5 ms·

If you think this one is bad: look at Plaid, which literally phishes users bank credentials as "fintech".

by cmeacham98 4y ago

anamexis 4y ago
“Phishing” implies fraudulent deception.
- buildbuildbuild 4y ago
  I think their growth numbers would have looked much differently if they had transparently disclosed the reality on their login form from day one: “Plaid will store your plaintext password and use it to periodically access your bank account.” Burying truth deep in a TOS is seen by some as deceptive.
  - jefftk 4y ago
    I doubt this would have affected signups that much: most people interested in their service don't care much. (Though instead of "access", which could imply "take money out" to some people, they'd probably use a more descriptive term)
  - PainfullyNormal 4y ago
    > “Plaid will store your plaintext password and use it to periodically access your bank account.” That's terrifying. I'm looking into privacy.com as an alternative to using my real debit card number online because it gets stolen at least once a year. Having my bank account itself compromised does not sound like an improvement. Then again, how often do banks get hacked and have their credentials compromised? At least as often.
  - dawnerd 4y ago
    I believe plaid has oauth integration with the larger banks now. I remember using it with chase and chase showing me an auth and permission approval request screen.
  - 2Gkashmiri 4y ago
    why can't banks have oath like authentication so this BS doesnt happen?
    - twelve40 4y ago
      because there are close to 20000 of them in the US, and while chase has the resources to do oauth properly, not every junky credit union can afford that
      - jrochkind1 4y ago
        Few/no small credit unions (or banks) have their own bespoke online portal they developed just for them. They use a vendor. I bet a few vendors would cover a pretty large % of those 20K banks.
        twelve40 4y ago
        what's in it for them anyway?
        jrochkind1 4y ago
        I don't know, what's in it for the big banks either? Probably the same thing as what's in it for smaller banks and their vendors? Apparently nothing, or not enough? Unless customers are going to use the feature to choose their bank? Or it saves the bank money from avoiding fraud? Maybe one or the other will be so eventually. When it is, the vendors/platforms that "junky credit unions" use will add it, same thing as when big banks will add it. A vendor that small banks and credit unions use for their online platform probably has the same order of magnitude of aggregate consumer customers as a big bank has, I don't see why it wouldn't be about as do-able for one of those vendors as a big bank.
- cmeacham98 4y ago
  I believe they've improved it now, but their login page literally used to say "Plaid" nowhere, and at least for my bank (Bank of America) looked almost identical to the official login. Here's an example: https://d1hzvs60s6jsjg.cloudfront.net/IMAGES-1/208624076/plaid3.png https://d1hzvs60s6jsjg.cloudfront.net/IMAGES-1/208624076/pla... Does this look like it's going to be shipping your credentials off to be stored by a third party?
edgineer 4y ago
Last I checked, privacy.com uses Plaid, too. When privacy.com had asked me to use Plaid to add a payment method, Plaid's privacy policy talked of gathering transaction information and using it for advertising among other things. I think Plaid's stance was that if the host service (the one asking you to use Plaid) wanted to be invasive then it's up to them, or if this host would be upstanding and maintain your privacy, that could happen, too. It was up to the customer to check their policies. But this limitation was not spelled out nor promised that I could see. Their policy may have changed since then.
junon 4y ago
"Phishing" does not mean what you think it means. Blame the banks for Plaid's need to exist.
- cmeacham98 4y ago
  Phishing generally means "pretend to be X to get user's info/credentials for X", do you have a different definition?
  - junon 4y ago
    Phishing is typically tricking an individual into divulging sensitive information. Credential stealing is typical, but still a subset. Plaid uses banking credentials on a user's behalf. Yes, it's similar to using stolen credentials because... it's the same thing, except consent, audits, insurance, etc. all play a role whereas with criminal activity they do not.
    - cmeacham98 4y ago
      This seems to be some weird semantic angle where because Plaid is audited that makes what they're doing not phishing? I'm not sure I agree with that definition or that it is particularly common. That said, if it makes you feel better, pretend my comment read "Plaid pretends to be the users' banks in order to trick users into giving Plaid their bank credentials and stores those credentials without their knowledge or consent".
      - junon 4y ago
        That is the definition of phishing. This is why "vishing" is "voice phishing", etc. Phishing is stealing information. It's not a "semantic angle" - it's the definition of phishing. You're free to consulting a dictionary to fact check me. Plaid is not phishing, by any true definition of the word.
        cmeacham98 4y ago

If you think this one is bad: look at Plaid, which literally phishes users bank credentials as "fintech".

anamexis 4y ago

“Phishing” implies fraudulent deception.

buildbuildbuild 4y ago
I think their growth numbers would have looked much differently if they had transparently disclosed the reality on their login form from day one: “Plaid will store your plaintext password and use it to periodically access your bank account.” Burying truth deep in a TOS is seen by some as deceptive.
- jefftk 4y ago
  I doubt this would have affected signups that much: most people interested in their service don't care much. (Though instead of "access", which could imply "take money out" to some people, they'd probably use a more descriptive term)
- PainfullyNormal 4y ago
  > “Plaid will store your plaintext password and use it to periodically access your bank account.” That's terrifying. I'm looking into privacy.com as an alternative to using my real debit card number online because it gets stolen at least once a year. Having my bank account itself compromised does not sound like an improvement. Then again, how often do banks get hacked and have their credentials compromised? At least as often.
- dawnerd 4y ago
  I believe plaid has oauth integration with the larger banks now. I remember using it with chase and chase showing me an auth and permission approval request screen.
- 2Gkashmiri 4y ago
  why can't banks have oath like authentication so this BS doesnt happen?
  - twelve40 4y ago
    because there are close to 20000 of them in the US, and while chase has the resources to do oauth properly, not every junky credit union can afford that
    - jrochkind1 4y ago
      Few/no small credit unions (or banks) have their own bespoke online portal they developed just for them. They use a vendor. I bet a few vendors would cover a pretty large % of those 20K banks.
      - twelve40 4y ago
        what's in it for them anyway?
        jrochkind1 4y ago
        I don't know, what's in it for the big banks either? Probably the same thing as what's in it for smaller banks and their vendors? Apparently nothing, or not enough? Unless customers are going to use the feature to choose their bank? Or it saves the bank money from avoiding fraud? Maybe one or the other will be so eventually. When it is, the vendors/platforms that "junky credit unions" use will add it, same thing as when big banks will add it. A vendor that small banks and credit unions use for their online platform probably has the same order of magnitude of aggregate consumer customers as a big bank has, I don't see why it wouldn't be about as do-able for one of those vendors as a big bank.
cmeacham98 4y ago
I believe they've improved it now, but their login page literally used to say "Plaid" nowhere, and at least for my bank (Bank of America) looked almost identical to the official login. Here's an example: https://d1hzvs60s6jsjg.cloudfront.net/IMAGES-1/208624076/plaid3.png https://d1hzvs60s6jsjg.cloudfront.net/IMAGES-1/208624076/pla... Does this look like it's going to be shipping your credentials off to be stored by a third party?

edgineer 4y ago

Last I checked, privacy.com uses Plaid, too. When privacy.com had asked me to use Plaid to add a payment method, Plaid's privacy policy talked of gathering transaction information and using it for advertising among other things. I think Plaid's stance was that if the host service (the one asking you to use Plaid) wanted to be invasive then it's up to them, or if this host would be upstanding and maintain your privacy, that could happen, too. It was up to the customer to check their policies. But this limitation was not spelled out nor promised that I could see. Their policy may have changed since then.

junon 4y ago

"Phishing" does not mean what you think it means. Blame the banks for Plaid's need to exist.

cmeacham98 4y ago
Phishing generally means "pretend to be X to get user's info/credentials for X", do you have a different definition?
- junon 4y ago
  Phishing is typically tricking an individual into divulging sensitive information. Credential stealing is typical, but still a subset. Plaid uses banking credentials on a user's behalf. Yes, it's similar to using stolen credentials because... it's the same thing, except consent, audits, insurance, etc. all play a role whereas with criminal activity they do not.
  - cmeacham98 4y ago
    This seems to be some weird semantic angle where because Plaid is audited that makes what they're doing not phishing? I'm not sure I agree with that definition or that it is particularly common. That said, if it makes you feel better, pretend my comment read "Plaid pretends to be the users' banks in order to trick users into giving Plaid their bank credentials and stores those credentials without their knowledge or consent".
    - junon 4y ago
      That is the definition of phishing. This is why "vishing" is "voice phishing", etc. Phishing is stealing information. It's not a "semantic angle" - it's the definition of phishing. You're free to consulting a dictionary to fact check me. Plaid is not phishing, by any true definition of the word.
      - cmeacham98 4y ago