Hacker News Reader

Comment by zaksoup | Hacker News Reader

Plaid's entire ideology has always seemed back-asswards to me. As far as I can tell it boils down to

1) Ask users for their plaintext login details to financial institutions

2) Store those details unhashed because they'll be used to authenticate directly with said institutions because they're not implementing some sort of reasonable Oauth flow

3) If users have 2fa enabled and the 3rd party doesn't allow app-specific passwords ask users to disable 2fa JUST so the user can use Plaid???

It seems like the product goes against every single good practice that websites have been trying to train into their users for years i.e. `Don't type your password for abc.com unless you literally see abc.com in the URL bar`. Not to mention they masquerade as an Oauth flow with plaid.js on sites that support it.

Can somebody explain ANY way in which Plaid is a net good for users/security/etc??

View on HN

Everything you described is fundamentally a problem with banks not with Plaid.

Plaid solves the problem of people wanting to give third-parties access to their financial data. The fact that in some cases it's a kludge to work around this and not secure end-to-end (although I do think Plaid natively supports 2FA now, at least for some banks) is due to the banks not making this easy.

At the end of the day people are going to get what they want, and many many many people prefer convenience (in this case, the ability to use third-party services like Truebill, Mint, etc etc) over perfect end-to-end security.

>> At the end of the day people are going to get what they want

The end of _that_ day is when all of their credentials are leaked from a data compromise.

I would agree that most people prefer convenience to security (and that they are two opposite points on the same line), but people only learn what security means when it's too late.

> Everything you described is fundamentally a problem with banks not with Plaid.

I don't disagree, but banking is not an arena where "creative disruption" that has harmful side effects should be welcomed. The reason you can't send money from one bank to another efficiently in the US but can in the UK is purely due to regulation. Or why there isn't an Open Banking Initiative in the US but there is in the UK. Once again, regulation.

The private market isn't making the solution better in this case because their implementation is reckless and potentially harmful.

> The private market isn't making the solution better in this case because their implementation is reckless and potentially harmful.

You could make this same argument about the existence of online banking. At some point utility supercedes risk. Personally, I feel fortunate to live in a society where I am able to make that decision for myself rather than the government making it for me.

> You could make this same argument about the existence of online banking.

How so? If I'm using Wells Fargo and I find out they have a breach, I can happily switch to another bank because they're clearly being incompetent. If a software provider that I'm using uses Plaid and Plaid gets hacked, then my banking data is potentially compromised. The bank has zero control over that, so there is no impetus for me to change banks, yet it's their data that has been compromised.

> Personally, I feel fortunate to live in a society where I am able to make that decision for myself rather than the government making it for me.

For most things, yes I agree. Do you think it's any coincidence that the banks haven't adopted modern/secure API access even though their consumers demand it? That's not the definition of a free market and is at odds with "having a free choice is better than having the government do it for me".

I actually don't want to give 3rd parties access to my financial data, but I do because there is no cloudless, desktop application that provides the functionality of Mint & its friends/competitors.

Consumers want an aggregate view of all their accounts. Many lenders also need an aggregate view of all assets.

OFX (Open Financial eXchange) was designed in the late 90's to address this need.

Many banks implemented OFX, but not all.

Hence, we end up with screen scraping services like Yodlee and Plaid.

(I don't know the specifics of Plaids infra. It's possible they store revocable oauth tokens instead of passwords)

It's not a net good for security, it just gets things done and there's someone to blame if money gets stolen.

How most of the world works. The fact plaid is needed is a gigantic hack and a disgrace but it's not like US banks are any good at APIs.

Maybe in the long run by pushing said institutions to adopt reasonable oauth flows

Reply on news.ycombinator.com