Hacker News Reader

Plaid = "Give me your bank login" and it is insane. It literally undoes 30 years of computer security advice for layfolk, all for their profit margin.

OAuth exists, Plaid should not.

Always use ACH.

> Plaid = "Give me your bank login" and it is insane.

Credit card = your "password" is written on the card, and everyone thinks it's normal.

I'm sorry but you are dangerously wrong.

Not only are there enormous protections with the mis-use of one's credit card, but the 'password'/card number is randomly generated and not used elsewhere.

A regular person is quite likely to reuse their favourite password for their bank login and therefore expose most of their other services when Plaid is inevitably hacked, or more likely, when someone pretends to be Plaid with typosquatting and the user has learned that giving passwords away is OK.

> I'm sorry but you are dangerously wrong.

I think it is the other way around, sorry.

The card number is visible in plain sight. The card number is reused everywhere. Merchant employees often have access to these numbers, and have reportedly used them illegally.

Yes, there are protections, but they often apply only after the fact, which can cause lots of problems, e.g. if you're traveling and reached your card limit. Also, not everyone checks their transactions at the end of the month, so many cases of fraud may go undetected.

Given modern security methods, credit card numbers are just plain silly, and yes, they may be even dangerous.

> Not only are there enormous protections with the mis-use of one's credit card, but the 'password'/card number is randomly generated and not used elsewhere.

Not true. My mother got a free credit card that she never used and never even took out of her safe box, and a few weeks ago someone used that card to buy a Microsoft gift card. Luckily for her, she regularly checks the bank's statements.

I'm convinced there's a workaround to buy stuff using just the numbers, because that's how cards used to work a few decades ago.

Credit card really isn't a payment mechanism but rather an invoicing mechanism.

The number on your card is not a password to authorize payments - it is the account number to which merchants can send an invoice, but there's effectively no expectation that they'll receive the money if you don't agree to.

Which is why EU has mandated 2FA for online payments

https://en.m.wikipedia.org/wiki/Strong_customer_authenticati...

Credit cards severely limit liability, banks don’t.

This is why scammers want people to buy gift cards or get banking details rather than just get them to hand over credit card numbers.

Same reason I refuse to use Venmo. Yes, I know that Venmo is owned by the banks. No, that doesn't mean I'm going to type my bank account's credentials into your app.

Venmo is owned by PayPal. You were probably thinking of Zelle, a similar service owned by several banks.

Many of the banks that own Zelle have it built into their banking apps, so if you use one of those you may have Zelle access without any extra credential entering.

I am philosophically opposed to ever using Zelle.

The banks behind Zelle openly stated in Zelle's planning that one of the motivations behind it was liability shifting, away from the banks, on to consumers. Other benefits to the consumer are just to make the platform more appealing.

What kind of liability can we be talking about here?

Against fraudulent transactions.

Venmo is owned by PayPal. You're thinking of Zelle, which is owned by banks. Both are terrible.

I mainly use it with some friends to re-balance "who's paying for the meal this time", so I just offer to pay the bill when my Venmo balance gets low.

Granted, this gives Venmo a small amount of cash to theoretically make interest off-of, but to me it's worth not entangling it with the routing-numbers of any important accounts.

I use Venmo and have never entered my bank login. I just have my routing and account number.

Since when did you have to do this to use Venmo?

You don't, you can use Plaid but you can also just given them a routing and account number. https://help.venmo.com/hc/en-us/articles/221073067-Verifying...

You don't AFAIK. Mine just asked for a routing and account number.

Last time I tried was years ago. I'd love to be wrong, because checks are a pain in the ass.

A few months ago someone sent me like 5 or 10 dollars on Cash App. Imagine my great surprise upon learning that in order to transfer it to a bank account I had previously transferred money to, I now had to give my bank login details to some Plaid assholes I had never even heard of. Cash App support was 100% useless ("just follow these steps that are the exact way you're ending up with Plaid's demand for your bank login credentials!"), but I eventually found some workaround on the website or something. And that was the last time I will ever use Cash App, they and Plaid can both go die in all the fires.

Maybe I'm missing something, but in EU you can just link your debit or credit card to similar apps. Why would they need a bank account?

Unlike here in the EU, those costs are capped by the government (sending money through a card) and are nearly free (if not actually free). In the US, only slow (~1-2 day bank transfers) are free, and sending money via a card actually costs quite a bit of money (2-5% of the amount).

Also, unlike the EU, if someone has your routing number + account number, they can literally just take money out of your account without your consent (with only a 1-2 days in which you can 'stop payment' on it -- once it is complete, you can never get the money back). At least with my EU bank (Bunq), if someone were to do that, I'd have 5 days to decide whether to approve or deny the transaction.

> Now add in the lack of privacy laws, and I'd be more than willing to bet that a company like Google has some kind of profile on your entire financial life (because apparently in the US, money-in-the-bank and empty credit cards means you are trustworthy) to determine whether or not they can trust you with "the secret sauce."

Is that not illegal? That seems like something that would have been made illegal back in the company-town days. Or at least for other reasons if it's not silo'd off.

Also, IIRC not having credit card debt makes you less trustworthy in the US credit system.

Background checks are routine in the industry, and they often include a credit report. So it's not just Google, but at least all the big ones.

Wait, you could have a candidate refused because they have too much debt to repay ? That feels wild.

Pretty much a standard in Finance-related work. The thinking being that being in debt not only makes you more likely to commit fraud/theft, but also that it makes you easier to influence/corrupt/blackmail.

It would mostly be impacted not by having a large mortgage, but by having missing payments or insolvency; and that is considered to imply that the person is 'more risky' in other ways as well.

Yep, getting into a hospital bed because someone ran a red-light, with bills you'll never be able to pay back (and probably made no payments on while you were out of work) is defacto 'more risky' than someone who doesn't have infinite medical bills.

Been there, done that. Took 12 years to "fix".

Having medical bills you can't pay does sometimes motivate people to do desperate things that are not in the interests of their employer. There are exaggerated tropes in Hollywood like Breaking Bad, however, all kinds of real risks do rise if the employee has significant debts that they can't pay - issues ranging from motivation to internal fraud or being unable to focus on work because their car or house gets repossesed or even suicide - all these things are more likely if the employee has significant financial problems, and so it's in the best interests of a cynical employer to ensure that they don't hire candidates with financial problems, unless they intend to abuse their desperation to have horrible conditions since the employee can't afford to quit.

Do people really believe that? Maybe some people care about paying bills on time and will go balls-to-the-wall to make that happen. Not me, I learned to realize 'you get paid when I get paid, so fuck off.' Now, if we entered into a debt together, you know, with a contract. I always pay on time, but if you just show up saying I owe you money with the power to put it on my credit report ... fuck off.

I don't think there is actually any science behind what you (or they) are saying, but I could be wrong (I didn't find anything definitive on Google Scholar, but I might be searching for the wrong thing) -- this smells like "it's the status-quo, so why question it."

That is a big step from what I said. Google does a background check, which includes a credit report. But there is no evidence that I know of that too much debt would be a reason to be refused.

Things that can cause refusal that I know of include lying about your degree.

I understand you're not implying misuse by Google, I just have a hard time seeing what legit info a company that's supposed to pay you gets from a credit history check.

Up until now I only ever heard of this kind of check for military and national security adjacent positions, not done as a routine for generic positions.

There is a huge difference between an employer looking at your credit report and an employer reading your bank statements.

How is this story representative of the US money system?