Hacker News Reader

Comment by Arrowmaster | Hacker News Reader

Yesterday I was renewing my vehicle registration through my US states website. They offered a range of payment options using embedded options on the site. The direct bank account option had the lowest fee but when I tried it I was immediately scared of the security. They used a 3rd party bank account transfer provider that asked me what bank I used and looked like it was going to prompt me for my login info before it errored out and I moved on.

Why can't the US have sane banking standards instead of this mess where you have to agree to a new 3rd party TOS and EULA for every purchase you want to make.

View on HN

US should have sane transfers soon. The Federal Reserve developed FedNow which is instant bank transfers. It is more secure than ACH since it only does pushes and requests.

It takes time for banks to implement it. There is also conflict with Zelle that some banks developed. I don't think it is meant for buying things, but secure and fast replacement for ACH would be good enough.

What you see is a glued or patchwork to make the things work somehow with the existing state of things. Strictly speaking, a lot of banks do not offer API support and yet these third party tools are able to orchestrate a flow with is nothing less than man-in-the-middle-attack.

The change if it happens at all, across the board to streamline can only from from government mandate. The industry is always going to go for finding some low cost option to achieve the target. The private players are always going to optimize for short term gains.

When using a government website, you were intimidated by the security posture of... Plaid? (Genuine question, maybe this was some other provider but Plaid's aggregator tool is the most common place I see this pop up in real life for ACH)

I personally have _no idea_ what the security posture of plaid is. I know they're a startup and made a bit of noise a few years ago, but if I was trying to buy something and a third party app popped up saying, "hey give me total access to withdraw directly from your bank account for a sec", why on earth would I say yes to that?

It also seems to go against common security advice. "Never log into your back account if redirected by a website you sort of, but don't really trust, except sometimes its alright and it's up to you to tell the difference" is a terrible way to secure banking.

In fairness they redirect you to your bank to login, you authorize the application (which can be revoked at any time), and then they redirect you back with tokenized information. (In fact it's kind of a pain point that when I use Plaid to link my bank for eg reimbursement deposits from my FSA/HSA, it has tokenized the account numbers so I can't actually tell which account is which.) I guess I get for less savvy users why that might look scary but the alternative is... keying your account number directly into a merchant's system for ACH, which is actually scary (and the default on many government websites which I actually trust less!)

Nowadays Plaid uses OAuth for many banks, but the real problem is and always has been that they get full access to your transaction data and pass it on to their users.

If any site asks me for my bank login credentials, I run far away and start checking if I've made any security mistakes. So far Paypal is the only credentials I'll enter after a redirect.

I went back and checked. It was not Plaid but Trustly. I've never heard of either before but Trustly's name makes me want to trust it even less than Plaid. And I'm more concerned about all of my personal information such as my transaction history for the past 90 days being siphoned up by yet another commercial entity that can probably profit more from it than the transaction fee they would have collected.

Reply on news.ycombinator.com