Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaid paid people $500 for their employer payroll logins

vice.com

Post reply on HN
Print view View original

61–70 of 101 posts

Re: Plaid paid people $500 for their employer payroll logins

#61

Post by lonesword »

ngc248 wrote: post #26
hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

"Even India, which in the past 3 months has unfortunately proven dysfunctional" what exactly does this mean? Other countries did not have a corona virus wave?

Indian here.

> what exactly does this mean?

That our response to the current wave has been tragic.

> Other countries did not have a corona virus wave?

Yes they did. However, we had the opportunity to learn from the tragic things that happened elsewhere and could have done stuff to prevent it/soften the blow but we didn't. The problem is not that we "allowed" another wave to happen, but that we allowed people to die due to a lack of oxygen and ICU beds.

Re: Plaid paid people $500 for their employer payroll logins

#62

Post by enchiridion »

FractalParadigm wrote: post #13
hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

Hell even here in Canada we have the Interac system, which from what little I know of the US banking system, is consistently 10+ years ahead of the game. I've had "Chip & PIN" on my cards since at least 2008, and distinctly remember getting my first "tap" card in ~2011 or so. I genuinely couldn't tell you the last time I inserted my card into a machine because anything under $100 (>99% of my in-store purchases) can b…

I was under the impression that chip and pin is more common in the UK and Canada because fraud is more of an issue, so the cost benefit works out in favor of it.

Even now you never have to pin in the US.

Re: Plaid paid people $500 for their employer payroll logins

#63

Post by cookguyruffles »

tgsovlerkhgsel wrote: post #57
hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

PSD2 seems like a total disaster to me. From my understanding, banks are required to provide an API. Not a specific one - any API. Which means each bank has a different one and you need yet another rent seeker that aggregates those APIs. That's on top of requiring specific, often outdated security mechanisms, so now every time I want to pay something with a credit card I have to do extra authentication, >1 GB of my p…

> Not a specific one - any API

Defining this is a job for industry bodies and suchlike, as is keeping it current. Lest we forget jokes like the 2020 Brexit agreement containing references to Netscape Navigator 4.0

Re: Plaid paid people $500 for their employer payroll logins

#64

Post by rendaw »

ncallaway wrote: post #21
tehwebguy wrote: post #12

On the consumer side I can’t imagine ever giving my bank credentials to Plaid or any other company. Super unnerving that this is even a thing, it’s like the number one rule of passwords.

I agree. I really wanted to use mint, but couldn't bring myself to give away my bank password. I resorted to writing my own tooling using puppeteer running on my machine to automatically login to my bank accounts and download the CSV exports of my transaction data for each bank. I then normalize that transaction data, and import the data into Lunch Money. It was a pretty big hassle to write and get working reliably(i…

I've been doing this for a couple years, just with Selenium rather than Puppeteer. Banks are generally okay, and they don't change their websites that often which is nice. A couple banks force phone 2FA and deliberately hide the "email confirmation" option which makes full automation difficult. Also nag screens, Selenium unreliability, etc.

Some companies like Azure use a different account name every time they bill me. I ended up having to regex the credit card transactions for that. Others have something completely nonsensical like "BS 03-6743-2266" (The real issue for me is getting itemized purchases to do categorization on. Stuff like restaurants are okay since everything is food, so I can just categorize the whole transaction. Amazon banned me and forced me to change my password while trying to grab my purchase history (and only my purchase history!). I was trying to grab it from email receipts but then I realized they don't send receipts for Subscribe & Save purchases (!).

I'd kill for something better, but for now it's this or manually enter every transaction or give up on financial responsibility.

Re: Plaid paid people $500 for their employer payroll logins

#65

Post by zwirbl »

enchiridion wrote: post #62
FractalParadigm wrote: post #13

Earlier quoted context omitted.

Hell even here in Canada we have the Interac system, which from what little I know of the US banking system, is consistently 10+ years ahead of the game. I've had "Chip & PIN" on my cards since at least 2008, and distinctly remember getting my first "tap" card in ~2011 or so. I genuinely couldn't tell you the last time I inserted my card into a machine because anything under $100 (>99% of my in-store purchases) can b…

I was under the impression that chip and pin is more common in the UK and Canada because fraud is more of an issue, so the cost benefit works out in favor of it. Even now you never have to pin in the US.

In the UK it's mostly likely because of EU regulations. I've never had anything but chip and pin in the EU, got my first card ~2006

Re: Plaid paid people $500 for their employer payroll logins

#66

Post by digianarchist »

FractalParadigm wrote: post #13
hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

Hell even here in Canada we have the Interac system, which from what little I know of the US banking system, is consistently 10+ years ahead of the game. I've had "Chip & PIN" on my cards since at least 2008, and distinctly remember getting my first "tap" card in ~2011 or so. I genuinely couldn't tell you the last time I inserted my card into a machine because anything under $100 (>99% of my in-store purchases) can b…

I think you're painting a rosy picture of the Interac system.

It's not instant. Transfers can be delayed for hours in some cases.

It has ridiculously low limits that cannot be raised.

Until recently it had a cumbersome question and answer system with strange character limits for each.

Virtually no businesses use it. You can buy weed (illegally) using it because they can't use credit card processing.

A revamp to the Interac system is in the works which looks similar to the UK faster payments. A frankly much better system.

https://www.theglobeandmail.com/business/article-interac-cho...

Re: Plaid paid people $500 for their employer payroll logins

#67

Post by andyjohnson0 »

zwirbl wrote: post #65
enchiridion wrote: post #62

Earlier quoted context omitted.

I was under the impression that chip and pin is more common in the UK and Canada because fraud is more of an issue, so the cost benefit works out in favor of it. Even now you never have to pin in the US.

In the UK it's mostly likely because of EU regulations. I've never had anything but chip and pin in the EU, got my first card ~2006

Chip and PIN was rolled-out in the UK in late 2003

Re: Plaid paid people $500 for their employer payroll logins

#68

Post by lbotos »

mgarfias wrote: post #15
jc_811 wrote: post #11

Earlier quoted context omitted.

I think the biggest issue is that they were paying employees for login credentials to sensitive systems. Imagine you’re an IT manager and you find out that an employee is giving the company’s* usernames and passwords - to a 3rd party at their own discretion. I think this is a HUGE deal. Unless the employees had explicit permission from the employer (the article strongly insinuates they did not), I don’t see how this…

I got the impression it was the employee side of the app. As in me logging into ADP so they can figure out how to scrape ADP

Yes, but I'm sure most employment contracts say something to the effect of "you will not grant unauthorized access to company property or systems."

And the fact that the employee was paid, shows that the interest was in the employee's favor, not the businesses. (conflict of interest)

It's the same as if a salesperson said "I'll give you $500 to help me get into your office building, and navigate me to the payroll department's desk. I just wanna understand the layout for a meeting I want to have in a few weeks."

Re: Plaid paid people $500 for their employer payroll logins

#69

Post by pjerem »

enchiridion wrote: post #62
FractalParadigm wrote: post #13

Earlier quoted context omitted.

Hell even here in Canada we have the Interac system, which from what little I know of the US banking system, is consistently 10+ years ahead of the game. I've had "Chip & PIN" on my cards since at least 2008, and distinctly remember getting my first "tap" card in ~2011 or so. I genuinely couldn't tell you the last time I inserted my card into a machine because anything under $100 (>99% of my in-store purchases) can b…

I was under the impression that chip and pin is more common in the UK and Canada because fraud is more of an issue, so the cost benefit works out in favor of it. Even now you never have to pin in the US.

I think it's more common in europe because the first industrial producer of chip card was created in France (Gemplus, now Gemalto). In France, payment cards are "dual network" : any card is either Visa OR Mastercard AND also "CB". "CB" is a payment network managed by the "GIE Carte Bancaire" owned by all french banks.

CB dealt with Gemplus to add chip to all new cards emitted since 1992 so we had them for a long time. I don't know how it spread over europe, but as we had the industrial capacity to provide chip cards to everyone and a free market, I think it was easy to sell that to lots of european banks. CHIP+PIN is a really great deal for banks : it's cheap and the responsibility of all payments made with the PIN is on the card owner and are really hard (or impossible) to dispute.

Re: Plaid paid people $500 for their employer payroll logins

#70

Post by nly »

enchiridion wrote: post #62
FractalParadigm wrote: post #13

Earlier quoted context omitted.

Hell even here in Canada we have the Interac system, which from what little I know of the US banking system, is consistently 10+ years ahead of the game. I've had "Chip & PIN" on my cards since at least 2008, and distinctly remember getting my first "tap" card in ~2011 or so. I genuinely couldn't tell you the last time I inserted my card into a machine because anything under $100 (>99% of my in-store purchases) can b…

I was under the impression that chip and pin is more common in the UK and Canada because fraud is more of an issue, so the cost benefit works out in favor of it. Even now you never have to pin in the US.

I thought it was the US that was still considered a hot bed for card fraud.

I've been to stores in the US where they just swipe your magstrip and hand you back the card. No signature, no pin, they don't even look at it, so you can basically clone cards like it's still 1985.

This is consistent with how my UK bank treats any transaction occurring in the US: usually it's an instant card block and a polite phone call from them to check that it was actually me.

Post reply on HN