5 ms·

The way Plaid works, I'm surprised that they hadn't already been shut down for breaking banks' TOS. It exposes the banks to so much liability for a product that

by zelly 7y ago

The way Plaid works, I'm surprised that they hadn't already been shut down for breaking banks' TOS. It exposes the banks to so much liability for a product that's not even theirs.

nikolay 7y ago
Worst is their suggestions to disable 2FA! I twitted to them about it, and they seem to have removed it after that!
- orthecreedence 7y ago
  Wells Fargo's 2FA uses SMS. Hardly worth enabling.
  - josh2600 7y ago
    I don’t know why you’re being downvoted. Sms 2FA is not safe, full stop.
    - ericleung 7y ago
      Sure, SMS-based 2FA is not nearly as secure as other forms of 2FA. But unless you're targeted, SMS-based 2FA still helps add a layer of security against other issues like password re-use. Of course none of us do that either, but for the general public, I'd rather support SMS-based 2FA across the board than nothing at all.
    - blackearl 7y ago
      For the average Joe it's good enough, no one is SIM swapping Bob who works at Walmart
  - nikolay 7y ago
    That's default, but you can buy an RSA hardware token.
    - pintxo 7y ago
      Like this one [1]? Seems that it is not necessarily better than SMS. [1] https://news.ycombinator.com/item?id=4156897 https://news.ycombinator.com/item?id=4156897
      - freeone3000 7y ago
        There is an actual, material difference between having no 2FA (guess passwords until you get in), SMS 2FA (have a human person call a phone provider and have the number switched), and token 2FA (given the physical device and a few hundred attempts, you're able to make another device that also authenticates). Saying you might as well not enable 2FA because a token cloning attack exists is ridiculous.
        projektfu 7y ago
        And it's not even an attack on the OTP token.
ztratar 7y ago
Some banks have tried, but Plaid has a great legal team and has argued with the move towards open banking in the EU that customers have a right to their data. Will be interesting to see where this goes.
- girvo 7y ago
  I’m excited to see Australian pushing through open banking APIs, reusing most of the UK/EU spec... but the implementation keeps getting pushed back and back and back. Mid 2020 now for initial roll out it sounds like... so for now I’ll stick with Basiq [0] as it’s Australian focused and free for my particular use case at least. Unless others have some other suggestions? I need to connect to ING Direct [0] https://basiq.io https://basiq.io
Nextgrid 7y ago
I dislike Plaid & similar systems but I disagree. Enforcing stupid & unreasonable ToS in court is a slippery slope that can be used against users. You want to use an alternative client to export your data because the official client doesn't allow it? ToS violation and the developer of the alternative client gets sued. Want to screen-scrape some website to automate some tedious manual behaviour? ToS violation and you get sued. Etc. The ability to delegate some manual process (logging into online banking and getting the data) to a third-party (like Plaid) should be a right that we should defend.
- bagacrap 7y ago
  Most manual processes, I agree, automate away. But not the ones that have negative implications for security. I don't care whether it's the TOS or some other means that's used to prevent pw sharing, but it should be prevented. It is the bank's duty to protect its users, not to tolerate services that actively discourage safe practices like 2fa.
  - moviuro 7y ago
    In the EU, we're getting DSP2 [0] which requires banks to publish usable APIs to: get account information, and initiate money transfers. That's huge, though only at a baby stage for the moment. [0] https://ec.europa.eu/commission/presscorner/detail/en/IP_15_5792 https://ec.europa.eu/commission/presscorner/detail/en/IP_15_...
    - Nextgrid 7y ago
      This is a sham. You need to go through a certification process which costs $$$ before you can get access to those APIs even if the banking data is processed locally, which will only empower the incumbents while locking out open-source solutions and indie developers (remember that a lot of tools & products we use started as someone's side-project; this regulation locks those out by default). At least with credential sharing & screen-scraping nobody can lock you out. Does it suck? Yeah. But I'd rather take a solution that sucks than no solution at all.
- 7y ago

by zelly 7y ago

The way Plaid works, I'm surprised that they hadn't already been shut down for breaking banks' TOS. It exposes the banks to so much liability for a product that's not even theirs.

nikolay 7y ago

Worst is their suggestions to disable 2FA! I twitted to them about it, and they seem to have removed it after that!

orthecreedence 7y ago
Wells Fargo's 2FA uses SMS. Hardly worth enabling.
- josh2600 7y ago
  I don’t know why you’re being downvoted. Sms 2FA is not safe, full stop.
  - ericleung 7y ago
    Sure, SMS-based 2FA is not nearly as secure as other forms of 2FA. But unless you're targeted, SMS-based 2FA still helps add a layer of security against other issues like password re-use. Of course none of us do that either, but for the general public, I'd rather support SMS-based 2FA across the board than nothing at all.
  - blackearl 7y ago
    For the average Joe it's good enough, no one is SIM swapping Bob who works at Walmart
- nikolay 7y ago
  That's default, but you can buy an RSA hardware token.
  - pintxo 7y ago
    Like this one [1]? Seems that it is not necessarily better than SMS. [1] https://news.ycombinator.com/item?id=4156897 https://news.ycombinator.com/item?id=4156897
    - freeone3000 7y ago
      There is an actual, material difference between having no 2FA (guess passwords until you get in), SMS 2FA (have a human person call a phone provider and have the number switched), and token 2FA (given the physical device and a few hundred attempts, you're able to make another device that also authenticates). Saying you might as well not enable 2FA because a token cloning attack exists is ridiculous.
      - projektfu 7y ago
        And it's not even an attack on the OTP token.

ztratar 7y ago

Some banks have tried, but Plaid has a great legal team and has argued with the move towards open banking in the EU that customers have a right to their data. Will be interesting to see where this goes.

girvo 7y ago
I’m excited to see Australian pushing through open banking APIs, reusing most of the UK/EU spec... but the implementation keeps getting pushed back and back and back. Mid 2020 now for initial roll out it sounds like... so for now I’ll stick with Basiq [0] as it’s Australian focused and free for my particular use case at least. Unless others have some other suggestions? I need to connect to ING Direct [0] https://basiq.io https://basiq.io

Nextgrid 7y ago

I dislike Plaid & similar systems but I disagree. Enforcing stupid & unreasonable ToS in court is a slippery slope that can be used against users. You want to use an alternative client to export your data because the official client doesn't allow it? ToS violation and the developer of the alternative client gets sued. Want to screen-scrape some website to automate some tedious manual behaviour? ToS violation and you get sued. Etc. The ability to delegate some manual process (logging into online banking and getting the data) to a third-party (like Plaid) should be a right that we should defend.

bagacrap 7y ago
Most manual processes, I agree, automate away. But not the ones that have negative implications for security. I don't care whether it's the TOS or some other means that's used to prevent pw sharing, but it should be prevented. It is the bank's duty to protect its users, not to tolerate services that actively discourage safe practices like 2fa.
- moviuro 7y ago
  In the EU, we're getting DSP2 [0] which requires banks to publish usable APIs to: get account information, and initiate money transfers. That's huge, though only at a baby stage for the moment. [0] https://ec.europa.eu/commission/presscorner/detail/en/IP_15_5792 https://ec.europa.eu/commission/presscorner/detail/en/IP_15_...
  - Nextgrid 7y ago
    This is a sham. You need to go through a certification process which costs $$$ before you can get access to those APIs even if the banking data is processed locally, which will only empower the incumbents while locking out open-source solutions and indie developers (remember that a lot of tools & products we use started as someone's side-project; this regulation locks those out by default). At least with credential sharing & screen-scraping nobody can lock you out. Does it suck? Yeah. But I'd rather take a solution that sucks than no solution at all.
7y ago