4 ms·
The article describes how Plaid is designed to replace the micro deposit / verify flow used by many sites to validate that you own a checking account before the
by akerl_ 5y ago
The article describes how Plaid is designed to replace the micro deposit / verify flow used by many sites to validate that you own a checking account before they deposit/withdrawal to/from that account.
I’m sure this is a reasonably common flow, but it’s only a slice of what Plaid does. They additionally do transaction parsing/normalization across a wide variety of accounts. I’ve been using Plaid for years as part of my ledger-cli workflow, to automate importing of account transactions.
The security flow is horrible, but the security flow for banks was already horrible: the reason I trust banks with my money is because of strong ability to reverse malicious activity, and regulatory oversight, not because I trust their infosec practices.
Pre-Plaid, I had some local scraping tools to pull transactions, and ran into several instances where the “MFA” step for banks allowed my “browser” to pick its own unique identifier. If I set it to “hahalol”, that was fine, and as long as I kept sending that ID, I never had to MFA again.
If we somehow had a world where there was an actual standard way to fetch data from my banks, I’d love that. I’d switch immediately. But in the current world, Plaid is pretty far down my list of financial-service-related risks.
- jtbayly 5y agoDon’t they also sell everything they learn about you from knowing every one of your transactions?
- akerl_ 5y agoI’m sure they’d claim they sell metadata or aggregates or something. But even if they’re selling more than they claim, I’ve accepted that as OK for my personal financial threat model. To say the obvious, other people’s risk/reward tradeoffs will be different, and I know plenty of people who’d never consider using Plaid. But I don’t think that makes them an “evil nightmare product from security hell”.
- jtbayly 5y agoI understand going ahead and using it. I have in the past and then stopped. But teaching people that it’s fine to enter their bank username and password on a not-their-bank website if somebody asks nicely is inarguable creating security hell in our society.
- akerl_ 5y agoThe entire financial industry is built upon a foundation of entering sensitive information all over the place. Swipe cards gave merchants your credit card number. Checks still give the recipient and every intermediary your full account and routing number. When you pay at any website, you’re entering in your full credit card number. Modern finance is a teetering stack of measures designed to account for this and handle cases where fraud or other malice occur.
- jtbayly 5y agoAll of that info is entirely different from the authentication info that proves you own the account and let’s you make changes to it.
- deleted 5y ago[deleted]
- jeandenis 5y ago(Plaid CTO) No. I answered in more depth in a separate thread.
- jtbayly 5y agoThanks. Glad to read these explanations.
- drekk 5y agoPlaid does not sell any user data to third parties. It's entirely funded by developers that pay to use the data, and who are also prevented from selling or otherwise sharing data. Your credentials also don't touch Plaid servers for the majority of traffic now; there are still legacy screen scraping extractors but Plaid can't exactly put a gun to a financial institution's head and force them to provide an API. It's only been recently that Plaid got to a size that players like Capital One or Wells Fargo are forced to play nice and sign a data access agreement or tell their users why they can't use Venmo.
- jtbayly 5y agoThank you for your answer. That’s all good news. Glad to know better now.
- digsy 5y ago>the security flow for banks was already horrible I'm curious why you would say that. What flaws have you seen in currently banking systems?
- akerl_ 5y agoThere’s an example in my comment, right beneath the paragraph you quoted.
- SAI_Peregrinus 5y ago> the reason I trust banks with my money is because of strong ability to reverse malicious activity Note that most banks will not reverse transactions made using your username & password. Plaid's security flow gets rid of the ability to reverse malicious activity.