3 ms·

I thought it was somewhat funny that all of the points highlighted in the "Attack #1: Big Head's credentials are exposed" section are exactly how Plaid works.

• Spivak 2y ago
  Yep, Plaid is put in a rough position of having to make something work across a bunch of financial institutions that can't or won't enable applications to have secure access. Plaid's existence and popularity is the canary that banks are way behind on features that users want.
  • tcoff91 2y ago
    most banks do actually support oauth now. Plaid mostly uses OAuth now.
    • bpicolo 2y ago
      "Most" is a strong phrase. Some financial institutions are taking it the opposite direction, like Fidelity which only allows a completely different partner now (Akoya).
• mooreds 2y ago
  This is why I avoid plaid at all costs. Hopefully FAPI and some of the banking open standards will (eventually) help with this.
• tomjakubowski 2y ago
  Not true anymore, at least for some banks. On connecting to Plaid, Chase provides an oauth flow, and Plaid never sees your credentials. Plaid announced this level of integration with Chase in 2018. Unsure when it was implemented. https://plaid.com/blog/chase/ https://plaid.com/blog/chase/
• apitman 2y ago
  Mint was the same way back in the day. I think Chase still doesn't support hardware tokens or authenticator apps. It's insane that banks are somehow the furthest behind in many security best practices.
• ycombinatrix 2y ago
  move fast and break things
• arianvanp 2y ago
  There is even a whole extension of oauth optimised for banking. https://oauth.net/fapi/ https://oauth.net/fapi/ Perhaps US needs a PSD-2 like regulation to force innovation on this front?