4 ms·

Don’t they also sell everything they learn about you from knowing every one of your transactions?

akerl_ 5y ago
I’m sure they’d claim they sell metadata or aggregates or something. But even if they’re selling more than they claim, I’ve accepted that as OK for my personal financial threat model. To say the obvious, other people’s risk/reward tradeoffs will be different, and I know plenty of people who’d never consider using Plaid. But I don’t think that makes them an “evil nightmare product from security hell”.
- jtbayly 5y ago
  I understand going ahead and using it. I have in the past and then stopped. But teaching people that it’s fine to enter their bank username and password on a not-their-bank website if somebody asks nicely is inarguable creating security hell in our society.
  - akerl_ 5y ago
    The entire financial industry is built upon a foundation of entering sensitive information all over the place. Swipe cards gave merchants your credit card number. Checks still give the recipient and every intermediary your full account and routing number. When you pay at any website, you’re entering in your full credit card number. Modern finance is a teetering stack of measures designed to account for this and handle cases where fraud or other malice occur.
    - jtbayly 5y ago
      All of that info is entirely different from the authentication info that proves you own the account and let’s you make changes to it.
  - deleted 5y ago
    [deleted]
jeandenis 5y ago
(Plaid CTO) No. I answered in more depth in a separate thread.
- jtbayly 5y ago
  Thanks. Glad to read these explanations.
drekk 5y ago
Plaid does not sell any user data to third parties. It's entirely funded by developers that pay to use the data, and who are also prevented from selling or otherwise sharing data. Your credentials also don't touch Plaid servers for the majority of traffic now; there are still legacy screen scraping extractors but Plaid can't exactly put a gun to a financial institution's head and force them to provide an API. It's only been recently that Plaid got to a size that players like Capital One or Wells Fargo are forced to play nice and sign a data access agreement or tell their users why they can't use Venmo.
- jtbayly 5y ago
  Thank you for your answer. That’s all good news. Glad to know better now.

I’m sure they’d claim they sell metadata or aggregates or something. But even if they’re selling more than they claim, I’ve accepted that as OK for my personal financial threat model. To say the obvious, other people’s risk/reward tradeoffs will be different, and I know plenty of people who’d never consider using Plaid. But I don’t think that makes them an “evil nightmare product from security hell”.

jtbayly 5y ago
I understand going ahead and using it. I have in the past and then stopped. But teaching people that it’s fine to enter their bank username and password on a not-their-bank website if somebody asks nicely is inarguable creating security hell in our society.
- akerl_ 5y ago
  The entire financial industry is built upon a foundation of entering sensitive information all over the place. Swipe cards gave merchants your credit card number. Checks still give the recipient and every intermediary your full account and routing number. When you pay at any website, you’re entering in your full credit card number. Modern finance is a teetering stack of measures designed to account for this and handle cases where fraud or other malice occur.
  - jtbayly 5y ago
    All of that info is entirely different from the authentication info that proves you own the account and let’s you make changes to it.
- deleted 5y ago
  [deleted]

jeandenis 5y ago

(Plaid CTO) No. I answered in more depth in a separate thread.

jtbayly 5y ago
Thanks. Glad to read these explanations.

drekk 5y ago

Plaid does not sell any user data to third parties. It's entirely funded by developers that pay to use the data, and who are also prevented from selling or otherwise sharing data. Your credentials also don't touch Plaid servers for the majority of traffic now; there are still legacy screen scraping extractors but Plaid can't exactly put a gun to a financial institution's head and force them to provide an API. It's only been recently that Plaid got to a size that players like Capital One or Wells Fargo are forced to play nice and sign a data access agreement or tell their users why they can't use Venmo.

jtbayly 5y ago
Thank you for your answer. That’s all good news. Glad to know better now.