10 ms·

So does this mean we can finally have APIs for personal financial software without resorting to the ickiness of putting credentials in Plaid?

by teeray 2y ago

ryandrake 2y ago
Giving a third party your banking credentials is not just icky, it probably violates your online banking terms of service, and is obviously terrible for security. This practice really needs to die yesterday.
- hollerith 2y ago
  Of course it violates the terms of service written by your bank. Your bank would make it illegal to even talk about your banking transactions with anyone other than your bank if they could.
  - dylan604 2y ago
    at the same time, the banks are happy they don't have to spend the money to develop those APIs themselves.
  - _boffin_ 2y ago
    Actually… not as much as you think. Go read Wells Fargo’s policies. The gist of it: if you give it to someone, that’s on you.
    - sjtgraham 2y ago
      It's not on you though. Banks have Reg E obligations that cannot be waived by contract.
      - _boffin_ 2y ago
        I wasn't talking about Regulation E. My point was that banks like Wells Fargo have effectively "allowed" companies like Plaid and MX to log in using user credentials .
- sq_ 2y ago
  I’ve been happy to see more and more of the banking-related services that I use stop requiring that and give each other actual API access. I absolutely refuse to hand over my credentials and cannot wait for the practice to die.
- Aspos 2y ago
  The fact that plaid was allowed to exist and grow into a monster tells a lot about incompetence/impotence of the regulators.
- eternityforest 2y ago
  What would actually happen if Plaid or the like was hacked? Would people lose money or would they be able to reverse it all?
  - deleted 2y ago
    [deleted]
  - teeray 2y ago
    Probably “thoughts and prayers” from a heartfelt apology written by their CEO who “takes full responsibility,” and free identity theft monitoring for a year.
- sjtgraham 2y ago
  It doesn't matter if it violates your bank's terms of service, it's not an enforceable term. For example, banks cannot refuse to pay out if you were a victim of fraud because you gave your credentials to an aggregator (regardless of whether or not the fraud was related). The EFTA has anti-waiver provisions that state a bank's Reg E obligation to make customers whole after unauthorized transactions cannot be waived by contract.

So does this mean we can finally have APIs for personal financial software without resorting to the ickiness of putting credentials in Plaid?

by teeray 2y ago

So does this mean we can finally have APIs for personal financial software without resorting to the ickiness of putting credentials in Plaid?

ryandrake 2y ago

Giving a third party your banking credentials is not just icky, it probably violates your online banking terms of service, and is obviously terrible for security. This practice really needs to die yesterday.

hollerith 2y ago
Of course it violates the terms of service written by your bank. Your bank would make it illegal to even talk about your banking transactions with anyone other than your bank if they could.
- dylan604 2y ago
  at the same time, the banks are happy they don't have to spend the money to develop those APIs themselves.
- _boffin_ 2y ago
  Actually… not as much as you think. Go read Wells Fargo’s policies. The gist of it: if you give it to someone, that’s on you.
  - sjtgraham 2y ago
    It's not on you though. Banks have Reg E obligations that cannot be waived by contract.
    - _boffin_ 2y ago
      I wasn't talking about Regulation E. My point was that banks like Wells Fargo have effectively "allowed" companies like Plaid and MX to log in using user credentials .
sq_ 2y ago
I’ve been happy to see more and more of the banking-related services that I use stop requiring that and give each other actual API access. I absolutely refuse to hand over my credentials and cannot wait for the practice to die.
Aspos 2y ago
The fact that plaid was allowed to exist and grow into a monster tells a lot about incompetence/impotence of the regulators.
eternityforest 2y ago
What would actually happen if Plaid or the like was hacked? Would people lose money or would they be able to reverse it all?
- deleted 2y ago
  [deleted]
- teeray 2y ago
  Probably “thoughts and prayers” from a heartfelt apology written by their CEO who “takes full responsibility,” and free identity theft monitoring for a year.
sjtgraham 2y ago
It doesn't matter if it violates your bank's terms of service, it's not an enforceable term. For example, banks cannot refuse to pay out if you were a victim of fraud because you gave your credentials to an aggregator (regardless of whether or not the fraud was related). The EFTA has anti-waiver provisions that state a bank's Reg E obligation to make customers whole after unauthorized transactions cannot be waived by contract.