5 ms·

It's encouraging to see Plaid making this level of effort to be accurate. It seems like it could be a viable alternative to Mint using something like https://gi

by jaden 7y ago

It's encouraging to see Plaid making this level of effort to be accurate. It seems like it could be a viable alternative to Mint using something like https://github.com/yyx990803/build-your-own-mint https://github.com/yyx990803/build-your-own-mint (written by the author of Vue.js). It's scary to think what would happen if one of these services (Mint, Personal Capital, Plaid) had a backend data breach. If they can log in to your financial sites, a breach would mean the attacker would be able to as well.

ceejayoz 7y ago
> If they can log in to your financial sites, a breach would mean the attacker would be able to as well. As an added bonus, banks may disclaim liability because you shared your credentials with a third party.
- jaden 7y ago
  That's a good (although bad for the consumer) point. Are you aware of any examples of this happening?
  - sdoering 7y ago
    Reading my terms of service I can see my bank explicitly having forbidden the sharing of credentials. Not sure if there ever was a case they used this clause, though.
temp129038 7y ago
Isn't it more scary to think how many people are so cavalier with sharing their online banking credentials with a third-party app like Plaid? I don't think enough people realize that when you authenticate with Plaid, even for apps that don't provide "Mint-like" functionality and have no need for your transaction history, you're giving that developer permission to pull your transaction history, personal information, account balance, etc without any additional permission at anytime.
- ceejayoz 7y ago
  "I was surprised the app I gave my banking credentials could read my transactions" seems like a weird complaint, considering there's not that much else legitimate you can do with them. I have concerns about Plaid/Mint/etc. being breached. Less so about the access they have.
  - temp129038 7y ago
    It's not a weird complaint at all when it's being presented purely as a tool to facilitate money transfer in/out of your bank account.
    - ceejayoz 7y ago
      If I'm trusting an app to literally take my money, them having access to transaction data should hardly be shocking.
      - temp129038 7y ago
        You're giving Plaid and your average user way too much credit. If the inherit trust is so obvious, then why would Plaid not include a very common step in authentication flows like FB and Google to explicitly tell users what they are agreeing to share with XYZ developer before submitting their credentials (which may be just a bank account number, but might also be transaction history, personal information, account balance, etc.)? They've purposefully omitted this step because conversion would almost certainly tank.
        jaymmartin 7y ago
        I've been playing around with Plaid the past few days and they very clearly list the permissions during authentication: https://i.imgur.com/xNPTIzy.png https://i.imgur.com/xNPTIzy.png They even link to a dashboard that displays all the information you are sharing with developers: https://my-sandbox.plaid.com/account https://my-sandbox.plaid.com/account That said, I agree that the average user won't realize the implications. Additionally, revocation/deletion of the data requires emailing them.

by jaden 7y ago

ceejayoz 7y ago

> If they can log in to your financial sites, a breach would mean the attacker would be able to as well. As an added bonus, banks may disclaim liability because you shared your credentials with a third party.

jaden 7y ago
That's a good (although bad for the consumer) point. Are you aware of any examples of this happening?
- sdoering 7y ago
  Reading my terms of service I can see my bank explicitly having forbidden the sharing of credentials. Not sure if there ever was a case they used this clause, though.

temp129038 7y ago

Isn't it more scary to think how many people are so cavalier with sharing their online banking credentials with a third-party app like Plaid? I don't think enough people realize that when you authenticate with Plaid, even for apps that don't provide "Mint-like" functionality and have no need for your transaction history, you're giving that developer permission to pull your transaction history, personal information, account balance, etc without any additional permission at anytime.

ceejayoz 7y ago
"I was surprised the app I gave my banking credentials could read my transactions" seems like a weird complaint, considering there's not that much else legitimate you can do with them. I have concerns about Plaid/Mint/etc. being breached. Less so about the access they have.
- temp129038 7y ago
  It's not a weird complaint at all when it's being presented purely as a tool to facilitate money transfer in/out of your bank account.
  - ceejayoz 7y ago
    If I'm trusting an app to literally take my money, them having access to transaction data should hardly be shocking.
    - temp129038 7y ago
      You're giving Plaid and your average user way too much credit. If the inherit trust is so obvious, then why would Plaid not include a very common step in authentication flows like FB and Google to explicitly tell users what they are agreeing to share with XYZ developer before submitting their credentials (which may be just a bank account number, but might also be transaction history, personal information, account balance, etc.)? They've purposefully omitted this step because conversion would almost certainly tank.
      - jaymmartin 7y ago
        I've been playing around with Plaid the past few days and they very clearly list the permissions during authentication: https://i.imgur.com/xNPTIzy.png https://i.imgur.com/xNPTIzy.png They even link to a dashboard that displays all the information you are sharing with developers: https://my-sandbox.plaid.com/account https://my-sandbox.plaid.com/account That said, I agree that the average user won't realize the implications. Additionally, revocation/deletion of the data requires emailing them.