3 ms·
Hear you 100%. It felt very uncomfortable for me the first time I used it, as well. The problem is that there sort of isn't a better way right now in the US, a
by mbm 6mo ago
Hear you 100%. It felt very uncomfortable for me the first time I used it, as well.
The problem is that there sort of isn't a better way right now in the US, and for now, Plaid or a Plaid-like competitor is the safest way. Eventually, it would be awesome if there were clean, open APIs, and standards around this, but for now, it's the best we have.
The alternative of course for the DIY-er is some sort of browser automation, which honestly, is what I tried first. I really wanted it to work, but it didn't - which led us to Plaid.
- angoragoats 6mo ago> The problem is that there sort of isn't a better way right now in the US, and for now, Plaid or a Plaid-like competitor is the safest way So then the correct thing to do is to not automate this, until there is a better way. Why would you willingly give your bank credentials to a third party just so you can get some summary emails?? It doesn’t make any sense.
- mbm 6mo agoHear you 100%. It's certainly not for everyone, and I respect your position.
- angoragoats 6mo agoI appreciate it, but by giving horrible companies like Plaid your business you are encouraging and normalizing poor security practices. My parents are almost 80 and use a local bank that I’m pretty sure would just be scraped by Plaid. Do you think they’re going to understand the difference between OAuth and storing their credentials? Plaid and any company like it should be shut down.
- ryandrake 6mo agoIt's total insanity. Can't banks detect and ban Plaid? They should suspend/cancel customers' online access as "compromised" if they detect someone other than the user using the user's credentials to log in. All the security theatrics banks put users through and they don't check for obvious credential leaks?
- mbm 6mo agoJust to share -- Most of the largest banks/FIs actually work directly with Plaid. Here's a quick list of some of the major ones: JPMorgan Chase, Bank of America, Wells Fargo, Citibank, U.S. Bank, PNC, Capital One, Truist, TD Bank, Charles Schwab, Vanguard, Marcus by Goldman Sachs, Goldman Sachs Private Wealth, Morgan Stanley, E*TRADE, USAA, M&T, RBC, American Express, Fifth Third, Citizens, KeyBank, Huntington, Ally, Discover, BMO
- cantrevealname 6mo ago> TD Bank Quite the opposite in the case of TD Bank. They sued Plaid in 2020. “The bank said in the court filings that the Plaid interface dupes consumers into believing they are entering personal information into TD Bank’s trusted platform.” (They settled in 2021 without explaining the terms of settlement.) https://financialpost.com/news/fp-street/td-bank-files-lawsuit-against-plaid-accusing-it-of-trying-to-dupe-consumers https://financialpost.com/news/fp-street/td-bank-files-lawsu...
- Bjartr 6mo agoAnd as of 2023 TD now has API integration with plaid so you don't need to give credentials to connect your account anymore https://www.prnewswire.com/news-releases/td-bank-group-and-plaid-enter-into-north-american-data-access-agreement-302015904.html https://www.prnewswire.com/news-releases/td-bank-group-and-p...
- wrs 6mo agoYes, Plaid clearly has different levels of integration with different banks. When I connect something to Chase with Plaid it is clearly a cooperative system with an OAuth-like permission dialog, and the Chase side even mentions they're tokenizing the account numbers so Plaid can't see them. When I connect to the little bank down the street I just get a username/password dialog. Their web banking system is so primitive I'm pretty sure Plaid is just scraping it. When they introduced 2FA, Plaid became quite flaky.
- 5mo ago