3 ms·
It's read only, we can't move money. And I totally hear you -- we had this happen in our family as well, and it was really sad. Security is a massive priority
by mbm 6mo ago
It's read only, we can't move money.
And I totally hear you -- we had this happen in our family as well, and it was really sad. Security is a massive priority for us, but it's always going to be a cost-benefit analysis for each person.
Happy to share more about our infra in a follow-up post.
- ForHackernews 6mo agoWhat makes it read-only? You told the AI "don't"?
- mbm 6mo agoActually, it's deterministic -- our product doesn't move money, so when the user gives us access through Plaid, we're only getting read-level permissions. We actually don't even get full account numbers. A company working with Plaid has to request separate product "scopes" through Plaid in order to be able to move money.
- ForHackernews 6mo agoI'm not that familiar with Plaid, but if it works like Yodlee, users have to hand over their credentials so there's no real security, it's just that their scraper is designed to be look not touch.
- mbm 6mo agoPlaid has OAuth-based access for most of the big institutions now, but yes, for smaller institutions, they do scraping. Thankfully, Plaid's been around for a while now and has a good track record. It would be a non-starter to give your credentials to a small startup directly.
- fsckboy 6mo agothe question isn't whether the user is trusting Plaid with too much access, the question is whether Plaid is trusting these apps with too much.
- 2ndorderthought 6mo agoIt's read only until they get hacked like dozens of other ai start ups are... I seriously hope this doesn't happen by the way but yea. This is not for me.
- mbm 6mo agoThe awesome thing is, if it's something you're interested in, you can basically set this up yourself -- a local AI model, some browser automation, and it does mostly work! It's just a pain to keep running. But it's definitely doable.
- 2ndorderthought 6mo agoI am the kind of geek who doesn't even want a second record of their finances around. My physical bank statements even have a procedure for how long they live until being shredded. If I were interested in this though, yea, a local LLM would be the only way.
- mbm 6mo agoI respect that 100%. Thanks for sharing your thoughts!
- 2ndorderthought 6mo ago<3
- deleted 6mo ago[deleted]