But Mint works the same way, doesn't it?
The CTO/CEO wanted to add a feature that lets users enter their bank password and through a service (Yodlee/TradeIt) lets the company read their stock portfolio and perform actions.
I told them that I don't think people would trust their bank info to some small fintech startup. Boy was I wrong and people with 4M dollar stock trading accounts would enter their credentials all the time for convenience of not having to copy the data over (since brokers didn't have an API with tokens).
Eventually the company grew and it's pretty reputable on its own but I remember this pretty vividly the surprise of people trusting all their money to us.
It's not really that people trust you that much, it is more that they in the moment you ask don't understand the consequences at all.
Unless you very explicitly tell the users about the risks, that they wold have zero recourse if something goes wrong, they will believe it is okay for them, that somehow everything is taken care of.
Very similar to the why people fall for con men. Nobody expects someone to have the audacity to lie so grandly, act so confidently, while in truth being completely 'naked'.
You tend to assume that the insanity must have a point, that the obvious loopholes must somehow be covered - taken care of - based on nothing but the fact that someone acted with confidence.
After a bit of consideration I went ahead and did it—I consider Google trustworthy as far as security practices, and to be honest, I didn't expect it to work. Chase forces (!) two step authentication despite my very strong password, and I thought that would prevent Google from logging in.
To my surprise, the process appears to have worked fine—my bank account was verified. I also didn't get a "new sign in from" email from Chase. So I wonder if they actually logged in or did something else...
Sure you do. They have it in plaintext on their servers. It can end up in logs. It's also not just Plaid - Mint uses Intuit, Yodlee is an option. There's a whole lot of people you need to trust to use these services
For many banks, it also means you need to disable 2fa on your banking account, so using these services directly weakens your security.
Providing any company my banking or email account login password sounds like a really bad idea. And something I'm not willing to provide.
Facebook already has a messenger, so they definitely don't need access to my emails.