13 ms·

I’ve some friends that works there, so I’m hesitant to say this, because I’m sorry for them, but Plaid is a terrible company. Their main product scrapes financi

I’ve some friends that works there, so I’m hesitant to say this, because I’m sorry for them, but Plaid is a terrible company. Their main product scrapes financial data from unsuspecting users that simply think they’re making a bank transfer and not signing away the privacy and security of their banking, 401k and trading information. https://twitter.com/seanieb/status/1298871471645761537?s=20 https://twitter.com/seanieb/status/1298871471645761537?s=20

xvector 6y ago
I can't wait until we have smart contracts on a privacy coin that let me invest and grow my wealth anonymously.
- hahaxdxd123 6y ago
  Anonymously is unlikely - how would the government get their taxes?
  - xvector 6y ago
    Even if the government bans XMR from exchanges, BTC to XMR atomic swaps are coming. You can then 1. Use XMR as an anonymizing bridge to pseudonymous ETH or ADA wallets 2. Grow wealth with ETH or ADA smart contracts/decentralized finance 3. When you want to spend, transfer funds from your ETH/ADA wallets over the XMR bridge to newly generated spend wallets. (There's potential for a chain-analysis correlation attack at this point if you aren't careful with how you are withdrawing.) --- Really, it's all a nightmare and very difficult to do it now, but I'll be damned if someone doesn't develop an app or program that does this all seamlessly in a few years.
  - cblconfederate 6y ago
    what if tax is part of the smart contract?
    - tyre 6y ago
      then it would have to know who it is taxing? The same applies. No, you cannot anonymously tax every transaction at some rate. Tax rates don't work that way, in a vacuum.
      - cblconfederate 6y ago
        why not. it's how sales tax works
smnrchrds 6y ago
They are getting sued by TD Bank for this very reason: > The bank said in the court filings that the interface "dupes" consumers into believing they are entering personal information into TD Bank's trusted platform. > "In reality, however, consumers are unwittingly giving their login credentials to the defendant, who takes the information, stores it on its servers, and uses it to mine consumers' bank records for valuable data (e.g., transaction histories, loans, etc.), which the defendant monetizes by selling to third parties," TD claimed in the court records. https://www.ctvnews.ca/business/td-bank-files-lawsuit-against-plaid-accusing-it-of-trying-to-dupe-consumers-1.5145326 https://www.ctvnews.ca/business/td-bank-files-lawsuit-agains... Also, giving your credentials to any third party, including Plaid, voids the warranty at many financial institutions. If your account gets hacked and your money stolen, you may find out that the zero liability policy no longer applies to you.
- xtracto 6y ago
  That´s interesting, and it is an important "stick". On the other side, I know some banks are giving a "carrot" to these types of companies by providing a "portal access" that allows these companies to connect their customers with their bank accounts so that the customer can select what to share with these sites. Of course, once those portals are enabled we enter the Facebook game: Where a lot of customers will blindly give all access to Plaid like companies, and then consumer group advocates will criticize for the amount of information that they are (still) mining from ignoring customers.
  - morpheuskafka 6y ago
    I think BofA does this, which I like. When I linked my account to Robinhood through Plaid, it asked for 2FA (text or phone call, BofA doesn't support TOTP codes) and verified in, then asked me to select which accounts to grant access to. Since it doesn't need the 2FA subsequently, it must be doing some kind of OAuth style authentication when it passes that token to the bank and then gets a long-term access token for that specific account. From an HTTPS perspective this is still pretty concerning though. AFAIK browsers would block the Plaid widget if someone tried to load it insecurely and the page was HTTPS (what users have been trained to look for). But without going into devtools there is no easy way to verify that the widget is actually a real Plaid widget, thus POSTing your password directly to their server and not the merchant's, and no way at all to verify that they have such a partnership with your bank sanctioning them to collect your password.
teagee 6y ago
I tried to use their API for a personal project and found starting one month a bunch of transactions were missing from my bank account. It turned out Chase included a promotion on the pdf statement that month which threw off their scraping algo. Really woke me up to their "tech", I changed passwords and avoid them now.
deleted 6y ago
[deleted]
morpheuskafka 6y ago
They really do need an OAuth rather than save-and-forward-credentials approach to account access. Hopefully the new FedInstant platform will have improvements in this area. That said, I personally wasn't surprised to see they have this access. It makes sense that if you give them your bank password, they will have full access to your account unless they clearly convince me otherwise.
- judge2020 6y ago
  > FedInstant for the uninitiated: https://www.frbservices.org/financial-services/fednow/index.html https://www.frbservices.org/financial-services/fednow/index.... https://www.frbservices.org/financial-services/fednow/what-is-fednow.html https://www.frbservices.org/financial-services/fednow/what-i...
briankelly 6y ago
Yes, awhile back my bank account was decoupled from Venmo for reasons unknown. I unwittingly used Plaid to sign into my bank account instead of the usual wait a couple days procedure. No indication whatsoever - only found out because I saw an article, probably on here, about this company and their basically fraudulent practices.
- ngai_aku 6y ago
  I was under the impression that Venmo uses Plaid’s APIs on the backend, no?
  - briankelly 6y ago
    I don't really know how the integration works. AFAICT you can avoid Plaid if you verify your account manually [1]. https://help.venmo.com/hc/en-us/articles/221073067-Verifying-Your-Bank-Account https://help.venmo.com/hc/en-us/articles/221073067-Verifying...
lambda_obrien 6y ago
Now I know why I can never think of good ideas for a business, I'm thinking about what I can build to help my customers, but in today's SV I need to be thinking how can I more easily steal user data at a lower cost than my competitors.
mattnewton 6y ago
I once went to use plaid to apply for a mortgage on one of the new fancy broker platforms. It asked me to type my login credentials.. sketchy , but alright banks and mortgage companies seem to trust them? Then they asked me to disable 2FA on my account and at that point it was indistinguishable from a phishing attack to me. I noped out and changed my bank password immediately.
- jsinai 6y ago
  This is why a standard API is needed, like Open Banking in the UK. When I use a third party app, the access request is redirected to my bank app and authorisation is granted there. At this point it is explicit what data the third party will require. Once authorised, I’m redirected back to the third party’s app. At no point have I given my credentials. This must be renewed every 90 days. Furthermore I can view what apps have access to my account and can revoke this access at any time. PS Yes I know people like Ben Thompson [1] and even the US Treasury (mentioned in the same link) advocated for a private solution like Plaid (and nearly by extension Visa), but seriously this seems like something that needs to be government regulated to prevent incentives for selling user data. [1] https://stratechery.com/2020/visa-plaid-networks-and-jobs/ https://stratechery.com/2020/visa-plaid-networks-and-jobs/
Ericson2314 6y ago
Well, better one small company doing that garbage than Visa! It makes it easier to avoid.
kinkrtyavimoodh 6y ago
I am sorry to say this but your friends should really give a thought to why they are still working there. I understand that people have families to feed and mortgage, but they should at least consider changing jobs if they are software engineers.
krisboyz781 6y ago
That's not true. Plaid says they'll be accessing your information literally when you sign into your account.
ultimoo 6y ago
This is so terrible. Is there an easy way for me to write to Plaid to delete all my information or do I have to go into each service and unlink?
- asibehar 6y ago
  If you're in CA, use the CCPA. They claim to have removed my information in response to a CCPA request.
  - hansvm 6y ago
    Nice to see somebody respecting the law. Atlassian is still claiming that if they give my account to somebody else then they can ignore my CCPA claims.
- EricFortney 6y ago
  Yes. https://my.plaid.com/help/360043065334-can-i-remove-app-access,-delete-my-data-from-plaid,-or-revoke-my-consent-to-plaid https://my.plaid.com/help/360043065334-can-i-remove-app-acce...
gravyboat 6y ago
Why are you sorry for them? They are making the choice to work at Plaid when they know Plaid is a terrible legal phishing company.
deleted 6y ago
[deleted]
nailer 6y ago
FWIW their competitor Teller uses the bank's own native APIs. The idea is the bank can't shut off Teller clients without shutting off their own customers. This involves a lot of iOS reverse engineering. So things like Plaid's Capital One integration breaking for months have never happened with Teller - who've been running for something like 5 years now. https://teller.io/ https://teller.io/
- ZephyrBlu 6y ago
  So Teller reverse engineers a bank's internal APIs and uses those to manage your account?
  - nailer 6y ago
    Yes.
fintechthrow456 6y ago
As someone who's worked in fintech for 10 years, I think this is a bad take. Out of all aggregators (what this is called), Plaid is by far the most open and privacy-forward. First, they're transparent about being a 3rd party that's part of the flow (see https://plaid.com/blog/the-all-new-plaid-link/ https://plaid.com/blog/the-all-new-plaid-link/). It's clear it's Plaid, they use neutral colors and not the bank's, etc. They have a portal where you can manage your data (https://my.plaid.com/ https://my.plaid.com/). Second, they are very open about not selling data (unlike most of the their competitors). It's in their terms and their website (see https://plaid.com/how-we-handle-data/ https://plaid.com/how-we-handle-data/). I guess that could change, but from working with them I know it's part of their positioning so I'd be surprised if that changed. Third, they've announced bank integrations and afaik they're moving to OAuth where the banks support it (I've seen this in the wild, but can't replicate right now). The key here is where banks support it. I think you have to look at the historical context: the banks do not want you to own your data as a consumer. They don't want fintech apps to exist. Having talked to banks about integrating directly with them, it's onerous and only the big players can do it. Plaid's fighting the good fight for fintech startups. But yeah it's a less-than-ideal solution and it sucks that it doesn't work without creds flowing through and it's not clear regulators or banks will work to make it better. That sucks. I just think bashing on Plaid here is one-sided. (throwaway account because I work in fintech)
- ZephyrBlu 6y ago
  > But yeah it's a less-than-ideal solution and it sucks that it doesn't work without creds flowing through I can appreciate that Plaid is trying to push stuff forwards, but (Presumably) storing your bank credentials in plain-text is a far worse than a "less-than-ideal solution".
- kelnos 6y ago
  > It's clear it's Plaid, they use neutral colors and not the bank's, etc. Every time I've been confronted with a Plaid-backed bank login prompt, they use the bank's colors and logo, the word "Plaid" or their logo is either nowhere to be found or is in tiny fine print, and I run away screaming from that service.
- 6y ago
jennyyang 6y ago
IIRC, they have basically an instance of a scraper for every different bank web site, which to me doesn't seem very scalable. I'm not sure if this is still the case, but when I interviewed a few years ago, it definitely seemed that way.
mtgx 6y ago
Pretty much how 99% of this data robbery happens by all surveillance companies. This is why Facebook is so pissed off at Apple that it dares to ASK users first. "Most users aren't aware what data is gathered about them" is about 10x more accurate than "users don't care about privacy", even though it's the latter that gets repeated all the time (with some help from the surveillance companies themselves spreading this propaganda).
Kharvok 6y ago
I can confirm this as I currently use Plaid in a few projects. People have no idea what they are signing up for when they authorize this. It's possible to get near real time transaction data from somoene's bank account as well as monitor their account balances for any linked account essentially in perpetuity. With this data it's possible to back in to a lot of behaviors about someone's life. All of that is handed to any firm you authorize to link your bank account.
Dirlewanger 6y ago
Blame the banks for dragging their feet and not making proper APIs for these companies to use instead of screen scraping.
esotericimpl 6y ago
Their engineering team is so terrible. They implemented race conditions that caused their end users to receive data that didn't belong to the underlying account that they had connected.

xvector 6y ago

I can't wait until we have smart contracts on a privacy coin that let me invest and grow my wealth anonymously.

hahaxdxd123 6y ago
Anonymously is unlikely - how would the government get their taxes?
- xvector 6y ago
  Even if the government bans XMR from exchanges, BTC to XMR atomic swaps are coming. You can then 1. Use XMR as an anonymizing bridge to pseudonymous ETH or ADA wallets 2. Grow wealth with ETH or ADA smart contracts/decentralized finance 3. When you want to spend, transfer funds from your ETH/ADA wallets over the XMR bridge to newly generated spend wallets. (There's potential for a chain-analysis correlation attack at this point if you aren't careful with how you are withdrawing.) --- Really, it's all a nightmare and very difficult to do it now, but I'll be damned if someone doesn't develop an app or program that does this all seamlessly in a few years.
- cblconfederate 6y ago
  what if tax is part of the smart contract?
  - tyre 6y ago
    then it would have to know who it is taxing? The same applies. No, you cannot anonymously tax every transaction at some rate. Tax rates don't work that way, in a vacuum.
    - cblconfederate 6y ago
      why not. it's how sales tax works

smnrchrds 6y ago

They are getting sued by TD Bank for this very reason: > The bank said in the court filings that the interface "dupes" consumers into believing they are entering personal information into TD Bank's trusted platform. > "In reality, however, consumers are unwittingly giving their login credentials to the defendant, who takes the information, stores it on its servers, and uses it to mine consumers' bank records for valuable data (e.g., transaction histories, loans, etc.), which the defendant monetizes by selling to third parties," TD claimed in the court records. https://www.ctvnews.ca/business/td-bank-files-lawsuit-against-plaid-accusing-it-of-trying-to-dupe-consumers-1.5145326 https://www.ctvnews.ca/business/td-bank-files-lawsuit-agains... Also, giving your credentials to any third party, including Plaid, voids the warranty at many financial institutions. If your account gets hacked and your money stolen, you may find out that the zero liability policy no longer applies to you.

xtracto 6y ago
That´s interesting, and it is an important "stick". On the other side, I know some banks are giving a "carrot" to these types of companies by providing a "portal access" that allows these companies to connect their customers with their bank accounts so that the customer can select what to share with these sites. Of course, once those portals are enabled we enter the Facebook game: Where a lot of customers will blindly give all access to Plaid like companies, and then consumer group advocates will criticize for the amount of information that they are (still) mining from ignoring customers.
- morpheuskafka 6y ago
  I think BofA does this, which I like. When I linked my account to Robinhood through Plaid, it asked for 2FA (text or phone call, BofA doesn't support TOTP codes) and verified in, then asked me to select which accounts to grant access to. Since it doesn't need the 2FA subsequently, it must be doing some kind of OAuth style authentication when it passes that token to the bank and then gets a long-term access token for that specific account. From an HTTPS perspective this is still pretty concerning though. AFAIK browsers would block the Plaid widget if someone tried to load it insecurely and the page was HTTPS (what users have been trained to look for). But without going into devtools there is no easy way to verify that the widget is actually a real Plaid widget, thus POSTing your password directly to their server and not the merchant's, and no way at all to verify that they have such a partnership with your bank sanctioning them to collect your password.

teagee 6y ago

I tried to use their API for a personal project and found starting one month a bunch of transactions were missing from my bank account. It turned out Chase included a promotion on the pdf statement that month which threw off their scraping algo. Really woke me up to their "tech", I changed passwords and avoid them now.

deleted 6y ago

[deleted]

morpheuskafka 6y ago

They really do need an OAuth rather than save-and-forward-credentials approach to account access. Hopefully the new FedInstant platform will have improvements in this area. That said, I personally wasn't surprised to see they have this access. It makes sense that if you give them your bank password, they will have full access to your account unless they clearly convince me otherwise.

judge2020 6y ago
> FedInstant for the uninitiated: https://www.frbservices.org/financial-services/fednow/index.html https://www.frbservices.org/financial-services/fednow/index.... https://www.frbservices.org/financial-services/fednow/what-is-fednow.html https://www.frbservices.org/financial-services/fednow/what-i...

briankelly 6y ago

Yes, awhile back my bank account was decoupled from Venmo for reasons unknown. I unwittingly used Plaid to sign into my bank account instead of the usual wait a couple days procedure. No indication whatsoever - only found out because I saw an article, probably on here, about this company and their basically fraudulent practices.

ngai_aku 6y ago
I was under the impression that Venmo uses Plaid’s APIs on the backend, no?
- briankelly 6y ago
  I don't really know how the integration works. AFAICT you can avoid Plaid if you verify your account manually [1]. https://help.venmo.com/hc/en-us/articles/221073067-Verifying-Your-Bank-Account https://help.venmo.com/hc/en-us/articles/221073067-Verifying...

lambda_obrien 6y ago

Now I know why I can never think of good ideas for a business, I'm thinking about what I can build to help my customers, but in today's SV I need to be thinking how can I more easily steal user data at a lower cost than my competitors.

mattnewton 6y ago

I once went to use plaid to apply for a mortgage on one of the new fancy broker platforms. It asked me to type my login credentials.. sketchy , but alright banks and mortgage companies seem to trust them? Then they asked me to disable 2FA on my account and at that point it was indistinguishable from a phishing attack to me. I noped out and changed my bank password immediately.

jsinai 6y ago
This is why a standard API is needed, like Open Banking in the UK. When I use a third party app, the access request is redirected to my bank app and authorisation is granted there. At this point it is explicit what data the third party will require. Once authorised, I’m redirected back to the third party’s app. At no point have I given my credentials. This must be renewed every 90 days. Furthermore I can view what apps have access to my account and can revoke this access at any time. PS Yes I know people like Ben Thompson [1] and even the US Treasury (mentioned in the same link) advocated for a private solution like Plaid (and nearly by extension Visa), but seriously this seems like something that needs to be government regulated to prevent incentives for selling user data. [1] https://stratechery.com/2020/visa-plaid-networks-and-jobs/ https://stratechery.com/2020/visa-plaid-networks-and-jobs/

Ericson2314 6y ago

Well, better one small company doing that garbage than Visa! It makes it easier to avoid.

kinkrtyavimoodh 6y ago

I am sorry to say this but your friends should really give a thought to why they are still working there. I understand that people have families to feed and mortgage, but they should at least consider changing jobs if they are software engineers.

krisboyz781 6y ago

That's not true. Plaid says they'll be accessing your information literally when you sign into your account.

ultimoo 6y ago

This is so terrible. Is there an easy way for me to write to Plaid to delete all my information or do I have to go into each service and unlink?

asibehar 6y ago
If you're in CA, use the CCPA. They claim to have removed my information in response to a CCPA request.
- hansvm 6y ago
  Nice to see somebody respecting the law. Atlassian is still claiming that if they give my account to somebody else then they can ignore my CCPA claims.
EricFortney 6y ago
Yes. https://my.plaid.com/help/360043065334-can-i-remove-app-access,-delete-my-data-from-plaid,-or-revoke-my-consent-to-plaid https://my.plaid.com/help/360043065334-can-i-remove-app-acce...

gravyboat 6y ago

Why are you sorry for them? They are making the choice to work at Plaid when they know Plaid is a terrible legal phishing company.

deleted 6y ago

[deleted]

nailer 6y ago

FWIW their competitor Teller uses the bank's own native APIs. The idea is the bank can't shut off Teller clients without shutting off their own customers. This involves a lot of iOS reverse engineering. So things like Plaid's Capital One integration breaking for months have never happened with Teller - who've been running for something like 5 years now. https://teller.io/ https://teller.io/

ZephyrBlu 6y ago
So Teller reverse engineers a bank's internal APIs and uses those to manage your account?
- nailer 6y ago
  Yes.

fintechthrow456 6y ago

As someone who's worked in fintech for 10 years, I think this is a bad take. Out of all aggregators (what this is called), Plaid is by far the most open and privacy-forward. First, they're transparent about being a 3rd party that's part of the flow (see https://plaid.com/blog/the-all-new-plaid-link/ https://plaid.com/blog/the-all-new-plaid-link/). It's clear it's Plaid, they use neutral colors and not the bank's, etc. They have a portal where you can manage your data (https://my.plaid.com/ https://my.plaid.com/). Second, they are very open about not selling data (unlike most of the their competitors). It's in their terms and their website (see https://plaid.com/how-we-handle-data/ https://plaid.com/how-we-handle-data/). I guess that could change, but from working with them I know it's part of their positioning so I'd be surprised if that changed. Third, they've announced bank integrations and afaik they're moving to OAuth where the banks support it (I've seen this in the wild, but can't replicate right now). The key here is where banks support it. I think you have to look at the historical context: the banks do not want you to own your data as a consumer. They don't want fintech apps to exist. Having talked to banks about integrating directly with them, it's onerous and only the big players can do it. Plaid's fighting the good fight for fintech startups. But yeah it's a less-than-ideal solution and it sucks that it doesn't work without creds flowing through and it's not clear regulators or banks will work to make it better. That sucks. I just think bashing on Plaid here is one-sided. (throwaway account because I work in fintech)

ZephyrBlu 6y ago
> But yeah it's a less-than-ideal solution and it sucks that it doesn't work without creds flowing through I can appreciate that Plaid is trying to push stuff forwards, but (Presumably) storing your bank credentials in plain-text is a far worse than a "less-than-ideal solution".
kelnos 6y ago
> It's clear it's Plaid, they use neutral colors and not the bank's, etc. Every time I've been confronted with a Plaid-backed bank login prompt, they use the bank's colors and logo, the word "Plaid" or their logo is either nowhere to be found or is in tiny fine print, and I run away screaming from that service.
6y ago

jennyyang 6y ago

IIRC, they have basically an instance of a scraper for every different bank web site, which to me doesn't seem very scalable. I'm not sure if this is still the case, but when I interviewed a few years ago, it definitely seemed that way.

mtgx 6y ago

Pretty much how 99% of this data robbery happens by all surveillance companies. This is why Facebook is so pissed off at Apple that it dares to ASK users first. "Most users aren't aware what data is gathered about them" is about 10x more accurate than "users don't care about privacy", even though it's the latter that gets repeated all the time (with some help from the surveillance companies themselves spreading this propaganda).

Kharvok 6y ago

I can confirm this as I currently use Plaid in a few projects. People have no idea what they are signing up for when they authorize this. It's possible to get near real time transaction data from somoene's bank account as well as monitor their account balances for any linked account essentially in perpetuity. With this data it's possible to back in to a lot of behaviors about someone's life. All of that is handed to any firm you authorize to link your bank account.

Dirlewanger 6y ago

Blame the banks for dragging their feet and not making proper APIs for these companies to use instead of screen scraping.

esotericimpl 6y ago

Their engineering team is so terrible. They implemented race conditions that caused their end users to receive data that didn't belong to the underlying account that they had connected.