Hacker News Reader

Comment by dawhizkid | Hacker News Reader

Said it once before: do not link your bank account on RH with Plaid (i.e. bank login). Plaid is the API they use that includes access to your account balance and entire transaction history! (https://plaid.com/products/transactions/)

RH Privacy Policy: https://d2ue93q3u507c2.cloudfront.net/assets/robinhood/legal...

View on HN

Hey! Co-founder of Plaid (plaid.com) here. RH does not pull your transaction history, RH is only using Plaid to authenticate your ACH accounts to make sure your actually the owner of the account and so you don't get over-drafted. They're using our auth and balance product, feel free to check out what information we return on our docs (http://plaid.com/docs).

Nitpick: you’re → your.

But they could potentially use you for more and users don't have insight into whether or not they do or if it will change.

Agreed there is no transparency around which endpoints are being used. There needs to be a screen that shows what data you’re providing like FB or Google login before you link anything.

Even the account balance is information they would not normally have and something most people consider personal and private.

I don't see what's specific to Plaid here. When you give your bank login information, that means they can see whatever is accessible via that login. You should always expect this no matter whom you're giving your login information to, or why.

Obviously if you are using a Mint-like application where it's clear you are sharing your transaction history then it should be expected, but on RH there is no obvious utility to sharing transaction data when linking a bank account only serves to transfer money in and out of a brokerage account.

As far as I can tell, a single Plaid token enables a developer to "turn on" any endpoint they offer without consent from the user, so even if RH does not pull transaction history now (I would like confirmation from them directly) they've obviously written their PP in a way that lets them flip a switch anytime they want without anyone knowing.

Plaid is an interesting company from a developer POV, but it's clear to me they've taken the early FB approach to their API and have extremely little control or visibility into what developers are doing with the data. They also do not show a confirmation screen with the data elements they're asking for from the customer before confirmation.

I hope they get their act together before we see them in the news because someone bought Plaid transaction data from millions of customers to target ads for the 2020 election. Purchase history on millions of voters would be incredibly powerful (even more so than likes IMO) as far as targeting goes.

Anybody worried about this should probably just open a checking account specifically for uses like this. We tend to talk about "your checking" account, as though you can only have one and it's somehow your official account. But, despite these weird notions we seem to have about them, checking accounts are just like any other consumer product.

You can have as many as you want with as many banks as you want; they've very easy to open online.

This shouldn't be a significant barrier for anybody on this forum.

Wow! I didn't realize that! Thanks for telling me. Very unfortunate given how much I value the service :(

that is scary!

Reply on news.ycombinator.com