3 ms·

I recently learned that when you connect your Paypal account to your checking account, there's two verification methods you can choose between: 1) the good old

• andrewstuart2 8y ago
  The primary difference being that I go to Mint/Quickbooks/etc. expecting them to provide services that require access to my personal financial data. Facebook already has a messenger, so they definitely don't need access to my emails.
• 0xffff2 8y ago
  I believe most if not all legitimate companies that ask for your banking credentials (besides your bank, obviously) are just passing them straight to https://plaid.com/ https://plaid.com/. It's still questionable whether you should trust Plaid with your banking credentials, but at least you probably don't need to trust that Paypal and Mint are both going to store your credentials securely.
  • bpicolo 8y ago
    > but at least you probably don't need to trust that Paypal and Mint are both going to store your credentials securely. Sure you do. They have it in plaintext on their servers. It can end up in logs. It's also not just Plaid - Mint uses Intuit, Yodlee is an option. There's a whole lot of people you need to trust to use these services For many banks, it also means you need to disable 2fa on your banking account, so using these services directly weakens your security.
  • saluki 8y ago
    Why don't banks provide a read only api and login/password if this type of thing is becoming more common. Providing any company my banking or email account login password sounds like a really bad idea. And something I'm not willing to provide.
• inglor 8y ago
  I worked for a fintech company until 2 years ago. The CTO/CEO wanted to add a feature that lets users enter their bank password and through a service (Yodlee/TradeIt) lets the company read their stock portfolio and perform actions. I told them that I don't think people would trust their bank info to some small fintech startup. Boy was I wrong and people with 4M dollar stock trading accounts would enter their credentials all the time for convenience of not having to copy the data over (since brokers didn't have an API with tokens). Eventually the company grew and it's pretty reputable on its own but I remember this pretty vividly the surprise of people trusting all their money to us.
  • lostmyoldone 8y ago
    While sometimes user actually knowingly make those trade-offs, I suspect many think they do a quite different trade-off. It's not really that people trust you that much, it is more that they in the moment you ask don't understand the consequences at all. Unless you very explicitly tell the users about the risks, that they wold have zero recourse if something goes wrong, they will believe it is okay for them, that somehow everything is taken care of. Very similar to the why people fall for con men. Nobody expects someone to have the audacity to lie so grandly, act so confidently, while in truth being completely 'naked'. You tend to assume that the insanity must have a point, that the obvious loopholes must somehow be covered - taken care of - based on nothing but the fact that someone acted with confidence.
• Wowfunhappy 8y ago
  Actually, I was surprised to see yesterday that Google offered this as well, when I set my bank account as a payment method for my Google apps account. After a bit of consideration I went ahead and did it—I consider Google trustworthy as far as security practices, and to be honest, I didn't expect it to work. Chase forces (!) two step authentication despite my very strong password, and I thought that would prevent Google from logging in. To my surprise, the process appears to have worked fine—my bank account was verified. I also didn't get a "new sign in from" email from Chase. So I wonder if they actually logged in or did something else...
• jbj 8y ago
  So does Venmo, to get around it, you need to tell them your bank is not on the list and cofirm the old fasioned you mention.
• astura 8y ago
  Yep, Some banks do the same thing when you add an account for external transfer.