The fact that Plaid works within a modal iframe with no clear domain verification, bypassing the browser's HTTPS lock icon, and then *asks for your banking logi

The fact that Plaid works within a modal iframe with no clear domain verification, bypassing the browser's HTTPS lock icon, and then *asks for your banking login*, is irresponsible and inexcusable for a financial company. That kind of insecure flow is a phisher's dream.