Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaid paid people $500 for their employer payroll logins

vice.com

Post reply on HN
Print view View original

51–60 of 101 posts

Re: Plaid paid people $500 for their employer payroll logins

#51

Post by pfranz »

sagarm wrote: post #45
ncallaway wrote: post #21

Earlier quoted context omitted.

I agree. I really wanted to use mint, but couldn't bring myself to give away my bank password. I resorted to writing my own tooling using puppeteer running on my machine to automatically login to my bank accounts and download the CSV exports of my transaction data for each bank. I then normalize that transaction data, and import the data into Lunch Money. It was a pretty big hassle to write and get working reliably(i…

Some banks now offer proper APIs, allowing Mint to redirect you to their OAuth flow-equivalent. So it's slowly improving.

I actually think the opposite is happening. Yes, a few are adding OAuth flow-equivalent, but even more are adding 2-factor and other security measures that prevent a third party.

Maybe Plaid has enough clout to prevent it, but other services have dropped functionality for more and more accounts over the past 2-3 years in my experience.

Re: Plaid paid people $500 for their employer payroll logins

#52

Post by rmesters »

hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

This is a problem that can only be solved by regulated open banking (i.e. regulator enforcing banks/FIs to build APIs following one standard). Until US has regulated open banking, users will be sharing bank credentials in plain text and providers will be screen-scraping bank accounts.

There's lots of good examples of regulated open banking. Europe has PDS2. Australia has Consumer Data Right Act. Several other countries that are now implementing open banking legislation: Brazil, Japan, Saudi Arabia, Mexico, Singapore, Hong Kong, India.

It would be great to see US on that list some day.

Re: Plaid paid people $500 for their employer payroll logins

#53

Post by rmesters »

wikibob wrote: post #42
imgabe wrote: post #37

Earlier quoted context omitted.

Financial institutions should all be required to provide API with various permissions so consumers can connect whatever 3rd party tools they want. Coinbase has a good API where you can specify read-only access to whichever accounts and wallets you want.

Look up PSD2. Exactly that is required in EU

Not just EU. Also Australia, Brazil, Japan, Saudi Arabia, Mexico, Singapore, Hong Kong, India. Canada is rumoured to have this soon as well.

Re: Plaid paid people $500 for their employer payroll logins

#54

Post by tialaramex »

seryoiupfurds wrote: post #25
FractalParadigm wrote: post #13

Earlier quoted context omitted.

Hell even here in Canada we have the Interac system, which from what little I know of the US banking system, is consistently 10+ years ahead of the game. I've had "Chip & PIN" on my cards since at least 2008, and distinctly remember getting my first "tap" card in ~2011 or so. I genuinely couldn't tell you the last time I inserted my card into a machine because anything under $100 (>99% of my in-store purchases) can b…

Interac E-Transfers are great, except that I wish they didn't train people to click a link from their email and type in their bank password. Sure, it redirects to a login page on your own bank's web site, but how does a non-technical user know it's not a phishing lookalike? Really, the existing autodeposit feature would be perfect if it let you log in to your online banking and confirm pending transactions before aut…

Yeah, the technical security in all these systems is a bit half-hearted†. However, in my opinion the key is to legislate that the banks (who built or in some cases purchased said half-hearted system) eat the cost of that. Maybe they're comfortable with say $10Mpa of fraud in the system, if they really can't build a safer one for less than $10M you can see they'd have a point.

The problem comes when banks are able to argue that their half-hearted security means they aren't liable to pay for the consequences. Consumers need protecting against that.

† In the UK we have a lot of 3-D Secure, developed by Arcot. But of course the average consumer has no idea who "Arcot" are, and so no reason why they should distinguish an arcot.com site (legitimate, you're supposed to give them credentials if necessary to authenticate you) versus say badguy.example (a hypothetical phishing fraud). Both of them can show you branded imagery from your bank, both have a padlock, both claim they're keeping you safe. How should an ordinary person know?

Re: Plaid paid people $500 for their employer payroll logins

#55

Post by CraigRood »

pfranz wrote: post #51
sagarm wrote: post #45

Earlier quoted context omitted.

Some banks now offer proper APIs, allowing Mint to redirect you to their OAuth flow-equivalent. So it's slowly improving.

I actually think the opposite is happening. Yes, a few are adding OAuth flow-equivalent, but even more are adding 2-factor and other security measures that prevent a third party. Maybe Plaid has enough clout to prevent it, but other services have dropped functionality for more and more accounts over the past 2-3 years in my experience.

IIRC, OpenBanking in the UK requires a re-auth every 90 days with the 2FA. I think thats a very reasonable balance, and means services don't have perpetual access.

Re: Plaid paid people $500 for their employer payroll logins

#56

Post by lstamour »

seryoiupfurds wrote: post #25
FractalParadigm wrote: post #13

Earlier quoted context omitted.

Hell even here in Canada we have the Interac system, which from what little I know of the US banking system, is consistently 10+ years ahead of the game. I've had "Chip & PIN" on my cards since at least 2008, and distinctly remember getting my first "tap" card in ~2011 or so. I genuinely couldn't tell you the last time I inserted my card into a machine because anything under $100 (>99% of my in-store purchases) can b…

Interac E-Transfers are great, except that I wish they didn't train people to click a link from their email and type in their bank password. Sure, it redirects to a login page on your own bank's web site, but how does a non-technical user know it's not a phishing lookalike? Really, the existing autodeposit feature would be perfect if it let you log in to your online banking and confirm pending transactions before aut…

I suggested to a big bank back in 2011 that they should have an iPhone app that sends a push notification to alert me to debit or point-of-sale transactions so I could approve them as they happened, and they only recently did so. But in their defense, security can be cumbersome and hardware-integrated tokens like Apple Pay are just as good and simpler to explain, assuming we can get rid of legacy plastic at some date in the future.

Similarly, we won't be able to get rid of email but if clicking a link in an email opened an app instead of a webpage, it would be a lot harder for phishing websites to pretend to be my bank. (Assuming I'm expecting a mobile app, of course. A second line of defense is that my password manager might not prompt me to fill in the password because the URL doesn't match. But even that's not foolproof.) Even better would be if Interac E-Transfer itself was an app I could sign up for, then it could send me a push notification and I could skip my inbox entirely for these sort of transactions.

Of course, the only reason I trust apps more than websites is that I went to download them previously, rather than clicking a link that just showed up in my inbox. To that end, Gmail and other email providers have immense power if they created a design which could highlight emails from senders I've seen before as "trusted" and those from unknown senders as unknown.

Things get more gray-area though when the system itself fails: You can request money from anyone using Interac E-Transfers, and that means spammers could hijack a bank account and request money from friends and relatives you've recently sent e-transfers to, for example. Those emails would then appear as "trusted" and there's not much you can do to stop that, it's the cost of making money transfer "easy".

Re: Plaid paid people $500 for their employer payroll logins

#57

Post by tgsovlerkhgsel »

hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

PSD2 seems like a total disaster to me.

From my understanding, banks are required to provide an API. Not a specific one - any API. Which means each bank has a different one and you need yet another rent seeker that aggregates those APIs.

That's on top of requiring specific, often outdated security mechanisms, so now every time I want to pay something with a credit card I have to do extra authentication, >1 GB of my phone's memory is filled just with bank auth apps (again, each bank has their own).

Re: Plaid paid people $500 for their employer payroll logins

#58

Post by lmm »

tgsovlerkhgsel wrote: post #57
hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

PSD2 seems like a total disaster to me. From my understanding, banks are required to provide an API. Not a specific one - any API. Which means each bank has a different one and you need yet another rent seeker that aggregates those APIs. That's on top of requiring specific, often outdated security mechanisms, so now every time I want to pay something with a credit card I have to do extra authentication, >1 GB of my p…

> you need yet another rent seeker that aggregates those APIs.

If anyone can implement such an aggregator, market competition should drive the cost of that close to zero soon enough.

Re: Plaid paid people $500 for their employer payroll logins

#59

Post by unishark »

sa46 wrote: post #41
KingMachiavelli wrote: post #18

> https://www.eff.org/cases/facebook-v-power-ventures While it is bad and unethical to encourage sharing credentials, I really hope we don't continue to criminalize intermediary services that act on the user's behalf. User's should be able to use whatever product and services they want. If you don't want consumer's to use third party tools then either improve your own tools or implement better security. On the bright…

Seems a bit counter-intuitive to brand Plaid's behavior as unethical and then argue that users should have agency to share their own passwords. At a meta-level, using unethical as a qualifier seems like an attempt to bolster an argument without having to provide a logical argument. I think most discussions are cleaner without broaching the thorny topic of ethics. Such discussions usually devolve into ideological batt…

> At a meta-level, using unethical as a qualifier seems like an attempt to bolster an argument without having to provide a logical argument.

I seemed like more of a disclaimer to avoid such ideological battles and deliver a nuanced view. "I agree the practice is shady, but..."

Re: Plaid paid people $500 for their employer payroll logins

#60

Post by pfranz »

CraigRood wrote: post #55
pfranz wrote: post #51

Earlier quoted context omitted.

I actually think the opposite is happening. Yes, a few are adding OAuth flow-equivalent, but even more are adding 2-factor and other security measures that prevent a third party. Maybe Plaid has enough clout to prevent it, but other services have dropped functionality for more and more accounts over the past 2-3 years in my experience.

IIRC, OpenBanking in the UK requires a re-auth every 90 days with the 2FA. I think thats a very reasonable balance, and means services don't have perpetual access.

Oh, I'd be ecstatic if that's how it worked. Instead, I have to go through 2FA every time I want to update with some providers. Others say "Apologies, we're working with the provider to restore support" and have stopped working for years. Others I can transfer money but can no longer see the balance.

On rare occasion I see banks that have a revocable token. I can't remember the exact linking process, but presumably they don't get my credentials, I can specify read-only access and specify specific accounts, it need periodic renewal, and from the bank end I can see who I gave permission to and revoke access from there. This doesn't seem common and I'm not sure if all the clients support those banks (or if it's a limited "in-group").

None of this is especially novel. It's just the incentives and efforts aren't there.

Post reply on HN