4 ms·

I honestly can't believe that there's enough people dumb enough to give their bank username/password combo to strangers to make services like this work. Nope n

I honestly can't believe that there's enough people dumb enough to give their bank username/password combo to strangers to make services like this work. Nope nope nope. As a user, I'd never use any service that is plaid based, I don't even care that "they have proper api access now". Even though I've been fan of other stripe offerings I'd never use this either. It's beyond shady. Friends don't let friends give out their banking creds.

lambda_lord 4y ago
That's not how the service works. You don't give Stripe your banking credentials, you log into your bank directly: https://stripe.com/docs/financial-connections/fundamentals#authentication-flow https://stripe.com/docs/financial-connections/fundamentals#a...
- wmf 4y ago
  No, it looks like you're logging in to your bank but you're actually giving your credentials to Stripe.
  - lambda_lord 4y ago
    If your bank supports Oauth it won't share your credentials: >Stripe generally defaults the authentication flow to OAuth if available at the financial institution....OAuth is an open standard authorization protocol that allows users to let applications (for example, Stripe) access their information within other applications (for example, bank apps) without having to share their login credentials. But for banks without Oauth you DO give your credentials to Stripe: > For these banks, end users provide credentials to Stripe or one of our trusted partners.
astrange 4y ago
Is there even a single case of this actually going badly?
twelve40 4y ago
there are at least 100 million people who've used Plaid alone, not to mention other aggregators (MX, Finicity, Yodlee, etc) like it or not, it is a mainstream thing by now. plus, as others have mentioned here, with oauth-enabled banks the aggregators just get a temporary token. https://www.protocol.com/fintech/plaid-lawsuit-settlement-open-banking https://www.protocol.com/fintech/plaid-lawsuit-settlement-op...

lambda_lord 4y ago

That's not how the service works. You don't give Stripe your banking credentials, you log into your bank directly: https://stripe.com/docs/financial-connections/fundamentals#authentication-flow https://stripe.com/docs/financial-connections/fundamentals#a...

wmf 4y ago
No, it looks like you're logging in to your bank but you're actually giving your credentials to Stripe.
- lambda_lord 4y ago
  If your bank supports Oauth it won't share your credentials: >Stripe generally defaults the authentication flow to OAuth if available at the financial institution....OAuth is an open standard authorization protocol that allows users to let applications (for example, Stripe) access their information within other applications (for example, bank apps) without having to share their login credentials. But for banks without Oauth you DO give your credentials to Stripe: > For these banks, end users provide credentials to Stripe or one of our trusted partners.

astrange 4y ago

Is there even a single case of this actually going badly?

twelve40 4y ago

there are at least 100 million people who've used Plaid alone, not to mention other aggregators (MX, Finicity, Yodlee, etc) like it or not, it is a mainstream thing by now. plus, as others have mentioned here, with oauth-enabled banks the aggregators just get a temporary token. https://www.protocol.com/fintech/plaid-lawsuit-settlement-open-banking https://www.protocol.com/fintech/plaid-lawsuit-settlement-op...