3 ms·
It looks like the credentials in credentials.json are your Plaid access key/secret/etc, not your bank account username/password. If an attacker gets them, they'
by GregorStocks 8y ago
It looks like the credentials in credentials.json are your Plaid access key/secret/etc, not your bank account username/password. If an attacker gets them, they'd have read-only access to your bank account until you rotate your Plaid creds, but they wouldn't be able to do anything as simple as logging into your bank account and transferring all your money out.
EDIT: It's actually worse than that, see comment from erichurkman below.
- reificator 8y agoThanks for the clarification, that's a little better. Still... EDIT: See the other response to this comment by erichurkman, this is still a potential vector for unauthorized payments, transfers, and withdrawals.
- erichurkman 8y agoCareful, because Plaid also gives you access to your account's routing and account numbers [0]. I'm not sure if the way this library works gives access to those, but with a routing & account number a thief _can_ write checks, debit your account, etc. [0] https://plaid.com/products/auth/ https://plaid.com/products/auth/
- GregorStocks 8y agoYeah, good point - I figured Auth wouldn't be enabled on a free developer account, but it looks like it actually is these days: https://plaid.com/pricing https://plaid.com/pricing.
- rflrob 8y agoAre routing and account numbers considered “secret”? Potentially any one of the handful of people I still write checks to could be unscrupulous and write checks, debit my account, etc., right?
- erichurkman 8y agoCorrect; that's why Knuth started issuing fake checks instead of real checks for people that found mistakes in his works: https://en.wikipedia.org/wiki/Knuth_reward_check https://en.wikipedia.org/wiki/Knuth_reward_check
- paulie_a 8y agoSo he started committing a felony? That doesn't seem like a great idea, interstate bank fraud gets you investigated really quickly.
- erichurkman 8y agoMore background: https://www-cs-faculty.stanford.edu/~knuth/news08.html https://www-cs-faculty.stanford.edu/~knuth/news08.html Current account 'balances' for people he no longer wrote personal checks to: https://www-cs-faculty.stanford.edu/~knuth/boss.html https://www-cs-faculty.stanford.edu/~knuth/boss.html
- paulie_a 8y agoI must be missing something but making fake checks, with fake banking information is a felony. What am I missing? The links don't explain how this criminal.
- wrs 8y agoYes! That’s why I recently had to go through the annoyance of changing checking accounts when someone stole the mail of one of the few vendors I still send checks to. Actually, I would have taken the risk, but my bank would not.