This is a bit unfair, isn't it? Not in the sense that these practices arent awful and inexcusable from a security standpoint, but in the sense that plaid isn't doing anything that isn't standard practice in the finance industry. Every 3rd party tool that does something with your finances (mint, personal capital, ynab, and even online banks that pull info from other banks) require you to submit login credentials in this manner. The industry needs changing - and really some rather punitive regulation IMHO - but this isn't a Plaid specific problem per se.