Hacker News Reader

Comment by irishcoffee | Hacker News Reader

My spouse was almost scammed out of 25k the other day, by a person. There is no way in fucking hell I'll let an "agent" touch my finances. That is madness.

View on HN

It's read only, we can't move money.

And I totally hear you -- we had this happen in our family as well, and it was really sad. Security is a massive priority for us, but it's always going to be a cost-benefit analysis for each person.

Happy to share more about our infra in a follow-up post.

What makes it read-only? You told the AI "don't"?

Actually, it's deterministic -- our product doesn't move money, so when the user gives us access through Plaid, we're only getting read-level permissions. We actually don't even get full account numbers.

A company working with Plaid has to request separate product "scopes" through Plaid in order to be able to move money.

I'm not that familiar with Plaid, but if it works like Yodlee, users have to hand over their credentials so there's no real security, it's just that their scraper is designed to be look not touch.

Plaid has OAuth-based access for most of the big institutions now, but yes, for smaller institutions, they do scraping. Thankfully, Plaid's been around for a while now and has a good track record. It would be a non-starter to give your credentials to a small startup directly.

the question isn't whether the user is trusting Plaid with too much access, the question is whether Plaid is trusting these apps with too much.

It's read only until they get hacked like dozens of other ai start ups are...

I seriously hope this doesn't happen by the way but yea. This is not for me.

The awesome thing is, if it's something you're interested in, you can basically set this up yourself -- a local AI model, some browser automation, and it does mostly work! It's just a pain to keep running. But it's definitely doable.

I am the kind of geek who doesn't even want a second record of their finances around. My physical bank statements even have a procedure for how long they live until being shredded.

If I were interested in this though, yea, a local LLM would be the only way.

I respect that 100%. Thanks for sharing your thoughts!

Remove spouse’s API key.

That’s where the fear is coming from - not robots.

The API key in this case was a phone call from a guy with a thick southern accent telling spouse they had a bench warrant out for their arrest, can’t hang up the phone, go to the bank right now and get the money to make this go away. No texting, no calling, we are watching you.

When spouse was standing in a liquor store in front of a bitcoin machine it finally clicked.

Reply on news.ycombinator.com