“Plaid consolidates financial data from multiple sources and categorizes transaction data with up to 24 months of history, making it easy to use and analyze.”
Fintech startup Plaid raises $250M at a $2.65B valuation
61–70 of 143 posts
Re: Fintech startup Plaid raises $250M at a $2.65B valuation
#62Plaid is a great idea, but the implementation worries me. My understanding is that, for most banks, you give Plaid your username and password, and Plaid scrapers on their servers log into your online banking account. Even worse, Plaid obfuscates this behavior from users by replicating their banks login window and making it appear that you are logging directly into your bank. I'm not sure how to feel about this, becau…
Not a Plaid user, but I believe Mint works the same way. It seems to only decrypt my bank credentials with a key derived from my session password, so I suspect Plaid, if what you say is correct, do something similar.
Basically, my password is hashed to see if I can log on. Then it's passed through a PBKDF to get the decryption key for my actual accounts, then that information gets sent to the scrapers to do the actual job. They don't store the keys after the job is done. The upshot is that a full database breach doesn't result in any bank credentials leaking, at the cost of inability to update accounts without the user explicitly logging in.
Re: Fintech startup Plaid raises $250M at a $2.65B valuation
#63Side note: I once heard from the venture arm of a rather well known CRM that Patagonia gets upset when you embroider your logo on their jackets ( e.g. in this picture https://techcrunch.com/wp-content/uploads/2018/12/DSC1296-2.... )...
Re: Fintech startup Plaid raises $250M at a $2.65B valuation
#64I met quite a few folks on the Plaid engineering team and was really impressed with the people I met and how they were approaching building their product. Congrats to them, and a lot more work to do!
Re: Fintech startup Plaid raises $250M at a $2.65B valuation
#65Plaid is a great idea, but the implementation worries me. My understanding is that, for most banks, you give Plaid your username and password, and Plaid scrapers on their servers log into your online banking account. Even worse, Plaid obfuscates this behavior from users by replicating their banks login window and making it appear that you are logging directly into your bank. I'm not sure how to feel about this, becau…
[deleted]
Re: Fintech startup Plaid raises $250M at a $2.65B valuation
#66Earlier quoted context omitted.
Do users have any idea exactly what they're giving up here though? Do they have fine-grained permissions to allow read-only vs write access, and to choose between transaction and account level data? And is there anything that prevents those second-party developers from then turning around and selling data to third parties (besides their own TOS with Plaid)?
What write access would there be? Obviously this is a hugely sensitive service, I’m not denying that. But there’s a way to do it right and it seems that Plaid is attempting to do that. So I’m not ready to declare them evil before they actually do anything evil.
Many (most?) banking websites allow transferring money through the UI. A screen scraper technically has the same access.
Unfortunately the current approach of the major aggregation players is the only way to motivate the banks to give customers access to their own data through more reliable means.
Re: Fintech startup Plaid raises $250M at a $2.65B valuation
#67There's been a whistleblower or two on HN about how Plaid scapes and sells your bank account transaction history to third parties. It seems more unethical than most selling-user-data strategies in that the users don't even know Plaid is involved in the transaction whatsoever ; they're just a hidden middle layer. I'd be interested to know if this is still part of their monetization strategy, or if anyone at Plaid can…
Co-founder of Plaid here. This is not true, we do not sell transactional data to third parties. We make 100% of our money by letting developers build financial applications[1]. [1] - https://plaid.com/pricing/
You may not sell the data but you give developer's access to bank balance, transaction history, and income streams. Essentially some of the most private aspects of a person's life.
Seems legitimately useful for personal finance tools or loan providers.
However, I know your API is being used by point of sale systems. Seems super unethical for point of sale systems to access any info beyond, is this the right account, does it have enough money. I just hope you're enforcing some kind of restrictions or at the very least warning consumers what they're giving the merchant permission to access.
Re: Fintech startup Plaid raises $250M at a $2.65B valuation
#68I looked into plaid+stripe solution for our ACH payments need and after playing around with it a little I just didn't feel like I can put that in front of my clients and tell them 'Yeah put in your bank login and password on our website to make the payment, we promise it's secure'. Their solution didnt sell with me and I went for Stripe ACH where they make microdeposit and customer has to verify the amounts. Even PaySimple's eCheck solution sounds more reasonable to put in front of clients than to demand their bank login and password. IMHO
Re: Fintech startup Plaid raises $250M at a $2.65B valuation
#69I am not yet convinced that giving away your bank username and password to plaid/mint/other scrapers does not exempt the bank from the liability limits established in Reg E.
The user effectively gives away control of their deposit accounts. If it is subsequently misused (unlike an access device like a debit card), the user's disclosure of the password might give the bank an affirmative defense. Push to shove, in a large breach with bulk cashouts via wire a depository institution might not honor the claims.
It seems obvious that revocable access w/ tokens is a solution, but that gives up the game on the transaction data (and likely drives some of banks' reluctance to offer that functionality).
I'd love to have my mind changed about this, if someone can point me in the right direction.
Re: Fintech startup Plaid raises $250M at a $2.65B valuation
#70It seems disingenuous for the banks to not provide an API spec, and then invest in and present Plaid as an alternative. This is not a technology problem, this is about entrenched players making a buck wherever possible, without doing the logical thing.
I'm glad Europe has defined an API for it's banks to avoid this from happening there