Plaid paid people $500 for their employer payroll logins
vice.com
vice.com
While it is bad and unethical to encourage sharing credentials, I really hope we don't continue to criminalize intermediary services that act on the user's behalf. User's should be able to use whatever product and services they want. If you don't want consumer's to use third party tools then either improve your own tools or implement better security.
On the bright side it sounds like in the Power Venture's case they did a few other things to sort of 'impersonate' Facebook in order to encourage user's to use their product. So maybe things haven't escalated too far yet... the outcome of this & Plaid will certainly be interesting.
At a meta-level, using unethical as a qualifier seems like an attempt to bolster an argument without having to provide a logical argument. I think most discussions are cleaner without broaching the thorny topic of ethics. Such discussions usually devolve into ideological battles, which by HN guidelines, "trample curiosity".
If I choose to give my credentials to e.g. Mint to aggregate information for my own benefit, that's good because it was entirely my choice.
I seemed like more of a disclaimer to avoid such ideological battles and deliver a nuanced view. "I agree the practice is shady, but..."
> Plaid's behavior works against the social norms that the majority of the tech community supports; in this case it deviates from the norm of keeping login information private.
But actually after re-reading the article, everything seems perfectly fine. The number of participants was only 12 who were all related in some fashion to Plaid employees & everything was pretty well disclosed. So the updated logical argument would be:
> Plaid's actions were limited in scope such that it had little chance of undermining norms regarding account login security. The purpose behind their actions was to increase the interoperability of their software and other software which is seen as a legitimate and net-positive goal in the software community.
Yeah, and it's also the number two and three rules with bank passwords.
I sold Bitcoin for the first time a few months ago on Coinbase. Their only bank integration is via Plaid, and I did a double-take and noped the fuck out of that right away. It boggles my mind that's even a thing. Luckly I was able to get my money out via Paypal instead without too much hassle.
I really wanted to use mint, but couldn't bring myself to give away my bank password.
I resorted to writing my own tooling using puppeteer running on my machine to automatically login to my bank accounts and download the CSV exports of my transaction data for each bank. I then normalize that transaction data, and import the data into Lunch Money.
It was a pretty big hassle to write and get working reliably(ish), but I'm super happy now that it's done. Every 2-3 weeks I run the script, and 5 minutes later all of my transactions are available in Lunch Money. I have the peace of mind of knowing that I'm not exposing my banking credentials to random third parties.
I have been playing with the idea of doing something like this for a long time. But it seems like a huge job and I haven't been able to motivate myself towards it yet.
My bank even supports showing a lot of those spending stats as in Lunch Money, but it is entirely on their end and I'm not in control of it at all. I can look at the graphs and numbers in the app but I can't export or store it in any way.
If you're interested, I'd be happy to share the source with you as a starting point
Thanks!
I'd really like to see Open Banking API laws passed in the US to require banks to offer this kind of API.
Maybe Plaid has enough clout to prevent it, but other services have dropped functionality for more and more accounts over the past 2-3 years in my experience.
On rare occasion I see banks that have a revocable token. I can't remember the exact linking process, but presumably they don't get my credentials, I can specify read-only access and specify specific accounts, it need periodic renewal, and from the bank end I can see who I gave permission to and revoke access from there. This doesn't seem common and I'm not sure if all the clients support those banks (or if it's a limited "in-group").
None of this is especially novel. It's just the incentives and efforts aren't there.
Some companies like Azure use a different account name every time they bill me. I ended up having to regex the credit card transactions for that. Others have something completely nonsensical like "BS 03-6743-2266" (<- this was iTunes), or use a 3rd party processor that puts their own name in the transaction.
The real issue for me is getting itemized purchases to do categorization on. Stuff like restaurants are okay since everything is food, so I can just categorize the whole transaction. Amazon banned me and forced me to change my password while trying to grab my purchase history (and only my purchase history!). I was trying to grab it from email receipts but then I realized they don't send receipts for Subscribe & Save purchases (!).
I'd kill for something better, but for now it's this or manually enter every transaction or give up on financial responsibility.
I'm curious to check this out, do you have a GitHub repo/account?
I'll see if I can maybe make a repo by the next time there's a thread about how customer hostile banks are.
I integrate with 1pw, so I don't have to enter my credentials which is nice.
I handle all the 2FA through cli prompts, so as a user you basically need to stick around as it's running because you might get a 2FA prompt as it logs in to banks.
The worst for me has been irregular marketing or other reminder popups from some banks. The kind of thing where they put some interstitial page up once per month or so after you sign in and want you to respond in some way.
I learned that this actually was what they were doing three years ago, and promptly complained to them, and was politely ignored (“Security is very important at POLi”… “Although it does not look like your traditional internet banking screen, the POLi interface is just as secure (if not more so)”…).
I’m baffled that the banks haven’t shut POLi down since it’s fundamentally predicated on ToS breaches, this man-in-the-middle attack and training users to do catastrophically stupid things, even including undermining 2FA (“give us your username and password; oh, looks like you have 2FA enabled, give us that token too?”). I complained to my bank (NAB) at the same time, and they said of using POLi Payments that “NAB does not suggest this course of action as this will be a breach of security” and that I should talk to POLi instead, as they “are unable to put a full block on this service as customers can still authorise transactions themselves at their own risk however NAB has advised in the terms and conditions of a breach this may cause”. In other words, they’re just covering their ears and ignoring it. Yet I’m sure they could block POLi without much difficulty if they actually wanted to, since all requests will be coming from POLi servers and are sure to be easily detectable (even their usage pattern would be trivial to detect). So why don’t they want to kill off this security menace?
Perhaps the worst part of it all is that Australia Post purchased POLi Payments some years back, thereby legitimising this abomination that should be terminated with prejudice.
Seriously, how do you end up with such a major player in the payments space being predicated around lies and evasion, terms-of-service violations and security malpractice? (And they even got exempted by ASIC from holding a financial services license.)
Another silly thing about it these days is that half the reason for the MitM attack (rapid confirmation that the transaction has taken place) is no longer needed, because almost all banks in Australia now support rapid transfers and linking email addresses to bank accounts, so they could just say “transfer the money to sales@example.com.au with description 12345” and reconcile it within a minute at least as an alternative to the MitM attack.
I usually pay for airlines with my credit card, now they aren't allowed to charge as large fees as they used to. Before that, I'd used BPay instead (which I still use for a lot of bills).
It's another tax on the poor, same as advertising. No service targeting sophisticated, wealthy people would use this. But if you have someone desperate for liquidity, of course they'll hand you the keys to their kingdom.
The default mechanism to transfer cash into Carta to exercise your options was with Plaid.
Now to be fair, you also had the option to use check routing numbers to perform the transfer. But I have to imagine that most people use plaid without a second thought.
*if you log into a company system, with a company provided username and password, those credentials belong to the company
And the fact that the employee was paid, shows that the interest was in the employee's favor, not the businesses. (conflict of interest)
It's the same as if a salesperson said "I'll give you $500 to help me get into your office building, and navigate me to the payroll department's desk. I just wanna understand the layout for a meeting I want to have in a few weeks."
>Plaid told Motherboard 12 people participated in the test and that it was vetted by the company's legal counsel. Plaid added that participants' login credentials have since been deleted and that the test was only open to friends and family of existing Plaid employees.
I cannot imagine the company's I've worked for allowing a non-partner 3rd party to pay me, an individual, for access to company systems, let alone approving it even if I wasn't getting paid...
Additionally, as a Senior Manager in my org, I could not accept a payment like this as it's a conflict of interest. It's even more egregious if plaid "got approval from a higher up for $500"
[0] https://www.ctvnews.ca/business/td-bank-files-lawsuit-agains...
If you trick someone into giving your their credentials and use them, how is that not the textbook definition of unauthorized access?
Seems like this is going to wind up in court sooner rather than later.
[1] Revised Directive on Payment Services (PSD2)https://en.wikipedia.org/wiki/Payment_Services_Directive#Rev... (Revised Directive on Payment Services (PSD2))
In the US, I have to pass through so many rent seekers to move some digits over (Plaid, Stripe, and Visa/MasterCard). Meanwhile Europe has PSD2 now and China AliPay/WeChat Pay. Even India, which in the past 3 months has unfortunately proven dysfunctional has UPI, which is orders of magnitude better than what we have.
When has the US recently passed legislation or standards that fosters innovation? (this is a serious good faith question - there seems to be a lot of govt grants for stuff like basic research, but a whiff of money churns out stuff like repealing net neutrality).
The big kicker for me is Interac e-Transfers, where you simply log into your banking and can email (or text) money to anyone in the country - they click the link in the email/SMS they receive, log into their bank account, and choose where the money is deposited. We've had this system in place since at least 2014? Hell I pay my rent and buy weed just by sending e-transfers, they're treated the same as cash and happen instantly. I reminds me of something that happened recently, I stumbled into a conversation with some of my American friends trying to figure out how the one person was going to pay the other >1000 miles apart; it was absolute lunacy listening to them decide between PayPal, Cash App, Venmo, etc., trying to figure out who had the lowest fees for both parties, factoring in the time it takes for the transaction to happen and transferring to/from their bank account if necessary. It's insane to me how the banking system underlying the world's largest economy is so far behind the times.
Really, the existing autodeposit feature would be perfect if it let you log in to your online banking and confirm pending transactions before autodepositing them. For that matter it would be nice if the email gave me a string I could paste into my online banking to get to the existing confirmation page.
It's all much better than having to link your bank account to some third party or give away your credentials though.
The problem comes when banks are able to argue that their half-hearted security means they aren't liable to pay for the consequences. Consumers need protecting against that.
† In the UK we have a lot of 3-D Secure, developed by Arcot. But of course the average consumer has no idea who "Arcot" are, and so no reason why they should distinguish an arcot.com site (legitimate, you're supposed to give them credentials if necessary to authenticate you) versus say badguy.example (a hypothetical phishing fraud). Both of them can show you branded imagery from your bank, both have a padlock, both claim they're keeping you safe. How should an ordinary person know?
Similarly, we won't be able to get rid of email but if clicking a link in an email opened an app instead of a webpage, it would be a lot harder for phishing websites to pretend to be my bank. (Assuming I'm expecting a mobile app, of course. A second line of defense is that my password manager might not prompt me to fill in the password because the URL doesn't match. But even that's not foolproof.) Even better would be if Interac E-Transfer itself was an app I could sign up for, then it could send me a push notification and I could skip my inbox entirely for these sort of transactions.
Of course, the only reason I trust apps more than websites is that I went to download them previously, rather than clicking a link that just showed up in my inbox. To that end, Gmail and other email providers have immense power if they created a design which could highlight emails from senders I've seen before as "trusted" and those from unknown senders as unknown.
Things get more gray-area though when the system itself fails: You can request money from anyone using Interac E-Transfers, and that means spammers could hijack a bank account and request money from friends and relatives you've recently sent e-transfers to, for example. Those emails would then appear as "trusted" and there's not much you can do to stop that, it's the cost of making money transfer "easy".
Even now you never have to pin in the US.
CB dealt with Gemplus to add chip to all new cards emitted since 1992 so we had them for a long time. I don't know how it spread over europe, but as we had the industrial capacity to provide chip cards to everyone and a free market, I think it was easy to sell that to lots of european banks. CHIP+PIN is a really great deal for banks : it's cheap and the responsibility of all payments made with the PIN is on the card owner and are really hard (or impossible) to dispute.
I've been to stores in the US where they just swipe your magstrip and hand you back the card. No signature, no pin, they don't even look at it, so you can basically clone cards like it's still 1985.
This is consistent with how my UK bank treats any transaction occurring in the US: usually it's an instant card block and a polite phone call from them to check that it was actually me.
Sounds like the other response about transaction fees is on the right track.
It's not instant. Transfers can be delayed for hours in some cases.
It has ridiculously low limits that cannot be raised.
Until recently it had a cumbersome question and answer system with strange character limits for each.
Virtually no businesses use it. You can buy weed (illegally) using it because they can't use credit card processing.
A revamp to the Interac system is in the works which looks similar to the UK faster payments. A frankly much better system.
https://www.theglobeandmail.com/business/article-interac-cho...
By the way I blame patents for this. Patents are a legal blockade on third party innovation. But that's how progress is made! Everyone copies everyone. You see something and you make a better version. Patents gum up the works and drive things to a standstill. They don't have this problem in China. Some people think investment won't happen without IP restrictions, but I think it will, just differently. There's no more unicorns and whales, but there's a lot more fish.
I'm hopeful we'll see all countries converge onto a similar pace of innovation and progress. Large countries/regions (as a simple proxy for population and access to raw resources) will hopefully reach this parity sooner than later. At that point, I also hope that 1 country/ideology will never be able to pull far ahead of another - short of some fluke breakthrough that can be kept secret.
Imagine two nations. A wealthy nation that used to innovate but has completely stopped innovation. It could continue to make advanced things using existing infrastructure and people, but could not improve beyond its current state. (This is the extreme, for illustration).
Then imagine a larger poorer nation that is rapidly advancing. Even before the poorer nation has surpassed the other in technological capabilities, it would be producing more total innovation per year. Growing requires lots of innovation. Stagnating... not so much.
So I am suggesting that the rate of innovation could be slowing in the US, and the rate of innovation could be higher in China. Even if absolute output is more advanced in the US, which would be a different metric. But the rate of innovation is important for projecting where each nation will be in the future, and I do believe intellectual property restrictions slow the rate of innovation.
what exactly does this mean? Other countries did not have a corona virus wave?
> what exactly does this mean?
That our response to the current wave has been tragic.
> Other countries did not have a corona virus wave?
Yes they did. However, we had the opportunity to learn from the tragic things that happened elsewhere and could have done stuff to prevent it/soften the blow but we didn't. The problem is not that we "allowed" another wave to happen, but that we allowed people to die due to a lack of oxygen and ICU beds.
If you take UPI, for instance, it's a fairly robust standard that has been developed by a non-governmental body that has been ruined by the regulator insisting that banks charge 0 transaction fees even for individuals that do a large number of transactions. This is because the regulator believes even a small fee will hamper adoption. This results in a relatively high failure rate because banks refuse to invest in servers and technologies that can handle the huge volume of transactions.
I am happy that technological standards are largely untouched by the government.
And almost nobody would ever use one at a retail store or restaurant or food truck, if anything they’re only used for sending large sums of money to small businesses who want to avoid the 3% card processing fee. It’s still bad that this fee is so high on our primary payment rails, but it’s not as ridiculous as people in this thread are making it sound.
When I opened my US bank account they asked me how many cheques I wanted "to get started". I said none. Like why would I ever use one for anything? I don't use a quill pen either.
I still have a UK checkbook, but haven't written a cheque in a decade.
There's lots of good examples of regulated open banking. Europe has PDS2. Australia has Consumer Data Right Act. Several other countries that are now implementing open banking legislation: Brazil, Japan, Saudi Arabia, Mexico, Singapore, Hong Kong, India.
It would be great to see US on that list some day.
Having an act, and being able to use it any useful manner are two very different things.
From my understanding, banks are required to provide an API. Not a specific one - any API. Which means each bank has a different one and you need yet another rent seeker that aggregates those APIs.
That's on top of requiring specific, often outdated security mechanisms, so now every time I want to pay something with a credit card I have to do extra authentication, >1 GB of my phone's memory is filled just with bank auth apps (again, each bank has their own).
If anyone can implement such an aggregator, market competition should drive the cost of that close to zero soon enough.
If you'd like to use the API to access your own account using open source software, good luck (unless you find an aggregator that is certified and allows you to access your own account through them).
Defining this is a job for industry bodies and suchlike, as is keeping it current. Lest we forget jokes like the 2020 Brexit agreement containing references to Netscape Navigator 4.0
If anything is going to kill the US it will be something like the collapse of fair elections or the huge ballooning healthcare and education costs, not the payment rails.
If you think about it, the payments system is a 2+% sales tax! Levied by private corporations! I don't even have an alternative since by contract with Visa/MC stores can't provide a lower price for paying cash.
This hasnt been true for over a decade. Cash discounts are allowed by the Durbin amendment.
See: https://www.law.cornell.edu/uscode/text/15/1693o-2 (b)(2)(A)
There are a lot of small businesses around me that are cash only under $10/15 dollars. Given human psychology around advertised prices (i.e. most people don't think about opportunity cost), I'm not surprised cash discounts aren't common.
Their motive may be different but their actions just help make this sort of behaviour on the vulnerable (ie. non technically/security literate) easier to repeat by the more unscrupulous.
What a useless statement. That could mean anything.