6 ms·

Plaid co-founder William Hockey is leaving

50 points by theBashShell 7y ago

zaksoup 7y ago
Plaid's entire ideology has always seemed back-asswards to me. As far as I can tell it boils down to 1) Ask users for their plaintext login details to financial institutions 2) Store those details unhashed because they'll be used to authenticate directly with said institutions because they're not implementing some sort of reasonable Oauth flow 3) If users have 2fa enabled and the 3rd party doesn't allow app-specific passwords ask users to disable 2fa JUST so the user can use Plaid??? It seems like the product goes against every single good practice that websites have been trying to train into their users for years i.e. `Don't type your password for abc.com unless you literally see abc.com in the URL bar`. Not to mention they masquerade as an Oauth flow with plaid.js on sites that support it. Can somebody explain ANY way in which Plaid is a net good for users/security/etc??
- scrollaway 7y ago
  It's not a net good for security, it just gets things done and there's someone to blame if money gets stolen. How most of the world works. The fact plaid is needed is a gigantic hack and a disgrace but it's not like US banks are any good at APIs.
- nsx147 7y ago
  Maybe in the long run by pushing said institutions to adopt reasonable oauth flows
- jamiequint 7y ago
  Everything you described is fundamentally a problem with banks not with Plaid. Plaid solves the problem of people wanting to give third-parties access to their financial data. The fact that in some cases it's a kludge to work around this and not secure end-to-end (although I do think Plaid natively supports 2FA now, at least for some banks) is due to the banks not making this easy. At the end of the day people are going to get what they want, and many many many people prefer convenience (in this case, the ability to use third-party services like Truebill, Mint, etc etc) over perfect end-to-end security.
  - creeble 7y ago
    >> At the end of the day people are going to get what they want The end of _that_ day is when all of their credentials are leaked from a data compromise. I would agree that most people prefer convenience to security (and that they are two opposite points on the same line), but people only learn what security means when it's too late.
  - mbesto 7y ago
    > Everything you described is fundamentally a problem with banks not with Plaid. I don't disagree, but banking is not an arena where "creative disruption" that has harmful side effects should be welcomed. The reason you can't send money from one bank to another efficiently in the US but can in the UK is purely due to regulation. Or why there isn't an Open Banking Initiative in the US but there is in the UK. Once again, regulation. The private market isn't making the solution better in this case because their implementation is reckless and potentially harmful.
    - jamiequint 7y ago
      > The private market isn't making the solution better in this case because their implementation is reckless and potentially harmful. You could make this same argument about the existence of online banking. At some point utility supercedes risk. Personally, I feel fortunate to live in a society where I am able to make that decision for myself rather than the government making it for me.
      - mbesto 7y ago
        > You could make this same argument about the existence of online banking. How so? If I'm using Wells Fargo and I find out they have a breach, I can happily switch to another bank because they're clearly being incompetent. If a software provider that I'm using uses Plaid and Plaid gets hacked, then my banking data is potentially compromised. The bank has zero control over that, so there is no impetus for me to change banks, yet it's their data that has been compromised. > Personally, I feel fortunate to live in a society where I am able to make that decision for myself rather than the government making it for me. For most things, yes I agree. Do you think it's any coincidence that the banks haven't adopted modern/secure API access even though their consumers demand it? That's not the definition of a free market and is at odds with "having a free choice is better than having the government do it for me".
- matchagaucho 7y ago
  Consumers want an aggregate view of all their accounts. Many lenders also need an aggregate view of all assets. OFX (Open Financial eXchange) was designed in the late 90's to address this need. Many banks implemented OFX, but not all. Hence, we end up with screen scraping services like Yodlee and Plaid. (I don't know the specifics of Plaids infra. It's possible they store revocable oauth tokens instead of passwords)
basch 7y ago
What did Plaid do that Yodlee/Envestnet didnt? Was there some sort of collective amnesia, where everyone pretended this wasnt a solved problem, and to fund it being reinvented? What does Plaid do better? Is it just a more modern stable variant, or does the end user experience something more akin to "one plaid account for all my plaid connected services." Do I have to type my bank account number in twice if I sign up for two services that utilize plaid?
- parsnips 7y ago
  Plaid's execution is much better than yodlees. Dwolla isn't even in the same business as either.
  - basch 7y ago
    I guess Im wondering how it was pitched. Was it "yodlee but good" or "hey this new thing nobodys done before."
    - ralph84 7y ago
      "* but good" is the vast majority of successful tech companies. iPhone wasn't the first smartphone. Facebook wasn't the first social network. Google wasn't the first search engine. Etc.
    - GregorStocks 7y ago
      I would assume most of their early customers were not using Plaid exclusively, because they only supported a handful of very big banks. Every company that I've seen select Plaid as a vendor has either done so after considering many alternatives, or used Plaid data alongside data from other providers.
- mushufasa 7y ago
  I think the dynamics of account aggregation lend themselves to a duopoly, not a monopoly. Account aggregation is an incredibly difficult problem for any startup trying to do something with financial data. It's super hard to a) convince people to sync their accounts, b) get their data correctly, c) at unit economics low enough to enable a business, all while ensuring strong security. Any significant improvement in any one of those areas, and you have a compelling case to switch account aggregation provider contracts. Essentially, the problem is so hard that the quality of the solution really matters. While there are barriers to entry to supplying an account aggregation service (imagine building 15,000 web scrapers), there's a lot of demand for product improvement, which only happens when there's market competition.
paws 7y ago
If I understand right, using Plaid means giving bank account credentials to a 3rd party by design. Let's say, for sake of argument, one day a Plaid user logs on to their bank account and discovers missing funds. Does the bank get to say Plaid users automatically lost consumer protections under e.g. Reg E and similar by sharing account credentials? Not an expert but it seems to me the answer is probably yes.
- justaguyhere 7y ago
  Services like Plaid and Mint can only read data, isn't it? Has that changed?
  - root_axis 7y ago
    They have the capability to do whatever they please.
  - tehwebguy 7y ago
    I mean, not if you give them your username and password
    - rufugee 7y ago
      A relatively simple fix for this would be for banks to allow me to create a read-only user ID and a transactional user ID...I could hand the read-only credentials to services like Plaid. I suggested this to Fidelity over a year ago and they looked at me like I was crazy. Banking in the US is so horrible at the moment. there’s an immense opportunity for someone to come through and give a better consumer experience, but I fear the barriers to entry are far too high. I had high hopes for Simple.com, but they ended up destroying about every useful feature they had and falling way short of the mark...
      - clintonb 7y ago
        Simpler (for users) would be using OAuth 2.0 and APIs with proper permissions. Users shouldn't need two sets of credentials.
root_axis 7y ago
Plaid is a great product that can provide alternative paths to credit for people with poor credit scores, but the fact that they give developers access to all your banking activity for months after using it once is pretty scummy. The ethical thing to do would be to provide a one-time snapshot unless the user is made explicitly aware of and agrees to allow the developer to access their bank transactions whenever they like.
divyahansg 7y ago
Is changing my password the only way to disconnect Plaid's access to my bank account?
- pingpongchef 7y ago
  I don't think it's the only way, but it is one way to do it with certainty.
mars4rp 7y ago
I was trying to get a mortgage and the agent made me download their app and fill it there. I had to put my bank username and pass in the app. I thought it is Auth2 and I am putting those credentials in the bank website. Now I am wondering could it been Plaid? I read that they are mimicking bank's page design. there was no URL in the app to verify where I am putting my credential in. now that I am thinking about it, it was super stupid of me.
- Waterluvian 7y ago
  A mortgage broker should have a fiduciary duty and part of that should make it criminal to lead you down a dark hallway like that. I recently dealt with one and it was so refreshing to have someone who consciously knew their job was to be my guide and educator through the process.
- ilikehurdles 7y ago
  I bought a home last year and had to do none of that, although I will say I had to share some PII (SSN in particular) through email. They claimed that email was “SECURE” several times, but without an explanation of what security measures they take and given that I used my normal mail client to send an unencrypted message, I’m assuming my data is just sitting around undeleted on someone’s mailbox.
wexxx 7y ago
This is William’s post. It’s worth going to the source. https://medium.com/@williamhockey/transitions-8e0ed5257ac2 https://medium.com/@williamhockey/transitions-8e0ed5257ac2
- dang 7y ago
  Ok, we'll change to that from https://techcrunch.com/2019/06/18/fresh-off-a-2-65b-valuation-plaid-co-founder-william-hockey-is-leaving https://techcrunch.com/2019/06/18/fresh-off-a-2-65b-valuatio.... Thanks!
bcp2384 7y ago
The fact they haven't even provided a very simple admin panel for end users to revoke access is all you need to know about this company's ethics.
- mifreewil 7y ago
  FWIW, I'm very familiar with Plaid as I've worked in several FinTech startups using Plaid for various reasons. If you simply want to revoke Plaid's access all you need to do is change your bank password. Of course, all past data will live on in Plaid. If you're a EU user, you can request to have your data removed. Curious what their response might be if you're not in the EU. Hate to be cynical, but I bet they'll ignore you as is all too common for customer service these days.

50 points by theBashShell 7y ago

Plaid's entire ideology has always seemed back-asswards to me. As far as I can tell it boils down to 1) Ask users for their plaintext login details to financial institutions 2) Store those details unhashed because they'll be used to authenticate directly with said institutions because they're not implementing some sort of reasonable Oauth flow 3) If users have 2fa enabled and the 3rd party doesn't allow app-specific passwords ask users to disable 2fa JUST so the user can use Plaid??? It seems like the product goes against every single good practice that websites have been trying to train into their users for years i.e. `Don't type your password for abc.com unless you literally see abc.com in the URL bar`. Not to mention they masquerade as an Oauth flow with plaid.js on sites that support it. Can somebody explain ANY way in which Plaid is a net good for users/security/etc??

scrollaway 7y ago
It's not a net good for security, it just gets things done and there's someone to blame if money gets stolen. How most of the world works. The fact plaid is needed is a gigantic hack and a disgrace but it's not like US banks are any good at APIs.
nsx147 7y ago
Maybe in the long run by pushing said institutions to adopt reasonable oauth flows
jamiequint 7y ago
Everything you described is fundamentally a problem with banks not with Plaid. Plaid solves the problem of people wanting to give third-parties access to their financial data. The fact that in some cases it's a kludge to work around this and not secure end-to-end (although I do think Plaid natively supports 2FA now, at least for some banks) is due to the banks not making this easy. At the end of the day people are going to get what they want, and many many many people prefer convenience (in this case, the ability to use third-party services like Truebill, Mint, etc etc) over perfect end-to-end security.
- creeble 7y ago
  >> At the end of the day people are going to get what they want The end of _that_ day is when all of their credentials are leaked from a data compromise. I would agree that most people prefer convenience to security (and that they are two opposite points on the same line), but people only learn what security means when it's too late.
- mbesto 7y ago
  > Everything you described is fundamentally a problem with banks not with Plaid. I don't disagree, but banking is not an arena where "creative disruption" that has harmful side effects should be welcomed. The reason you can't send money from one bank to another efficiently in the US but can in the UK is purely due to regulation. Or why there isn't an Open Banking Initiative in the US but there is in the UK. Once again, regulation. The private market isn't making the solution better in this case because their implementation is reckless and potentially harmful.
  - jamiequint 7y ago
    > The private market isn't making the solution better in this case because their implementation is reckless and potentially harmful. You could make this same argument about the existence of online banking. At some point utility supercedes risk. Personally, I feel fortunate to live in a society where I am able to make that decision for myself rather than the government making it for me.
    - mbesto 7y ago
      > You could make this same argument about the existence of online banking. How so? If I'm using Wells Fargo and I find out they have a breach, I can happily switch to another bank because they're clearly being incompetent. If a software provider that I'm using uses Plaid and Plaid gets hacked, then my banking data is potentially compromised. The bank has zero control over that, so there is no impetus for me to change banks, yet it's their data that has been compromised. > Personally, I feel fortunate to live in a society where I am able to make that decision for myself rather than the government making it for me. For most things, yes I agree. Do you think it's any coincidence that the banks haven't adopted modern/secure API access even though their consumers demand it? That's not the definition of a free market and is at odds with "having a free choice is better than having the government do it for me".
matchagaucho 7y ago
Consumers want an aggregate view of all their accounts. Many lenders also need an aggregate view of all assets. OFX (Open Financial eXchange) was designed in the late 90's to address this need. Many banks implemented OFX, but not all. Hence, we end up with screen scraping services like Yodlee and Plaid. (I don't know the specifics of Plaids infra. It's possible they store revocable oauth tokens instead of passwords)

basch 7y ago

What did Plaid do that Yodlee/Envestnet didnt? Was there some sort of collective amnesia, where everyone pretended this wasnt a solved problem, and to fund it being reinvented? What does Plaid do better? Is it just a more modern stable variant, or does the end user experience something more akin to "one plaid account for all my plaid connected services." Do I have to type my bank account number in twice if I sign up for two services that utilize plaid?

parsnips 7y ago
Plaid's execution is much better than yodlees. Dwolla isn't even in the same business as either.
- basch 7y ago
  I guess Im wondering how it was pitched. Was it "yodlee but good" or "hey this new thing nobodys done before."
  - ralph84 7y ago
    "* but good" is the vast majority of successful tech companies. iPhone wasn't the first smartphone. Facebook wasn't the first social network. Google wasn't the first search engine. Etc.
  - GregorStocks 7y ago
    I would assume most of their early customers were not using Plaid exclusively, because they only supported a handful of very big banks. Every company that I've seen select Plaid as a vendor has either done so after considering many alternatives, or used Plaid data alongside data from other providers.
mushufasa 7y ago
I think the dynamics of account aggregation lend themselves to a duopoly, not a monopoly. Account aggregation is an incredibly difficult problem for any startup trying to do something with financial data. It's super hard to a) convince people to sync their accounts, b) get their data correctly, c) at unit economics low enough to enable a business, all while ensuring strong security. Any significant improvement in any one of those areas, and you have a compelling case to switch account aggregation provider contracts. Essentially, the problem is so hard that the quality of the solution really matters. While there are barriers to entry to supplying an account aggregation service (imagine building 15,000 web scrapers), there's a lot of demand for product improvement, which only happens when there's market competition.

paws 7y ago

If I understand right, using Plaid means giving bank account credentials to a 3rd party by design. Let's say, for sake of argument, one day a Plaid user logs on to their bank account and discovers missing funds. Does the bank get to say Plaid users automatically lost consumer protections under e.g. Reg E and similar by sharing account credentials? Not an expert but it seems to me the answer is probably yes.

justaguyhere 7y ago
Services like Plaid and Mint can only read data, isn't it? Has that changed?
- root_axis 7y ago
  They have the capability to do whatever they please.
- tehwebguy 7y ago
  I mean, not if you give them your username and password
  - rufugee 7y ago
    A relatively simple fix for this would be for banks to allow me to create a read-only user ID and a transactional user ID...I could hand the read-only credentials to services like Plaid. I suggested this to Fidelity over a year ago and they looked at me like I was crazy. Banking in the US is so horrible at the moment. there’s an immense opportunity for someone to come through and give a better consumer experience, but I fear the barriers to entry are far too high. I had high hopes for Simple.com, but they ended up destroying about every useful feature they had and falling way short of the mark...
    - clintonb 7y ago
      Simpler (for users) would be using OAuth 2.0 and APIs with proper permissions. Users shouldn't need two sets of credentials.

root_axis 7y ago

Plaid is a great product that can provide alternative paths to credit for people with poor credit scores, but the fact that they give developers access to all your banking activity for months after using it once is pretty scummy. The ethical thing to do would be to provide a one-time snapshot unless the user is made explicitly aware of and agrees to allow the developer to access their bank transactions whenever they like.

divyahansg 7y ago

Is changing my password the only way to disconnect Plaid's access to my bank account?

pingpongchef 7y ago
I don't think it's the only way, but it is one way to do it with certainty.

mars4rp 7y ago

I was trying to get a mortgage and the agent made me download their app and fill it there. I had to put my bank username and pass in the app. I thought it is Auth2 and I am putting those credentials in the bank website. Now I am wondering could it been Plaid? I read that they are mimicking bank's page design. there was no URL in the app to verify where I am putting my credential in. now that I am thinking about it, it was super stupid of me.

Waterluvian 7y ago
A mortgage broker should have a fiduciary duty and part of that should make it criminal to lead you down a dark hallway like that. I recently dealt with one and it was so refreshing to have someone who consciously knew their job was to be my guide and educator through the process.
ilikehurdles 7y ago
I bought a home last year and had to do none of that, although I will say I had to share some PII (SSN in particular) through email. They claimed that email was “SECURE” several times, but without an explanation of what security measures they take and given that I used my normal mail client to send an unencrypted message, I’m assuming my data is just sitting around undeleted on someone’s mailbox.

wexxx 7y ago

This is William’s post. It’s worth going to the source. https://medium.com/@williamhockey/transitions-8e0ed5257ac2 https://medium.com/@williamhockey/transitions-8e0ed5257ac2

dang 7y ago
Ok, we'll change to that from https://techcrunch.com/2019/06/18/fresh-off-a-2-65b-valuation-plaid-co-founder-william-hockey-is-leaving https://techcrunch.com/2019/06/18/fresh-off-a-2-65b-valuatio.... Thanks!

bcp2384 7y ago

The fact they haven't even provided a very simple admin panel for end users to revoke access is all you need to know about this company's ethics.

mifreewil 7y ago
FWIW, I'm very familiar with Plaid as I've worked in several FinTech startups using Plaid for various reasons. If you simply want to revoke Plaid's access all you need to do is change your bank password. Of course, all past data will live on in Plaid. If you're a EU user, you can request to have your data removed. Curious what their response might be if you're not in the EU. Hate to be cynical, but I bet they'll ignore you as is all too common for customer service these days.