the same. That's bad.

If I choose to give my credentials to e.g. Mint to aggregate information for my own benefit, that's good because it was entirely my choice.

Re: Plaid paid people $500 for their employer payroll logins

#44

Post by [deleted] »

FractalParadigm wrote: post #13
hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

Hell even here in Canada we have the Interac system, which from what little I know of the US banking system, is consistently 10+ years ahead of the game. I've had "Chip & PIN" on my cards since at least 2008, and distinctly remember getting my first "tap" card in ~2011 or so. I genuinely couldn't tell you the last time I inserted my card into a machine because anything under $100 (>99% of my in-store purchases) can b…

[deleted]

Re: Plaid paid people $500 for their employer payroll logins

#45

Post by sagarm »

ncallaway wrote: post #21
tehwebguy wrote: post #12

On the consumer side I can’t imagine ever giving my bank credentials to Plaid or any other company. Super unnerving that this is even a thing, it’s like the number one rule of passwords.

I agree. I really wanted to use mint, but couldn't bring myself to give away my bank password. I resorted to writing my own tooling using puppeteer running on my machine to automatically login to my bank accounts and download the CSV exports of my transaction data for each bank. I then normalize that transaction data, and import the data into Lunch Money. It was a pretty big hassle to write and get working reliably(i…

Some banks now offer proper APIs, allowing Mint to redirect you to their OAuth flow-equivalent. So it's slowly improving.

Re: Plaid paid people $500 for their employer payroll logins

#46

Post by sagarm »

yonran wrote: post #4

I bet many banks have similar language prohibiting sharing logins, so you could make the argument that the core business of Plaid could be considered hacking under CFAA. I hope that the legitimate use of tools to do things on the Internet will be normalized before this argument is tried in court.

Yodlee (used by Mint and likely others) has been around for over a decade, and AFAIK nothing happened to them.

Re: Plaid paid people $500 for their employer payroll logins

#47

Post by refurb »

FractalParadigm wrote: post #13
hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

Hell even here in Canada we have the Interac system, which from what little I know of the US banking system, is consistently 10+ years ahead of the game. I've had "Chip & PIN" on my cards since at least 2008, and distinctly remember getting my first "tap" card in ~2011 or so. I genuinely couldn't tell you the last time I inserted my card into a machine because anything under $100 (>99% of my in-store purchases) can b…

Interac e-transfer seem fraught with scams and fraud. There were a few Reddit threads on how to protect transfers from being intercepted.

Re: Plaid paid people $500 for their employer payroll logins

#48

Post by ncallaway »

climb_stealth wrote: post #34
ncallaway wrote: post #21

Earlier quoted context omitted.

I agree. I really wanted to use mint, but couldn't bring myself to give away my bank password. I resorted to writing my own tooling using puppeteer running on my machine to automatically login to my bank accounts and download the CSV exports of my transaction data for each bank. I then normalize that transaction data, and import the data into Lunch Money. It was a pretty big hassle to write and get working reliably(i…

Did you release the sources for this by any chance? I have been playing with the idea of doing something like this for a long time. But it seems like a huge job and I haven't been able to motivate myself towards it yet. My bank even supports showing a lot of those spending stats as in Lunch Money, but it is entirely on their end and I'm not in control of it at all. I can look at the graphs and numbers in the app but…

I haven't released it. I've considered it, and it's written in a way that others could use it, but I know if it gained significant popularity it would be a really high value target to compromise. I don't have the time to dedicate to the vigilance necessary to defend that kind of a target.

If you're interested, I'd be happy to share the source with you as a starting point

Re: Plaid paid people $500 for their employer payroll logins

#49

Post by ncallaway »

sagarm wrote: post #45
ncallaway wrote: post #21

Earlier quoted context omitted.

I agree. I really wanted to use mint, but couldn't bring myself to give away my bank password. I resorted to writing my own tooling using puppeteer running on my machine to automatically login to my bank accounts and download the CSV exports of my transaction data for each bank. I then normalize that transaction data, and import the data into Lunch Money. It was a pretty big hassle to write and get working reliably(i…

Some banks now offer proper APIs, allowing Mint to redirect you to their OAuth flow-equivalent. So it's slowly improving.

Yep, but unfortunately it's only a small handful of the banks. And it tends to be the larger national banks that offer proper APIs, and I tend to avoid banking with those.

I'd really like to see Open Banking API laws passed in the US to require banks to offer this kind of API.

Re: Plaid paid people $500 for their employer payroll logins

#50

Post by seanhunter »

hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

It boggles my mind how far behind the payments curve the US is. If you go to India or Indonesia you can pay guy cooking street food at the side of the road by scanning a QR code but in New York you still have people paying for sandwiches in Pret a Manger using a cheque.
Post reply on HN