6 ms·
If you aren't comfortable with that you better not use any fintech apps like Cash App, Venmo, Wealthfront, Robinhood, any Intuit products, etc. These services u
by qafy 7y ago
If you aren't comfortable with that you better not use any fintech apps like Cash App, Venmo, Wealthfront, Robinhood, any Intuit products, etc. These services use Plaid (like this app does) or similar APIs like Quovo, Yodlee, etc. Even financial institutions themselves like Citi Bank, American Express, Chime, PayPal, etc use these APIs to link your accounts.
And to be clear, the app itself never has access to your credentials. This all happens in an iframe that tokenizes your credentials.
- aschatten 7y agoOut of the app you mentioned only Intuit products, TurboTax specifically asks for bank account password. The rest just use account number is ACH for verification.
- plorkyeran 7y agoI in fact don't use any of those apps, partially because of that.
- Animats 7y agoI don't, either. Bank bill pay handles most outgoing payments, and that comes with good guarantees. Everything else is on a credit card. I can get data out of the bank in spreadsheet format if it needs to go into some analysis program. Everything is online, but doesn't involve flaky third parties.
- clairity 7y agoyes, financial apps need to be locally-installed and under your control (preferably open-sourced), for both security and privacy.
- InafuSabi 7y agoCorrect move. Only you know your bankpass, even the machine generating it `forgets` after the printout
- jwr 7y agoWell of course I won't use anything like that! I find it mind-boggling that people even consider giving a third party their bank account login+password. It's like saying "yes, I want to be robbed of all my money, please take these credentials and spread them forth to whichever leaked data pile they might end up in". My bank considers transactions done using login credentials to be final. There is no recourse if someone steals your money. Last year an iOS mail application called "Spark" (otherwise a great app) decided to quietly upload my login and password to their cloud servers so that their servers can access my mail for me. I dropped the app immediately (https://jan.rychter.com/enblog/spark-email-app-why-i-dont-use-it-anymore-2018-07-20 https://jan.rychter.com/enblog/spark-email-app-why-i-dont-us...). This should not be considered acceptable. If you want to let users authorize external access to account data, use Oauth2.
- BrandoElFollito 7y agoYou can transfer money in your bank without a second factor check? (an SMS with a code for instance?) An my accounts do that by default (France), except for pre-approved recipients.
- tekknik 7y agoPlaid doesn’t let you transfer any money through their API, just read data. If Plaid gets compromised and your username and pass get leaked and used then most (all?) will detect the location change and confirm via SMS.
- rrix2 7y agoWhich bank implements OAuth?
- dingwallr 7y agoMonzo bank in the UK uses OAuth 2.0 for its API: https://docs.monzo.com/#authentication https://docs.monzo.com/#authentication (disclaimer: I work here)
- slartibardfast0 7y agoEvery bank in the EU will have to have it or near equivalent very soon under the EU’s Payment Services Directive 2 which mandates API based access to accounts. Sandboxes are already available under reasonable terms for many banks in for example Ireland. *edit, first word
- Izkata 7y agoWealthfront at least lets you select "my bank isn't in this list" (even if it is) and then you get the UI to enter your routing and account numbers. So no, it doesn't require your bank's user/pass. I don't know why it isn't well-advertised, I wouldn't use it otherwise.
- trillcyborg 7y agoThe project uses plaid. The pass is entered into plaid widget and never sent to me. I only get a key for reading user data through plaid. Payments are done by adding Dwolla to plaid. Also pretty secure and what i believe venmo uses
- webninja 7y ago1) Robinhood only has my routing number and account number. 2) The Cash app only has my routing number and account number. 3) PayPal only has my routing number and account number. 4) My credit card only has my bank’s routing and account number. Despite these restrictions, the world keeps on spinning round and round.
- jeremija 7y agoI don't understand why TransferWise requires me to enter my bank username and password to verify my account. I believe it also uses Plaid behind the scenes, but I used to be able to select "other" bank and enter my routing and account number manually. But as soon as I do that it recognizes my bank and switches to the login screen and I have to abort because I don't want to give it to them. I contacted support and they were not helpful at all.
- UweSchmidt 7y agoYou list an amazing number of apps and services, but that doesn't seem to reassure me of the idea of giving up your credentials. That's way too much enthusiasm for the new and shiny app, way too little awareness that in this world people are out to get what's yours, way too little concern for questionable security at every single layer of computing, way too much trust in the banking system, way too careless about the information about you that you give to strangers. Not something that people I know who are good with money would do.
- deleted 7y ago[deleted]
- naner 7y agoYep this behavior has been normalized by our industry, much to the embarrassment of everyone involved. Move fast and break (other people's) things?