12 ms·

It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services l

It's about time. When I learned that applications like YNAB (You Need A Budget) use services like Plaid to connect to my bank account, and that these services literally take my username and password and impersonate me to get my banking data, I was a little sketched out. I use YNAB every day, and having it connected to my bank account is incredibly useful, but if something goes wrong and Plaid loses my money somehow, is there any recourse? Hopefully individuals will be able to use the Open Banking APIs to access their own data directly, but it looks like accreditation will be required, so probably not. Here's the full text of the report: https://www.canada.ca/en/department-finance/programs/consultations/2021/final-report-advisory-committee-open-banking.html https://www.canada.ca/en/department-finance/programs/consult...

jamespullar 5y ago
To be fair, YNAB is rather explicit about how it connects to your accounts and also actively recommends against doing so in favor of manually entering your transactions. My experience with connecting the two is that I still need to manually validate every transaction because on occasion Plaid is either slow or just misses entries entirely. Also in the case of YNAB, Plaid is not posting transactions on your accounts. It's a screen scraping service transferring account data.
- frosted-flakes 5y ago
  I manually enter all of my transactions, but for correcting mistakes or for automatic payments, linking to my bank accounts is still very useful. Also, some accounts update faster than others for some reason. Usually YNAB will import them the same day. Plaid doesn't post transactions, but it does have my credentials which I said I would not share with anyone when I opened my bank account. Those credentials do allow posting transactions, and while it's not likely that anything will happen, if something does, I'm theoretically responsible. At the moment, I'm willing to take that risk.
SilverRed 5y ago
I think the future is that banks/bank apps will do the budgeting stuff themselves. Most bank apps will now break down your monthly spending by categories. My bank app shows me my weekly and monthly spend compared to previous periods, how much I spent in each category, how much I spent at each business, how much I have spent this month so far compared to the same time last month and etc.
- toomuchtodo 5y ago
  Startups prove the model, and then legacy enterprises adopt.
- frosted-flakes 5y ago
  My bank does that too, and has done so for many years now. It's close to useless though, because I have no control over it. YNAB isn't just historical trends, it's a budgeting program.
- function_seven 5y ago
  I hope not. I have accounts at more than one bank, and need to have the data centralized for it to be useful. Having a standard and open API across banks, brokerages, and credit providers would be killer.
- andylynch 5y ago
  Uk banks are doing this now. You can use open banking to show all your (uk) accounts in one place
KerrickStaley 5y ago
FWIW I use Schwab for banking and I was able to connect YNAB to Schwab without entering my password. It looks like Schwab supports read-only API access, and Plaid takes advantage of that to avoid needing your credentials. As an added plus, you can keep 2FA enabled. Schwab does 2FA through an app so it's a touch above SMS-based 2FA (although only a single app is supported, Symantic VIP Access, rather than generic support for apps like Google Authenticator). I also hate Plaid's model where you provide Plaid your credentials, and I've never entered my credentials into Plaid.
- ZekeSulastin 5y ago
  If you trust python-vipaccess[0], you can use it to provision the token to load into your preferred TOTP app. It’s not a supported method but if you (or someone coming across this later) want to use another app it’s an option :) From WilsonHammer on Reddit[1]: 1) Install pip, a python package manager, using your OS package manager. 2) Install python-vipaccess by executing `pip install --user python-vipaccess` 3) Execute `vipaccess provision -p -t VSMT` - this will print out all the information needed. Note the Symantec ID (it looks like VSMT12345678). It is what goes in the "Credential ID" field when adding a new device on Schwab's website. 4) Save the `otpauth://...` data into data.txt. 4.5) (Optional) Modify the `issuer=Symantec` parameter to read `issuer=Charles%20Schwab` Also change `VIP%20Access:VSMT123456789` to your Schwab online banking username. These are purely aesthetic changes and will only make a difference in the label that shows up in the Google Auth app. 5) Install qrencode using your OS package manager. 6) Execute `qrencode.exe -o qr.png -s 15 < data.txt` to generate the QR image (qr.png) from your otpauth data file. The -s 15 scales how many pixels wide a QR block is in the image (in this case, 15). 7) Scan the QR image (qr.png) with your google auth app. 8) Go to Schwab -> Service -> Security Center -> Manage Two-Step Verification -> Add another Security Token and input the Symantec ID from step 3 (it looks like VSMT12345678) and the current rolling TOTP code from the Google Auth App. (If you use Authy you may have to type it manually) [0] https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess [1] https://www.reddit.com/r/personalfinance/comments/hvvuwl/using_google_auth_or_your_totp_app_of_choice_for/ https://www.reddit.com/r/personalfinance/comments/hvvuwl/usi...
frereubu 5y ago
In the UK, which has implemented open banking already, you can use services like https://syncforynab.com/ https://syncforynab.com/ (no affiliation, just a happy customer) to link your accounts to YNAB. Some challenger banks like Monzo and Starling allow you to set up webhooks for transactions so they're immediately available in YNAB through Sync for YNAB rather than having to use x-hourly syncs via open banking companies that are officially blessed by the big banks.
- omginternets 5y ago
  I recently moved back to the US after 5 years in the UK. It’s hard to overstate how awesome Monzo is, and how much of a steaming pile of 3rd world shit banking in the US is.
  - omginternets 5y ago
    Addendum: I still use Monzo in the US. Call the cops. I don’t care.
adrr 5y ago
It’s worse than that. I assume Plaid doesn’t scrape bank sites and rely on 3rd parties to bypass the EULAs on bank sites.
- harringtonjones 5y ago
  can you please elaborate? this is quite the accusation
  - adrr 5y ago
    It is something I heard working in fintech, a lot around security, that the aggregators rely on 3rd party scrapers. Not plaid specific.
- phoenixy1 5y ago
  Hi! I work at Plaid. This is false. We do not do that.
  - adrr 5y ago
    Ever? That was always the rumor on how aggregators could fix scraping within a day of major changes.
    - ceejayoz 5y ago
      If the supposed third-party scrapers can do it within a day, why wouldn't Plaid/Mint/Yodlee be able to do the same?
xibalba 5y ago
> YNAB (You Need A Budget) use services like Plaid to...take my username and password and impersonate me to get my banking data WHAT. THE. F. I'm a longtime, happy YNAB user. I had no idea this was going on until just now. I always just assumed there were secure APIs used to import my data. YNAB's Capital One "integration" stopped working a few years ago (possibly because they cracked down on screen scraping?) and I was upset with Capital One. Perhaps Capital One took steps to prevent insecure access/screen scraping?
- varenc 5y ago
  For future reference the tip off is that YNAB/Plaid asks for your bank account's username and password directly. If they were using some proper API, you'd be redirected to an Authorization page on your bank's domain where you could review the requested permissions and the app requesting, and then choose to grant it.
  - kryptk 5y ago
    Exactly this, Plaid "kindly requests" you violate the ToS you have with the bank and hand over the keys to your finances. I have never noped out of anything so hard.
    - amluto 5y ago
      It would be interesting if an attorney general went after Plaid for CFAA violation.
      - varenc 5y ago
        I'm conflicted on the issue. Plaid only has to do this insane screen scraping because there's no other way to get my own financial data. The details of how it's done pains me, but I also think I should have freedom of choice with my data. IMHO, the Canadian proposal seems like the ideal solution. Force the banks to offer a secure and more efficient way for consumers to access their open banking data. (This will also massively lower the barrier to entry for another Plaid competitor) edit: Plaid's docs mention that banks may detect and block this screen-scraping. They frame it as the bank limiting "your ability to access your financial information", which I think is somewhat valid. They're quite obtuse about the whole scraping thing though: https://plaid.com/trouble-connecting/#:~:text=Your%20financial%20institution%20may%20be%20limiting%20your%20ability%20to%20connect https://plaid.com/trouble-connecting/#:~:text=Your%20financi...
williamscales 5y ago
Plaid is only one security breach away from being utterly destroyed. And they will take out the financial lives of all their customers with them. It’s utterly irresponsible and I have no idea how Plaid hasn’t been shut down. You have no recourse if they are breached. The TOS of your online banking probably says that if you disclose your username and password to any third party then you have no liability protections.
- dataflow 5y ago
  Edit: Never mind, I was confusing the use of Plaid for linking accounts (like Robinhood does) with its use to actually monitor accounts (like YNAB).
  - Buttons840 5y ago
    How would they know about that transaction I made today without my password?
- devin 5y ago
  This is FUD. Lots of Plaid-based connections only allow reads. This is a regulated industry, and the fallout reputationally might be tough, but consumers are well-protected.
  - Jarwain 5y ago
    How is that enforced? What is the technical basis that enforces read-only access using user/password auth? Especially since that user/password auth is used by an end user to do "write"-type actions?
    - lucasyvas 5y ago
      Read-only access is not possible. By handing over the credentials you are handing over write access. You are correct.
      - 5y ago
shados 5y ago
Dunno how Turbotax does things under the hood in the US, but when it prompts me for the username and password of my broker to import my info, it certainly make me very queasy.
phoenixy1 5y ago
I haven't read the entire report yet, but it seems like a step in the right direction (even given some of the caveats folks have pointed out). I work at Plaid and a big focus area for us is to move as much traffic to APIs as possible, with a target of 75% of traffic to be committed to APIs by EOY, and we’re hopeful that we’ll be close to a fully API based industry in the next few years. IMO anything that makes API-based connectivity and open finance standards more widespread is a win for both fintech developers and anyone with a bank account.
barbarbar 5y ago
I don't know what Plaid is. But the user/password thing sounds insane. How can that be even an idea for a solution?
- deathanatos 5y ago
  What else is there, when the bank doesn't provide an API & the ability to do something proper, like OAuth2?
  - robertlagrant 5y ago
    There is this alternative: don't create a service that does something like this.
perl4ever 5y ago
>if something goes wrong and Plaid loses my money somehow, is there any recourse Wait, you mean you don't read and understand every word of every legal agreement you accede to?? Ok, well, as a responsible consumer, have you considered keeping a lawyer on retainer?
phoenixy1 5y ago
Hi! I work at Plaid wanted to share that the Consumer Financial Production Bureau addressed the fact that a financial institution cannot waive liability responsibilities in a recent Compliance Aid. FAQ 4 says that instititutions cannot rely on an agreement with the consumer that waives the liability protections under Regulation E if a consumer has shared their account information with a third party because those are protections provided under the Electronic Funds Transfer Act. Source: https://www.consumerfinance.gov/compliance/compliance-resources/deposit-accounts-resources/electronic-fund-transfers/electronic-fund-transfers-faqs/ https://www.consumerfinance.gov/compliance/compliance-resour...
- robertlagrant 5y ago
  But still. Terrible security model, right?
- frosted-flakes 5y ago
  That's for the USA. This news is about Canada.
devinsit 5y ago
This is basically the main reason why I built uFincs (https://ufincs.com/ https://ufincs.com/) without any sort of bank integration. As a Canadian myself, the privacy implications of letting a third party like Plaid take my bank password to get my data were, indeed, rather sketchy. I've been looking forward to the day that open banking gets pushed here, so this is definitely good news that uFincs (and every other personal finance app) nmight eventually get some secure bank integrations. Although, knowing how these things usually go, I'm sure the "2023" target is a little optimistic...
marvin 5y ago
This put me off this type of banking app the first time I tried to register an account with them ten years ago, and I haven't touched them since. I suppose EU users have an easier time with the PDS2 directive mandating interoperability between banking actors, but I'm unsure how many have found a way around properly implementing it.
jrootabega 5y ago
I've worked for a heavy customer of Plaid, and I've experienced the good and bad side of said entities and architectures, and the propaganda used by both sides. Banks say "impersonate", Plaid says something else. I think a reasonable viewpoint could say that you are authorizing Plaid to act on your behalf. Would a bank punish a rich person for having their accountant/finance manager know their credentials and use them in their duties? Would a bank publicly punish someone for storing their bank password in a password manager? How about an online password manager?

jamespullar 5y ago

To be fair, YNAB is rather explicit about how it connects to your accounts and also actively recommends against doing so in favor of manually entering your transactions. My experience with connecting the two is that I still need to manually validate every transaction because on occasion Plaid is either slow or just misses entries entirely. Also in the case of YNAB, Plaid is not posting transactions on your accounts. It's a screen scraping service transferring account data.

frosted-flakes 5y ago
I manually enter all of my transactions, but for correcting mistakes or for automatic payments, linking to my bank accounts is still very useful. Also, some accounts update faster than others for some reason. Usually YNAB will import them the same day. Plaid doesn't post transactions, but it does have my credentials which I said I would not share with anyone when I opened my bank account. Those credentials do allow posting transactions, and while it's not likely that anything will happen, if something does, I'm theoretically responsible. At the moment, I'm willing to take that risk.

SilverRed 5y ago

I think the future is that banks/bank apps will do the budgeting stuff themselves. Most bank apps will now break down your monthly spending by categories. My bank app shows me my weekly and monthly spend compared to previous periods, how much I spent in each category, how much I spent at each business, how much I have spent this month so far compared to the same time last month and etc.

toomuchtodo 5y ago
Startups prove the model, and then legacy enterprises adopt.
frosted-flakes 5y ago
My bank does that too, and has done so for many years now. It's close to useless though, because I have no control over it. YNAB isn't just historical trends, it's a budgeting program.
function_seven 5y ago
I hope not. I have accounts at more than one bank, and need to have the data centralized for it to be useful. Having a standard and open API across banks, brokerages, and credit providers would be killer.
andylynch 5y ago
Uk banks are doing this now. You can use open banking to show all your (uk) accounts in one place

KerrickStaley 5y ago

FWIW I use Schwab for banking and I was able to connect YNAB to Schwab without entering my password. It looks like Schwab supports read-only API access, and Plaid takes advantage of that to avoid needing your credentials. As an added plus, you can keep 2FA enabled. Schwab does 2FA through an app so it's a touch above SMS-based 2FA (although only a single app is supported, Symantic VIP Access, rather than generic support for apps like Google Authenticator). I also hate Plaid's model where you provide Plaid your credentials, and I've never entered my credentials into Plaid.

ZekeSulastin 5y ago
If you trust python-vipaccess[0], you can use it to provision the token to load into your preferred TOTP app. It’s not a supported method but if you (or someone coming across this later) want to use another app it’s an option :) From WilsonHammer on Reddit[1]: 1) Install pip, a python package manager, using your OS package manager. 2) Install python-vipaccess by executing `pip install --user python-vipaccess` 3) Execute `vipaccess provision -p -t VSMT` - this will print out all the information needed. Note the Symantec ID (it looks like VSMT12345678). It is what goes in the "Credential ID" field when adding a new device on Schwab's website. 4) Save the `otpauth://...` data into data.txt. 4.5) (Optional) Modify the `issuer=Symantec` parameter to read `issuer=Charles%20Schwab` Also change `VIP%20Access:VSMT123456789` to your Schwab online banking username. These are purely aesthetic changes and will only make a difference in the label that shows up in the Google Auth app. 5) Install qrencode using your OS package manager. 6) Execute `qrencode.exe -o qr.png -s 15 < data.txt` to generate the QR image (qr.png) from your otpauth data file. The -s 15 scales how many pixels wide a QR block is in the image (in this case, 15). 7) Scan the QR image (qr.png) with your google auth app. 8) Go to Schwab -> Service -> Security Center -> Manage Two-Step Verification -> Add another Security Token and input the Symantec ID from step 3 (it looks like VSMT12345678) and the current rolling TOTP code from the Google Auth App. (If you use Authy you may have to type it manually) [0] https://github.com/dlenski/python-vipaccess https://github.com/dlenski/python-vipaccess [1] https://www.reddit.com/r/personalfinance/comments/hvvuwl/using_google_auth_or_your_totp_app_of_choice_for/ https://www.reddit.com/r/personalfinance/comments/hvvuwl/usi...

frereubu 5y ago

In the UK, which has implemented open banking already, you can use services like https://syncforynab.com/ https://syncforynab.com/ (no affiliation, just a happy customer) to link your accounts to YNAB. Some challenger banks like Monzo and Starling allow you to set up webhooks for transactions so they're immediately available in YNAB through Sync for YNAB rather than having to use x-hourly syncs via open banking companies that are officially blessed by the big banks.

omginternets 5y ago
I recently moved back to the US after 5 years in the UK. It’s hard to overstate how awesome Monzo is, and how much of a steaming pile of 3rd world shit banking in the US is.
- omginternets 5y ago
  Addendum: I still use Monzo in the US. Call the cops. I don’t care.

adrr 5y ago

It’s worse than that. I assume Plaid doesn’t scrape bank sites and rely on 3rd parties to bypass the EULAs on bank sites.

harringtonjones 5y ago
can you please elaborate? this is quite the accusation
- adrr 5y ago
  It is something I heard working in fintech, a lot around security, that the aggregators rely on 3rd party scrapers. Not plaid specific.
phoenixy1 5y ago
Hi! I work at Plaid. This is false. We do not do that.
- adrr 5y ago
  Ever? That was always the rumor on how aggregators could fix scraping within a day of major changes.
  - ceejayoz 5y ago
    If the supposed third-party scrapers can do it within a day, why wouldn't Plaid/Mint/Yodlee be able to do the same?

xibalba 5y ago

> YNAB (You Need A Budget) use services like Plaid to...take my username and password and impersonate me to get my banking data WHAT. THE. F. I'm a longtime, happy YNAB user. I had no idea this was going on until just now. I always just assumed there were secure APIs used to import my data. YNAB's Capital One "integration" stopped working a few years ago (possibly because they cracked down on screen scraping?) and I was upset with Capital One. Perhaps Capital One took steps to prevent insecure access/screen scraping?

varenc 5y ago
For future reference the tip off is that YNAB/Plaid asks for your bank account's username and password directly. If they were using some proper API, you'd be redirected to an Authorization page on your bank's domain where you could review the requested permissions and the app requesting, and then choose to grant it.
- kryptk 5y ago
  Exactly this, Plaid "kindly requests" you violate the ToS you have with the bank and hand over the keys to your finances. I have never noped out of anything so hard.
  - amluto 5y ago
    It would be interesting if an attorney general went after Plaid for CFAA violation.
    - varenc 5y ago
      I'm conflicted on the issue. Plaid only has to do this insane screen scraping because there's no other way to get my own financial data. The details of how it's done pains me, but I also think I should have freedom of choice with my data. IMHO, the Canadian proposal seems like the ideal solution. Force the banks to offer a secure and more efficient way for consumers to access their open banking data. (This will also massively lower the barrier to entry for another Plaid competitor) edit: Plaid's docs mention that banks may detect and block this screen-scraping. They frame it as the bank limiting "your ability to access your financial information", which I think is somewhat valid. They're quite obtuse about the whole scraping thing though: https://plaid.com/trouble-connecting/#:~:text=Your%20financial%20institution%20may%20be%20limiting%20your%20ability%20to%20connect https://plaid.com/trouble-connecting/#:~:text=Your%20financi...

williamscales 5y ago

Plaid is only one security breach away from being utterly destroyed. And they will take out the financial lives of all their customers with them. It’s utterly irresponsible and I have no idea how Plaid hasn’t been shut down. You have no recourse if they are breached. The TOS of your online banking probably says that if you disclose your username and password to any third party then you have no liability protections.

dataflow 5y ago
Edit: Never mind, I was confusing the use of Plaid for linking accounts (like Robinhood does) with its use to actually monitor accounts (like YNAB).
- Buttons840 5y ago
  How would they know about that transaction I made today without my password?
devin 5y ago
This is FUD. Lots of Plaid-based connections only allow reads. This is a regulated industry, and the fallout reputationally might be tough, but consumers are well-protected.
- Jarwain 5y ago
  How is that enforced? What is the technical basis that enforces read-only access using user/password auth? Especially since that user/password auth is used by an end user to do "write"-type actions?
  - lucasyvas 5y ago
    Read-only access is not possible. By handing over the credentials you are handing over write access. You are correct.
    - 5y ago

shados 5y ago

Dunno how Turbotax does things under the hood in the US, but when it prompts me for the username and password of my broker to import my info, it certainly make me very queasy.

phoenixy1 5y ago

I haven't read the entire report yet, but it seems like a step in the right direction (even given some of the caveats folks have pointed out). I work at Plaid and a big focus area for us is to move as much traffic to APIs as possible, with a target of 75% of traffic to be committed to APIs by EOY, and we’re hopeful that we’ll be close to a fully API based industry in the next few years. IMO anything that makes API-based connectivity and open finance standards more widespread is a win for both fintech developers and anyone with a bank account.

barbarbar 5y ago

I don't know what Plaid is. But the user/password thing sounds insane. How can that be even an idea for a solution?

deathanatos 5y ago
What else is there, when the bank doesn't provide an API & the ability to do something proper, like OAuth2?
- robertlagrant 5y ago
  There is this alternative: don't create a service that does something like this.

perl4ever 5y ago

>if something goes wrong and Plaid loses my money somehow, is there any recourse Wait, you mean you don't read and understand every word of every legal agreement you accede to?? Ok, well, as a responsible consumer, have you considered keeping a lawyer on retainer?

phoenixy1 5y ago

Hi! I work at Plaid wanted to share that the Consumer Financial Production Bureau addressed the fact that a financial institution cannot waive liability responsibilities in a recent Compliance Aid. FAQ 4 says that instititutions cannot rely on an agreement with the consumer that waives the liability protections under Regulation E if a consumer has shared their account information with a third party because those are protections provided under the Electronic Funds Transfer Act. Source: https://www.consumerfinance.gov/compliance/compliance-resources/deposit-accounts-resources/electronic-fund-transfers/electronic-fund-transfers-faqs/ https://www.consumerfinance.gov/compliance/compliance-resour...

robertlagrant 5y ago
But still. Terrible security model, right?
frosted-flakes 5y ago
That's for the USA. This news is about Canada.

devinsit 5y ago

This is basically the main reason why I built uFincs (https://ufincs.com/ https://ufincs.com/) without any sort of bank integration. As a Canadian myself, the privacy implications of letting a third party like Plaid take my bank password to get my data were, indeed, rather sketchy. I've been looking forward to the day that open banking gets pushed here, so this is definitely good news that uFincs (and every other personal finance app) nmight eventually get some secure bank integrations. Although, knowing how these things usually go, I'm sure the "2023" target is a little optimistic...

marvin 5y ago

This put me off this type of banking app the first time I tried to register an account with them ten years ago, and I haven't touched them since. I suppose EU users have an easier time with the PDS2 directive mandating interoperability between banking actors, but I'm unsure how many have found a way around properly implementing it.

jrootabega 5y ago

I've worked for a heavy customer of Plaid, and I've experienced the good and bad side of said entities and architectures, and the propaganda used by both sides. Banks say "impersonate", Plaid says something else. I think a reasonable viewpoint could say that you are authorizing Plaid to act on your behalf. Would a bank punish a rich person for having their accountant/finance manager know their credentials and use them in their duties? Would a bank publicly punish someone for storing their bank password in a password manager? How about an online password manager?