2 ms·

What about Plaid? Should users avoid that?

• guipsp 6y ago
  ...Yes? The point is that you should be aware of who you're giving your information to.
  • dcow 6y ago
    Plaid is a valid service that helps glue bank APIs together. Why should it be avoided? I am not arguing your point strictly. But the problem in general can only really be solved with education. Users should always know who they’re giving credentials to. A technical measure like not allowing keyboard input in a full screen browser is a leaky stop gap. The full screen app could just as well show its own pixel perfect full screen keyboard and trick users to tap it.
    • ben_w 6y ago
      > The full screen app could just as well show its own pixel perfect full screen keyboard and trick users to tap it. You should’ve led with that, it’s a much better question than your others on this thread.
• gruez 6y ago
  If you care about security, yes. It operates identically to a phishing service, complete with a logos/imagery to suggest you're sending your credentials to your bank rather than a third party. What's worse is that as far as the user's concerned, they're inputting their credentials into the consumer site[1], as you can see in the demo: https://plaid.com/demo https://plaid.com/demo. This is as opposed to something like google oauth where you enter your credentials on accounts.google.com only. [1] ie. you're on site A, which wants access to your account details on bank X. when you're entering your details, the address bar shows site A's domain, not plaid.com or bank X.
  • dcow 6y ago
    I guess I would say it the other way around: phishing services operate identically to legit services. If we outlaw everything that someone has attempted to phish we’ll eventually have nothing. If a user trusts plaid to handle their credentials, so be it.