Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plaid paid people $500 for their employer payroll logins

vice.com

Post reply on HN
Print view View original

91–100 of 101 posts

Re: Plaid paid people $500 for their employer payroll logins

#91

Post by vidarh »

CraigRood wrote: post #55
pfranz wrote: post #51

Earlier quoted context omitted.

I actually think the opposite is happening. Yes, a few are adding OAuth flow-equivalent, but even more are adding 2-factor and other security measures that prevent a third party. Maybe Plaid has enough clout to prevent it, but other services have dropped functionality for more and more accounts over the past 2-3 years in my experience.

IIRC, OpenBanking in the UK requires a re-auth every 90 days with the 2FA. I think thats a very reasonable balance, and means services don't have perpetual access.

It's frankly annoying. I wish they enforced a notification by some means instead (X still has access unless you do Y), at least for services that only need read-only access.

Re: Plaid paid people $500 for their employer payroll logins

#92

Post by enchiridion »

nly wrote: post #70
enchiridion wrote: post #62

Earlier quoted context omitted.

I was under the impression that chip and pin is more common in the UK and Canada because fraud is more of an issue, so the cost benefit works out in favor of it. Even now you never have to pin in the US.

I thought it was the US that was still considered a hot bed for card fraud. I've been to stores in the US where they just swipe your magstrip and hand you back the card. No signature, no pin, they don't even look at it, so you can basically clone cards like it's still 1985. This is consistent with how my UK bank treats any transaction occurring in the US: usually it's an instant card block and a polite phone call fro…

That just sounds like basic geo-fencing. I'm sure the opposite applies too.

Sounds like the other response about transaction fees is on the right track.

Re: Plaid paid people $500 for their employer payroll logins

#93

Post by hahaxdxd123 »

cactus2093 wrote: post #84
hahaxdxd123 wrote: post #9

The fact that Plaid even exists, and that their core business will probably continue to thrive for another decade makes me almost certain that the US will lose its stranglehold on innovation soon. In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unf…

Payments in the US are more of a minor nuisance than a serious problem. And the rise of companies like stripe, Shopify, plaid, and PayPal before them seem to be doing a fine job filling the gaps. I’m sure eventually we’ll get better low level payment rails, but I don’t think it would actually affect the day to day life of the average American much if at all which is why it hasn’t happened yet. If anything is going to…

I feel like this is just a more general trend of US legislators deadlocked so hard that it provides rent seekers the opportunity to step in and entrench themselves. I would argue that healthcare - which you mentioned - is another prime example of this.

If you think about it, the payments system is a 2+% sales tax! Levied by private corporations! I don't even have an alternative since by contract with Visa/MC stores can't provide a lower price for paying cash.

Re: Plaid paid people $500 for their employer payroll logins

#94

Post by ac29 »

hahaxdxd123 wrote: post #93
cactus2093 wrote: post #84

Earlier quoted context omitted.

Payments in the US are more of a minor nuisance than a serious problem. And the rise of companies like stripe, Shopify, plaid, and PayPal before them seem to be doing a fine job filling the gaps. I’m sure eventually we’ll get better low level payment rails, but I don’t think it would actually affect the day to day life of the average American much if at all which is why it hasn’t happened yet. If anything is going to…

I feel like this is just a more general trend of US legislators deadlocked so hard that it provides rent seekers the opportunity to step in and entrench themselves. I would argue that healthcare - which you mentioned - is another prime example of this. If you think about it, the payments system is a 2+% sales tax! Levied by private corporations! I don't even have an alternative since by contract with Visa/MC stores c…

> I don't even have an alternative since by contract with Visa/MC stores can't provide a lower price for paying cash.

This hasnt been true for over a decade. Cash discounts are allowed by the Durbin amendment.

See: https://www.law.cornell.edu/uscode/text/15/1693o-2 (b)(2)(A)

Re: Plaid paid people $500 for their employer payroll logins

#95

Post by hahaxdxd123 »

ac29 wrote: post #94
hahaxdxd123 wrote: post #93

Earlier quoted context omitted.

I feel like this is just a more general trend of US legislators deadlocked so hard that it provides rent seekers the opportunity to step in and entrench themselves. I would argue that healthcare - which you mentioned - is another prime example of this. If you think about it, the payments system is a 2+% sales tax! Levied by private corporations! I don't even have an alternative since by contract with Visa/MC stores c…

> I don't even have an alternative since by contract with Visa/MC stores can't provide a lower price for paying cash. This hasnt been true for over a decade. Cash discounts are allowed by the Durbin amendment. See: https://www.law.cornell.edu/uscode/text/15/1693o-2 (b)(2)(A)

Ahh thanks for the correction. This seems like it's still pretty consumer unfriendly though - you still have to advertise the card price in store and then you can take a discount at the register, as opposed to advertising a cash price and then adding a card charge.

There are a lot of small businesses around me that are cash only under $10/15 dollars. Given human psychology around advertised prices (i.e. most people don't think about opportunity cost), I'm not surprised cash discounts aren't common.

Re: Plaid paid people $500 for their employer payroll logins

#96

Post by kag0 »

nly wrote: post #72
KingMachiavelli wrote: post #18

> https://www.eff.org/cases/facebook-v-power-ventures While it is bad and unethical to encourage sharing credentials, I really hope we don't continue to criminalize intermediary services that act on the user's behalf. User's should be able to use whatever product and services they want. If you don't want consumer's to use third party tools then either improve your own tools or implement better security. On the bright…

Many banking apps won't even run on a rooted phone 'for my own safety', yet not so long ago the same banks allowed aggregation services that store my login credentials to have access to my accounts?

The difference is liability. If something happens due to the bank's app, the bank is liable. If you give your account credentials to some third party and something happens, that's not the bank's problem.

Re: Plaid paid people $500 for their employer payroll logins

#97

Post by tgsovlerkhgsel »

cookguyruffles wrote: post #63
tgsovlerkhgsel wrote: post #57

Earlier quoted context omitted.

PSD2 seems like a total disaster to me. From my understanding, banks are required to provide an API. Not a specific one - any API. Which means each bank has a different one and you need yet another rent seeker that aggregates those APIs. That's on top of requiring specific, often outdated security mechanisms, so now every time I want to pay something with a credit card I have to do extra authentication, >1 GB of my p…

> Not a specific one - any API Defining this is a job for industry bodies and suchlike, as is keeping it current. Lest we forget jokes like the 2020 Brexit agreement containing references to Netscape Navigator 4.0

Having a rule that banks need to agree on one and then implement it would be fine. What is not fine is allowing each bank to come up with their own, especially as banks have no interest of making usage of their API easy.

Re: Plaid paid people $500 for their employer payroll logins

#98

Post by tgsovlerkhgsel »

lmm wrote: post #58
tgsovlerkhgsel wrote: post #57

Earlier quoted context omitted.

PSD2 seems like a total disaster to me. From my understanding, banks are required to provide an API. Not a specific one - any API. Which means each bank has a different one and you need yet another rent seeker that aggregates those APIs. That's on top of requiring specific, often outdated security mechanisms, so now every time I want to pay something with a credit card I have to do extra authentication, >1 GB of my p…

> you need yet another rent seeker that aggregates those APIs. If anyone can implement such an aggregator, market competition should drive the cost of that close to zero soon enough.

Since the aggregator will process sensitive data, you need a lot of audits etc.

If you'd like to use the API to access your own account using open source software, good luck (unless you find an aggregator that is certified and allows you to access your own account through them).

Re: Plaid paid people $500 for their employer payroll logins

#99

Post by KingMachiavelli »

sa46 wrote: post #41
KingMachiavelli wrote: post #18

> https://www.eff.org/cases/facebook-v-power-ventures While it is bad and unethical to encourage sharing credentials, I really hope we don't continue to criminalize intermediary services that act on the user's behalf. User's should be able to use whatever product and services they want. If you don't want consumer's to use third party tools then either improve your own tools or implement better security. On the bright…

Seems a bit counter-intuitive to brand Plaid's behavior as unethical and then argue that users should have agency to share their own passwords. At a meta-level, using unethical as a qualifier seems like an attempt to bolster an argument without having to provide a logical argument. I think most discussions are cleaner without broaching the thorny topic of ethics. Such discussions usually devolve into ideological batt…

As I used the wrote the word 'unethical' I knew it was sort of the wrong choice. At best it is unclear and lacks substance. The logical argument explicitly phrased would have been:

> Plaid's behavior works against the social norms that the majority of the tech community supports; in this case it deviates from the norm of keeping login information private.

But actually after re-reading the article, everything seems perfectly fine. The number of participants was only 12 who were all related in some fashion to Plaid employees & everything was pretty well disclosed. So the updated logical argument would be:

> Plaid's actions were limited in scope such that it had little chance of undermining norms regarding account login security. The purpose behind their actions was to increase the interoperability of their software and other software which is seen as a legitimate and net-positive goal in the software community.

Re: Plaid paid people $500 for their employer payroll logins

#100

Post by seanhunter »

cactus2093 wrote: post #83
stuaxo wrote: post #74

Earlier quoted context omitted.

Unbelievable, I can't remember why last saw a cheque in the UK.

Don’t believe everything you read online, especially when the parent commenter is clearly not even American based on their spelling. I live in the US and have only used a “check” a couple of times in the past 5 years. And almost nobody would ever use one at a retail store or restaurant or food truck, if anything they’re only used for sending large sums of money to small businesses who want to avoid the 3% card proces…

I didn't just read it online- this is based on my experience as a UK citizen who used to live and work in Manhattan a lot up to 2 years ago (think: not permanently but enough in any given year to have to pay Federal and NY state income tax). More than once I saw people do this to buy sandwiches in the financial district and near to Madison square park, and I've even see people pay for groceries by cheque and get cash back the way that that people used to before ATMs existed. I can dimly remember my parents doing this maybe 40 years ago but have certainly never done myself. I was also for some time the unhappy owner of an extremely small number of shares and the company insisted on sending me my dividend (less than $5) every quarter by cheque.

When I opened my US bank account they asked me how many cheques I wanted "to get started". I said none. Like why would I ever use one for anything? I don't use a quill pen either.

Post reply on HN