I’ve never understood Plaid.
Given what they do, they can’t possibly encrypt the credentials they’re given, let alone hash them, can they?
And considering how most banks are set up, we are talking about the user’s only set of credentials. Which have the user’s permissions.
Then there are all these fintech startups saying that they’re secure because they use Plaid to access all your financial life, all to provide you with centralised analytics or supposed financial advice.
Sure it’s probably (one can hope) more secure than every single one of them rolling out their own hacked together equivalent. But still.
If your bank doesn't use something like OAuth they do store your login credentials. If your bank does use OAuth or similar Plaid still has to store the access token, which hopefully your bank has given a read-only scope.
They can definitely encrypt the credentials, they just also have to make it simple for their backend to decrypt it when they need access to your bank, which defeats a lot of the security there. (It's still better than just storing it in plaintext).
> In other cases, when you link a financial institution to an app via Plaid, you provide your login credentials to us. We store those credentials and use them to collect the data to power the services you’ve chosen and, when requested, securely share it with the app you’re using and establish a secure connection that you control. We then help keep your data safe and private with best-in-class encryption protocols.
If you have 2 factor enabled for each login you get told your account settings are incompatible with Plaid and have to disable 2fah. If it's only enabled for first time logins on a new browser/client Plaid ask you for the code.
I don't know for sure how they do it, but it must just be a thousand custom forms and browser automations for each bank they support. And have to be updated whenever the bank updates.
From my understanding in recent years Mint uses a lot more of the Quicken/QuickBooks semi-formal APIs when formal APIs don't exist. My understanding is that is one of the few, biggest benefits of Mint being bought by Intuit because that 200-pound gorilla has always had a surprising number of special read only APIs and export dump tools from even the quirkiest, smallest banks because of how ubiquitous their tax software is (and how many users would rebel if they didn't have easy access in Quicken or QuickBooks).
This is one of my (numerous) top complaints about Plaid. From the start they’ve been more about working against than working with banks, and that’s sort of obvious still today.
My credit union doesn’t give a flying fuck about Plaid and it’s a constant cat and mouse game that amuses me to watch. My credit union doesn’t have a path to online banking without per-session MFA.
I think banks should be required to provide a user-opt-in OAuth API for read-only access, but not so that companies like Plaid can pilfer your data.
> From the start they’ve been more about working against than working with banks...
At the very beginning sure, but very quickly Plaid built out a team to try and work with banks. Banks were the biggest roadblock to OAuth, most banks have (had) zero appetite to provide a good experience for users to delegate programmatic access to their own user data. Banks see user financial data as their own and _not_ belonging to their users (as it legally does).
However Plaid has made in-roads at many large institutions, and now supports OAuth, or OAuth-like, access at all (nearly all?) major US financial institutions.
Plaid never liked working against banks, that just made everything worse for everybody involved.
> My credit union doesn’t have a path to online banking without per-session MFA.
This obviously kills async products at Plaid, like continuous transaction data, but doesn't block sync products like Auth (account and routing data).
In fact, Plaid made a huge push to increase the amount of MFA encountered on their platform. When banks or credit unions didn't offer MFA, or didn't allow users to enforce MFA on every login, Plaid would attempt to force it through a variety of mechanisms to ensure a bad actor would encounter MFA on Plaid even if the bank would otherwise let them through their actual website.
And considering how most banks are set up, we are talking about the user’s only set of credentials. Which have the user’s permissions.
Then there are all these fintech startups saying that they’re secure because they use Plaid to access all your financial life, all to provide you with centralised analytics or supposed financial advice.
Sure it’s probably (one can hope) more secure than every single one of them rolling out their own hacked together equivalent. But still.
Am I missing something?