4 ms·

In the case of venmo (and many other of their customers), it was actually Plaid that was asking for your bank login credentials to connect your bank account to

In the case of venmo (and many other of their customers), it was actually Plaid that was asking for your bank login credentials to connect your bank account to Venmo. They've been getting criticism regularly for that, unsurprisingly.

floatingatoll 5y ago
(And Plaid noted that they vastly prefer to oauth to banks, and do with many other banks, but that Venmo won’t accept oauth and demands credentials.)
- Operyl 5y ago
  No that’s not correct. Venmo is not forcing password auth, it’s banks not implementing the OAuth flow that causes this. I just went through with OAuth in Venmo with my bank (Capital One). They also offer traditional (deposit 50 cents and validate the amount) work flow too, they’re not forcing the Plaid model at all.
  - floatingatoll 5y ago
    Erm, I don’t think we’re describing the same sides of the flow, but I trust you’re right anyways. Apologies for my confusion.
dheera 5y ago
Yeah so now I need to give my password to not just Venmo but also some startup called Plaid that I need to trust? Doubly fuck no.
- phoenixy1 5y ago
  To clarify -- Venmo doesn't get the credentials at all, only Plaid does. Venmo then uses an API to get the specific bank account data it needs from Plaid.
  - dheera 5y ago
    I still don't trust Plaid. Venmo could also get the credentials if they want to, since they're launching it from within their own app. They could keylog everything in their app if they wanted to, including what happens inside Plaid. Nobody should ask for passwords to anything but their own service. Period. Asking for bank passwords should be made illegal. If I were the president I would have made that a federal law yesterday.
    - Larrikin 5y ago
      The president doesn't make legislation. Plaid provides a useful service that's a stop gap for the poor infrastructure of banks. I honestly doubt that most banks would have even bothered to start the laborious process of OAuth without them being an extremely popular middle layer for services like YNAB. My company actually uses them to process recurring payments.
      - dheera 5y ago
        Yeah well I would have also made it a law for banks to support OAuth and hardware key 2FA, hand out 2 Yubikeys to every citizen and ban SMS, among other things. Plaid is not useful if they need to ask for passwords.
- zwily 5y ago
  Plaid is not some tiny startup... They're almost 10 years old and Visa tried to buy them for $5B a couple years ago. That doesn't mean you should trust them (I don't), but just because you haven't heard of them doesn't mean they're not big.
- Operyl 5y ago
  Venmo offers the traditional verify a deposit amount validation method too, it just takes a few days. It’s an either or method.

floatingatoll 5y ago

(And Plaid noted that they vastly prefer to oauth to banks, and do with many other banks, but that Venmo won’t accept oauth and demands credentials.)

Operyl 5y ago
No that’s not correct. Venmo is not forcing password auth, it’s banks not implementing the OAuth flow that causes this. I just went through with OAuth in Venmo with my bank (Capital One). They also offer traditional (deposit 50 cents and validate the amount) work flow too, they’re not forcing the Plaid model at all.
- floatingatoll 5y ago
  Erm, I don’t think we’re describing the same sides of the flow, but I trust you’re right anyways. Apologies for my confusion.

dheera 5y ago

Yeah so now I need to give my password to not just Venmo but also some startup called Plaid that I need to trust? Doubly fuck no.

phoenixy1 5y ago
To clarify -- Venmo doesn't get the credentials at all, only Plaid does. Venmo then uses an API to get the specific bank account data it needs from Plaid.
- dheera 5y ago
  I still don't trust Plaid. Venmo could also get the credentials if they want to, since they're launching it from within their own app. They could keylog everything in their app if they wanted to, including what happens inside Plaid. Nobody should ask for passwords to anything but their own service. Period. Asking for bank passwords should be made illegal. If I were the president I would have made that a federal law yesterday.
  - Larrikin 5y ago
    The president doesn't make legislation. Plaid provides a useful service that's a stop gap for the poor infrastructure of banks. I honestly doubt that most banks would have even bothered to start the laborious process of OAuth without them being an extremely popular middle layer for services like YNAB. My company actually uses them to process recurring payments.
    - dheera 5y ago
      Yeah well I would have also made it a law for banks to support OAuth and hardware key 2FA, hand out 2 Yubikeys to every citizen and ban SMS, among other things. Plaid is not useful if they need to ask for passwords.
zwily 5y ago
Plaid is not some tiny startup... They're almost 10 years old and Visa tried to buy them for $5B a couple years ago. That doesn't mean you should trust them (I don't), but just because you haven't heard of them doesn't mean they're not big.
Operyl 5y ago
Venmo offers the traditional verify a deposit amount validation method too, it just takes a few days. It’s an either or method.