Hacker News Reader

Comment by mbm | Hacker News Reader

Hear you 100%. It felt very uncomfortable for me the first time I used it, as well.

The problem is that there sort of isn't a better way right now in the US, and for now, Plaid or a Plaid-like competitor is the safest way. Eventually, it would be awesome if there were clean, open APIs, and standards around this, but for now, it's the best we have.

The alternative of course for the DIY-er is some sort of browser automation, which honestly, is what I tried first. I really wanted it to work, but it didn't - which led us to Plaid.

View on HN

> The problem is that there sort of isn't a better way right now in the US, and for now, Plaid or a Plaid-like competitor is the safest way

So then the correct thing to do is to not automate this, until there is a better way. Why would you willingly give your bank credentials to a third party just so you can get some summary emails?? It doesn’t make any sense.

It's total insanity. Can't banks detect and ban Plaid? They should suspend/cancel customers' online access as "compromised" if they detect someone other than the user using the user's credentials to log in. All the security theatrics banks put users through and they don't check for obvious credential leaks?

Just to share -- Most of the largest banks/FIs actually work directly with Plaid.

Here's a quick list of some of the major ones:

JPMorgan Chase, Bank of America, Wells Fargo, Citibank, U.S. Bank, PNC, Capital One, Truist, TD Bank, Charles Schwab, Vanguard, Marcus by Goldman Sachs, Goldman Sachs Private Wealth, Morgan Stanley, E*TRADE, USAA, M&T, RBC, American Express, Fifth Third, Citizens, KeyBank, Huntington, Ally, Discover, BMO

> TD Bank

Quite the opposite in the case of TD Bank. They sued Plaid in 2020. “The bank said in the court filings that the Plaid interface dupes consumers into believing they are entering personal information into TD Bank’s trusted platform.” (They settled in 2021 without explaining the terms of settlement.)

https://financialpost.com/news/fp-street/td-bank-files-lawsu...

And as of 2023 TD now has API integration with plaid so you don't need to give credentials to connect your account anymore

https://www.prnewswire.com/news-releases/td-bank-group-and-p...

Yes, Plaid clearly has different levels of integration with different banks.

When I connect something to Chase with Plaid it is clearly a cooperative system with an OAuth-like permission dialog, and the Chase side even mentions they're tokenizing the account numbers so Plaid can't see them.

When I connect to the little bank down the street I just get a username/password dialog. Their web banking system is so primitive I'm pretty sure Plaid is just scraping it. When they introduced 2FA, Plaid became quite flaky.

Correct. They’re incentivized to try to make it as seamless and secure as possible for the 95%, but it’s challenging to build custom integrations for thousands of institutions. Wouldn’t open standards be nice?

Hear you 100%. It's certainly not for everyone, and I respect your position.

I appreciate it, but by giving horrible companies like Plaid your business you are encouraging and normalizing poor security practices. My parents are almost 80 and use a local bank that I’m pretty sure would just be scraped by Plaid. Do you think they’re going to understand the difference between OAuth and storing their credentials? Plaid and any company like it should be shut down.

Reply on news.ycombinator.com