5 ms·

>Plaid must be something special. It's not so much that Plaid is "something special" but that US banks are stuck in the 1950's technologically. Plaid shouldn'

>Plaid must be something special. It's not so much that Plaid is "something special" but that US banks are stuck in the 1950's technologically. Plaid shouldn't exist. It only exists because banks refuse to create open APIs for others to integrate with. With that said, Plaid has done a fantastic job.

rizpanjwani 6y ago
Never used Plaid but didn't they require your banking credentials and also didn't have a very secure mechanism for storing them?
- jerry80 6y ago
  Yes. Plaid can be used to verify banking details (many stock brokers use it for this, for example). Plaid works by asking the user to give their banking username and password to Plaid, and then their two factor authentication token too. Plaid logs into their account behind the scenes to verify ownership. Plaid claims to not store this info, and I assume that they don't, but it still seems like one of the biggest security anti-patterns ever. If nothing else, it's training users to ignore the "don't share your password" warnings. Do we really want users trained to be more susceptible to phishing?
  - rizpanjwani 6y ago
    Yeah in the last decade, I have many times considered building a service that would have a better interface and access to information by fetching it from all my financial institutions, but what's held me back is the lack of APIs and I never even considered collecting user credentials as a viable option because of the potential security nightmare and possible libabilities. I guess it pays to be ignorant of all that and just plow ahead. Once you get billions in VC funding, you can fend off any consequences.
  - dexterous 6y ago
    > Plaid claims to not store this info, and I assume that they don't Think of it as Plaid storing OAuth2 access tokens, sort of; and the tokens do expire (over pretty long periods), though, some bank integrations do allow them to generate their equivalent of refresh tokens. Plaid didn't go into this blind; they know the tightrope they're walking. As someone who's worked with Plaid to build an integration into our product, I'd say they're definitely in a very gray area, but that's pretty much all of the Fintech space right now. Although, I'd also say they're not malicious; even if it is just motivated by the fear of the bad press resulting in a customer exodus.
ceejayoz 6y ago
> It only exists because banks refuse to create open APIs for others to integrate with. Mostly true, but both Capital One and Citibank have OAuth APIs. It's lovely.
vageli 6y ago
Mercury bank seems to be a standout in this regard, promoting themselves as a "full stack" bank.
pg_bot 6y ago
This seems to be changing. Nacha (the organization that governs ACH) has been developing open APIs so that more organizations can get access to the ACH network without any dirty hacks. I would expect to see a rise in the number of personal finance applications over the next few years due to this fact. https://www.nacha.org/content/available-apis https://www.nacha.org/content/available-apis https://www.nacha.org/content/phixius https://www.nacha.org/content/phixius
- tadfisher 6y ago
  The problem is that Nacha is building these APIs on top of ACH. There needs to be a universal realtime payment and account-validation network, not a file FTP'd to the Fed that's sent out three times a day.
  - pg_bot 6y ago
    Take a look at FedNow which is aiming to offer a 24/7/365 instant payment service for all US banks by 2023-24. (I would realistically expect 2028-30 for it to go online) This is being worked on, but everything moves at a glacial pace.
    - pjg 6y ago
      FedNow is a while away. RTP (Real-time payments) from the The Clearing House is already doing it. They have appx half the DDAs (bank accounts) in the US covered. Another year or two they will have 80-90% Also Push to Card and VISA/MC Debit are real-time payment systems i.e. 7x24x365 where you can pull or push money to the bank account linked to the VISA/MC branded ATM card Bottom line: Fednow may be too little too late

rizpanjwani 6y ago

Never used Plaid but didn't they require your banking credentials and also didn't have a very secure mechanism for storing them?

jerry80 6y ago
Yes. Plaid can be used to verify banking details (many stock brokers use it for this, for example). Plaid works by asking the user to give their banking username and password to Plaid, and then their two factor authentication token too. Plaid logs into their account behind the scenes to verify ownership. Plaid claims to not store this info, and I assume that they don't, but it still seems like one of the biggest security anti-patterns ever. If nothing else, it's training users to ignore the "don't share your password" warnings. Do we really want users trained to be more susceptible to phishing?
- rizpanjwani 6y ago
  Yeah in the last decade, I have many times considered building a service that would have a better interface and access to information by fetching it from all my financial institutions, but what's held me back is the lack of APIs and I never even considered collecting user credentials as a viable option because of the potential security nightmare and possible libabilities. I guess it pays to be ignorant of all that and just plow ahead. Once you get billions in VC funding, you can fend off any consequences.
- dexterous 6y ago
  > Plaid claims to not store this info, and I assume that they don't Think of it as Plaid storing OAuth2 access tokens, sort of; and the tokens do expire (over pretty long periods), though, some bank integrations do allow them to generate their equivalent of refresh tokens. Plaid didn't go into this blind; they know the tightrope they're walking. As someone who's worked with Plaid to build an integration into our product, I'd say they're definitely in a very gray area, but that's pretty much all of the Fintech space right now. Although, I'd also say they're not malicious; even if it is just motivated by the fear of the bad press resulting in a customer exodus.

ceejayoz 6y ago

> It only exists because banks refuse to create open APIs for others to integrate with. Mostly true, but both Capital One and Citibank have OAuth APIs. It's lovely.

vageli 6y ago

Mercury bank seems to be a standout in this regard, promoting themselves as a "full stack" bank.

pg_bot 6y ago

This seems to be changing. Nacha (the organization that governs ACH) has been developing open APIs so that more organizations can get access to the ACH network without any dirty hacks. I would expect to see a rise in the number of personal finance applications over the next few years due to this fact. https://www.nacha.org/content/available-apis https://www.nacha.org/content/available-apis https://www.nacha.org/content/phixius https://www.nacha.org/content/phixius

tadfisher 6y ago
The problem is that Nacha is building these APIs on top of ACH. There needs to be a universal realtime payment and account-validation network, not a file FTP'd to the Fed that's sent out three times a day.
- pg_bot 6y ago
  Take a look at FedNow which is aiming to offer a 24/7/365 instant payment service for all US banks by 2023-24. (I would realistically expect 2028-30 for it to go online) This is being worked on, but everything moves at a glacial pace.
  - pjg 6y ago
    FedNow is a while away. RTP (Real-time payments) from the The Clearing House is already doing it. They have appx half the DDAs (bank accounts) in the US covered. Another year or two they will have 80-90% Also Push to Card and VISA/MC Debit are real-time payment systems i.e. 7x24x365 where you can pull or push money to the bank account linked to the VISA/MC branded ATM card Bottom line: Fednow may be too little too late