4 ms·
There's legitimately no alternative, "secure" way to access someone's banking data other than by asking for a username/password and then 'impersonating' them /
by fortytw2 7y ago
There's legitimately no alternative, "secure" way to access someone's banking data other than by asking for a username/password and then 'impersonating' them / asking for 2FA codes etc etc. As a commenter on the issue says, there is no oauth-esque mechanism implemented by banks.
I think plaid is the lesser evil when compared to rolling all of that on your own for N different banking institutions.
- ChrisSD 7y agoHave you read about https://www.openbanking.org.uk/ https://www.openbanking.org.uk/ The nine largest banks and building societies are required to participate. Many others do so voluntarily.
- weberc2 7y agoWhat percentage of the world's banks are covered? Or perhaps what percentage of the world's population banks in those covered institutions? Or perhaps what percentage of the total banked wealth (terminology?) is held in covered institutions?
- ChrisSD 7y agoOn an article titled "Plaid Launches in the UK" I would assume the most relevant territory is "the UK". But if instead the question is "what's the alternative" the answer is "government intervention" as shown by the UK.
- weberc2 7y agoIt depends on the audience. Many businesses don't want to restrict themselves exclusively to the subset of UK banks that follow that initiative. And government intervention is hardly a pragmatic solution (how many companies can afford to lobby every government in which they'd like to do business?).
- novok 7y agoIf I was plaid, I would use things like open banking if it's available, because it cost less to implement and maintain than the current html scraping norm we have now. I'm guessing plaid uses oauth & open banking when available, and falls back to scraping when it's not.
- anfractuosity 7y agoI think soon banks may be forced to provide an API - https://en.wikipedia.org/wiki/Open_banking https://en.wikipedia.org/wiki/Open_banking, not sure how long that'll take though.
- dbbk 7y agoThat’s ‘legitimately’ not true.
- jeandenis 7y agoNot sure why the downvotes. What he says is true in the US and in Europe Plaid is relying on psd2/open banking.
- Nursie 7y ago>> There's legitimately no alternative, "secure" way to access someone's banking data other than by asking for a username/password Not so true under Open Banking and other systems. Open Banking uses OAUTH2 style stuff, and a variety of certificate schemes (Open Banking's own, and EU ETSI qualified certificates) to allow participants to be delegated various forms of access and roles, in a much more granular way. >> As a commenter on the issue says, there is no oauth-esque mechanism implemented by banks. There is in the UK, and PSD2 solutions are rolling out all across the EU. Australia is also getting in on the action.
- fortytw2 7y agoThis is super cool! I was totally unaware of Open Banking.
- Eldt 7y agoI feel that until there is a secure way to do it, it shouldn't be done at all
- SpicyLemonZest 7y agoI generally feel that way too, but the US banking system just isn't built for it. It's hard to get too mad at Plaid for spoofing when my checking account's ID number is the only password required for authorizing electronic transfers.