Comment by reificator | Hacker News Reader

Comment by reificator | Hacker News Reader

> Credentials are stored in lib/credentials.json. This is checked into the repo, so USE A PRIVATE REPO. Do not use a public fork and accidentally push your tokens to it! I will not take responsibility for any potential leak of sensitive information.

It seems like using your CI provider to manage the credentials would be significantly more safe than checking them into even a private repository. For instance, there are several services that will scan or otherwise access your private repos for some purpose or another, and you wouldn't want to accidentally connect them while this is also in the mix.

A pre build step that templates the credentials into a file would be pretty easy to set up in most CI systems I've used, but I have no experience in CircleCI. (maybe 10 minutes of tinkering but that's it)

Finally I should note, I am not advising anyone to store their financial credentials with any third party. But if you've already made up your mind to do so, at least consider one that's meant to handle secrets in a secure manner.

It looks like the credentials in credentials.json are your Plaid access key/secret/etc, not your bank account username/password. If an attacker gets them, they'd have read-only access to your bank account until you rotate your Plaid creds, but they wouldn't be able to do anything as simple as logging into your bank account and transferring all your money out.

EDIT: It's actually worse than that, see comment from erichurkman below.

Thanks for the clarification, that's a little better.

Still...

EDIT: See the other response to this comment by erichurkman, this is still a potential vector for unauthorized payments, transfers, and withdrawals.

Careful, because Plaid also gives you access to your account's routing and account numbers [0]. I'm not sure if the way this library works gives access to those, but with a routing & account number a thief _can_ write checks, debit your account, etc.

[0] https://plaid.com/products/auth/

Yeah, good point - I figured Auth wouldn't be enabled on a free developer account, but it looks like it actually is these days: https://plaid.com/pricing.

Are routing and account numbers considered “secret”? Potentially any one of the handful of people I still write checks to could be unscrupulous and write checks, debit my account, etc., right?

Correct; that's why Knuth started issuing fake checks instead of real checks for people that found mistakes in his works: https://en.wikipedia.org/wiki/Knuth_reward_check

So he started committing a felony? That doesn't seem like a great idea, interstate bank fraud gets you investigated really quickly.

More background: https://www-cs-faculty.stanford.edu/~knuth/news08.html

Current account 'balances' for people he no longer wrote personal checks to: https://www-cs-faculty.stanford.edu/~knuth/boss.html

I must be missing something but making fake checks, with fake banking information is a felony. What am I missing? The links don't explain how this criminal.

Yes! That’s why I recently had to go through the annoyance of changing checking accounts when someone stole the mail of one of the few vendors I still send checks to. Actually, I would have taken the risk, but my bank would not.

Reply on news.ycombinator.com