Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaid paid people $500 for their employer payroll logins

vice.com

Post reply on HN
Print view View original

71–80 of 101 posts

Re: Plaid paid people $500 for their employer payroll logins

#71

Post by stefan_ »

enchiridion wrote: post #62
FractalParadigm wrote: post #13

Earlier quoted context omitted.

Hell even here in Canada we have the Interac system, which from what little I know of the US banking system, is consistently 10+ years ahead of the game. I've had "Chip & PIN" on my cards since at least 2008, and distinctly remember getting my first "tap" card in ~2011 or so. I genuinely couldn't tell you the last time I inserted my card into a machine because anything under $100 (>99% of my in-store purchases) can b…

I was under the impression that chip and pin is more common in the UK and Canada because fraud is more of an issue, so the cost benefit works out in favor of it. Even now you never have to pin in the US.

In the US, interchange fees are an order of magnitude more than in the EU, where they are capped. So there is a lot more fraud the system can silently swallow before anyone has to consider upsetting customers and vendors with PINs.

Re: Plaid paid people $500 for their employer payroll logins

#72

Post by nly »

KingMachiavelli wrote: post #18

> https://www.eff.org/cases/facebook-v-power-ventures While it is bad and unethical to encourage sharing credentials, I really hope we don't continue to criminalize intermediary services that act on the user's behalf. User's should be able to use whatever product and services they want. If you don't want consumer's to use third party tools then either improve your own tools or implement better security. On the bright…

Many banking apps won't even run on a rooted phone 'for my own safety', yet not so long ago the same banks allowed aggregation services that store my login credentials to have access to my accounts?

Re: Plaid paid people $500 for their employer payroll logins

#74

Post by stuaxo »

seanhunter wrote: post #50
hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

It boggles my mind how far behind the payments curve the US is. If you go to India or Indonesia you can pay guy cooking street food at the side of the road by scanning a QR code but in New York you still have people paying for sandwiches in Pret a Manger using a cheque.

Unbelievable, I can't remember why last saw a cheque in the UK.

Re: Plaid paid people $500 for their employer payroll logins

#75

Post by climb_stealth »

ncallaway wrote: post #48
climb_stealth wrote: post #34

Earlier quoted context omitted.

Did you release the sources for this by any chance? I have been playing with the idea of doing something like this for a long time. But it seems like a huge job and I haven't been able to motivate myself towards it yet. My bank even supports showing a lot of those spending stats as in Lunch Money, but it is entirely on their end and I'm not in control of it at all. I can look at the graphs and numbers in the app but…

I haven't released it. I've considered it, and it's written in a way that others could use it, but I know if it gained significant popularity it would be a really high value target to compromise. I don't have the time to dedicate to the vigilance necessary to defend that kind of a target. If you're interested, I'd be happy to share the source with you as a starting point

Sure, if you don't mind that would be great! My email is my hn username @noodfive.com

Thanks!

Re: Plaid paid people $500 for their employer payroll logins

#76

Post by scrollaway »

lmm wrote: post #58
tgsovlerkhgsel wrote: post #57

Earlier quoted context omitted.

PSD2 seems like a total disaster to me. From my understanding, banks are required to provide an API. Not a specific one - any API. Which means each bank has a different one and you need yet another rent seeker that aggregates those APIs. That's on top of requiring specific, often outdated security mechanisms, so now every time I want to pay something with a credit card I have to do extra authentication, >1 GB of my p…

> you need yet another rent seeker that aggregates those APIs. If anyone can implement such an aggregator, market competition should drive the cost of that close to zero soon enough.

And indeed it is. Nordigen's product for example is free; they make money on upselling an optional product on top.

https://nordigen.com/

Re: Plaid paid people $500 for their employer payroll logins

#77

Post by scrollaway »

rendaw wrote: post #64
ncallaway wrote: post #21

Earlier quoted context omitted.

I agree. I really wanted to use mint, but couldn't bring myself to give away my bank password. I resorted to writing my own tooling using puppeteer running on my machine to automatically login to my bank accounts and download the CSV exports of my transaction data for each bank. I then normalize that transaction data, and import the data into Lunch Money. It was a pretty big hassle to write and get working reliably(i…

I've been doing this for a couple years, just with Selenium rather than Puppeteer. Banks are generally okay, and they don't change their websites that often which is nice. A couple banks force phone 2FA and deliberately hide the "email confirmation" option which makes full automation difficult. Also nag screens, Selenium unreliability, etc. Some companies like Azure use a different account name every time they bill m…

You're doing this for personal or business expenses?

I'm curious to check this out, do you have a GitHub repo/account?

Re: Plaid paid people $500 for their employer payroll logins

#78

Post by astura »

lbotos wrote: post #68
mgarfias wrote: post #15

Earlier quoted context omitted.

I got the impression it was the employee side of the app. As in me logging into ADP so they can figure out how to scrape ADP

Yes, but I'm sure most employment contracts say something to the effect of "you will not grant unauthorized access to company property or systems." And the fact that the employee was paid, shows that the interest was in the employee's favor, not the businesses. (conflict of interest) It's the same as if a salesperson said "I'll give you $500 to help me get into your office building, and navigate me to the payroll dep…

They say their lawyers approved it, so I assume they verified they were getting credentials from higher ups who had the authorization and not just rank and file employees.

>Plaid told Motherboard 12 people participated in the test and that it was vetted by the company's legal counsel. Plaid added that participants' login credentials have since been deleted and that the test was only open to friends and family of existing Plaid employees.

Re: Plaid paid people $500 for their employer payroll logins

#79

Post by lbotos »

astura wrote: post #78
lbotos wrote: post #68

Earlier quoted context omitted.

Yes, but I'm sure most employment contracts say something to the effect of "you will not grant unauthorized access to company property or systems." And the fact that the employee was paid, shows that the interest was in the employee's favor, not the businesses. (conflict of interest) It's the same as if a salesperson said "I'll give you $500 to help me get into your office building, and navigate me to the payroll dep…

They say their lawyers approved it, so I assume they verified they were getting credentials from higher ups who had the authorization and not just rank and file employees. >Plaid told Motherboard 12 people participated in the test and that it was vetted by the company's legal counsel. Plaid added that participants' login credentials have since been deleted and that the test was only open to friends and family of exis…

This sentence is loosely worded. Plaid's lawyers may have approved it, but did the lawyers of the company systems that were accessed approve it?

I cannot imagine the company's I've worked for allowing a non-partner 3rd party to pay me, an individual, for access to company systems, let alone approving it even if I wasn't getting paid...

Additionally, as a Senior Manager in my org, I could not accept a payment like this as it's a conflict of interest. It's even more egregious if plaid "got approval from a higher up for $500"

Re: Plaid paid people $500 for their employer payroll logins

#80

Post by RileyJames »

rmesters wrote: post #52
hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

This is a problem that can only be solved by regulated open banking (i.e. regulator enforcing banks/FIs to build APIs following one standard). Until US has regulated open banking, users will be sharing bank credentials in plain text and providers will be screen-scraping bank accounts. There's lots of good examples of regulated open banking. Europe has PDS2. Australia has Consumer Data Right Act. Several other countri…

Australia’s open banking initiative is well captured by the big 4 banks. Good luck getting any access to it.

Having an act, and being able to use it any useful manner are two very different things.

Post reply on HN