5 ms·
Seems like the auth flow doesn't redirect to the bank's website. Does that mean that my bank credentials are sent to Plaid?
by findjashua 10y ago
Seems like the auth flow doesn't redirect to the bank's website. Does that mean that my bank credentials are sent to Plaid?
- deleted 10y ago[deleted]
- ceejayoz 10y agoYes. That's how Mint, Digit, and all the other "connect your bank account" apps tend to do it. I've yet to find a major US bank that has anything resembling an OAuth style flow - the closest I've seen is Wells Fargo offering generation of read-only credentials.
- deleted 10y ago[deleted]
- findjashua 10y agoThen how is Plaid more secure than Mint, Digit etc?
- Artemis2 10y agoFrom this [1], they are a provider for these. 1: https://news.ycombinator.com/item?id=11939425 https://news.ycombinator.com/item?id=11939425
- findjashua 10y agoSo, they're just punting the liability to another 3rd party (Plaid)? Given all the excitement in this thread, I was hoping that Plaid had miraculously cajoled the banks into an OAuth integration. But I guess banks will be banks :-/
- anonymousjunior 10y agoI'm sure something of the sort is in the works; it's hard to build momentum with a ton of huge legacy systems to bring along.
- ceejayoz 10y agoBanks don't make this easy. There isn't a secure way of doing it in the vast majority of cases. Companies like Digit use Plaid to offload the risk of storing these credentials (like how most startups offload PCI/credit-card to Stripe). Intuit's big enough to have their own solution for Mint.