3 ms·

It’s the Facebook API issue but IMO transaction data is much more sensitive so it’s a bigger issue. I have used the Plaid API and have no idea how they audit de

It’s the Facebook API issue but IMO transaction data is much more sensitive so it’s a bigger issue. I have used the Plaid API and have no idea how they audit developers to make sure they are using the data as intended and storing that data securely. One hack incident of a developer that exposes bank numbers and transaction data would be a huge reputational hit.

hn_throwaway_99 8y ago
Edit: I stand corrected, I didn't think you get full account number access but you do. Leaving original comment below. They don't expose bank numbers though, that's kind of the point. Developer access is all tokenized. That said, plaid does give you access to tons of detailed financial transaction data, and it's easy for companies to tie this to PII in their own systems, and I'm sure many of those companies have less robust security than plaid. As a developer, I thought "Wow, you can get so much data through plaid!" but then as a user I would refuse to ever use a plaid integration because I know how much data it gives them. Furthermore, I don't believe the average user really realizes just how much data they are giving up. I agree with you, though, it really is similar to the Facebook API issue. All it would take is a third party company packaging data in a way to use it to target political ads and then you've got 60 Minutes exposes all over the place.
- randomacct3847 8y ago
  Nah that’s not true. https://plaid.com/products/auth https://plaid.com/products/auth You get the full routing and account number with the Auth product - that is how you push and pull funds as a developer to a customer’s account.
  - ceejayoz 8y ago
    I'd note that you give those same numbers to every yahoo you ever write a check to. The US checking system is terrifyingly insecure in that regard.

3 ms·

It’s the Facebook API issue but IMO transaction data is much more sensitive so it’s a bigger issue. I have used the Plaid API and have no idea how they audit de

by randomacct3847 8y ago

hn_throwaway_99 8y ago
Edit: I stand corrected, I didn't think you get full account number access but you do. Leaving original comment below. They don't expose bank numbers though, that's kind of the point. Developer access is all tokenized. That said, plaid does give you access to tons of detailed financial transaction data, and it's easy for companies to tie this to PII in their own systems, and I'm sure many of those companies have less robust security than plaid. As a developer, I thought "Wow, you can get so much data through plaid!" but then as a user I would refuse to ever use a plaid integration because I know how much data it gives them. Furthermore, I don't believe the average user really realizes just how much data they are giving up. I agree with you, though, it really is similar to the Facebook API issue. All it would take is a third party company packaging data in a way to use it to target political ads and then you've got 60 Minutes exposes all over the place.
- randomacct3847 8y ago
  Nah that’s not true. https://plaid.com/products/auth https://plaid.com/products/auth You get the full routing and account number with the Auth product - that is how you push and pull funds as a developer to a customer’s account.
  - ceejayoz 8y ago
    I'd note that you give those same numbers to every yahoo you ever write a check to. The US checking system is terrifyingly insecure in that regard.