Hacker News Reader

Comment by teeray | Hacker News Reader

So does this mean we can finally have APIs for personal financial software without resorting to the ickiness of putting credentials in Plaid?

View on HN

Giving a third party your banking credentials is not just icky, it probably violates your online banking terms of service, and is obviously terrible for security. This practice really needs to die yesterday.

Of course it violates the terms of service written by your bank.

Your bank would make it illegal to even talk about your banking transactions with anyone other than your bank if they could.

at the same time, the banks are happy they don't have to spend the money to develop those APIs themselves.

Actually… not as much as you think. Go read Wells Fargo’s policies.

The gist of it: if you give it to someone, that’s on you.

It's not on you though. Banks have Reg E obligations that cannot be waived by contract.

I wasn't talking about Regulation E. My point was that banks like Wells Fargo have effectively "allowed" companies like Plaid and MX to log in using user credentials .

I’ve been happy to see more and more of the banking-related services that I use stop requiring that and give each other actual API access.

I absolutely refuse to hand over my credentials and cannot wait for the practice to die.

The fact that plaid was allowed to exist and grow into a monster tells a lot about incompetence/impotence of the regulators.

What would actually happen if Plaid or the like was hacked? Would people lose money or would they be able to reverse it all?

Probably “thoughts and prayers” from a heartfelt apology written by their CEO who “takes full responsibility,” and free identity theft monitoring for a year.

It doesn't matter if it violates your bank's terms of service, it's not an enforceable term. For example, banks cannot refuse to pay out if you were a victim of fraud because you gave your credentials to an aggregator (regardless of whether or not the fraud was related). The EFTA has anti-waiver provisions that state a bank's Reg E obligation to make customers whole after unauthorized transactions cannot be waived by contract.

Reply on news.ycombinator.com