Hacker News Reader

Comment by bubblethink | Hacker News Reader

gemini requires you to give them your bank's username and password. It's not like you are authenticating with your bank directly. It's actually quite deceptive. It'll show you something similar to your bank's login screen, but you are still on gemini's website. You are literally giving gemini your password. I'm not sure why people don't object to that. They have a roundabout wire transfer way for the initial authentication, for which they claim that they credit the wire fees. I did the roundabout wire thing, and still waiting for the credit. Support has been lackluster. gemini also forces you to use authy, as opposed to standard totp. Overall, gdax(coinbase) for me is much better than gemini.

View on HN

That's not what's happening at all. They are using a service called Plaid for bank authentication. It's used a lot of places. And you are doing ACH transfers; not bank wires.

https://plaid.com/

What they do at the end is moot. Their domain, or a third party domain, asks you to enter bank credentials. The red flag is that you are not entering your credentials in your bank's website. Most other places ask you for your account and routing number, and do ACH micro deposits, after which you confirm the deposited amount. Gemini doesn't do that. The only way to avoid that on Gemini is go the wire route, which will incur a $20-$30 charge from your bank.

it's a third party service that provides your routing numbers to gemini. they aren't storing your bank password anywhere.

Why should you need to trust a third party (payment company) of a third party (Gemini) with the plaintext password to my bank account ? Even if you trust them to not store the password long term, in the interim you are giving them access to your entire financial history. That's a pretty big privacy issue in itself.

Holy shit, it's not a plaintext password. sigh read about plaid. I linked to it.

web authentication is really not my area, but would you care to explain how this is safe ? For instance, I recognize when an app or a site is trying to use google to authenticate me, I am taken to google to authenticate. I'm not taken to the bank in this case. From https://blog.plaid.com/getting-started/, it looks like a curl request with plaintext password request made to plaid's servers.

Also from https://plaid.com/legal/longtail/, "You acknowledge that in accessing your data and information through the Service, your provider account access number(s), password(s), security question(s) and answer(s), account number(s), login information, and any other security or access information, and the actual data in your account(s) with such provider(s) such as bank and other account balances, credit card charges, debits and deposits (collectively, "Provider Account Data"), may be collected and stored in the Service."

Reply on news.ycombinator.com