Why should you need to trust a third party (payment company) of a third party (Gemini) with the plaintext password to my bank account ? Even if you trust them to not store the password long term, in the interim you are giving them access to your entire financial history. That's a pretty big privacy issue in itself.

Holy shit, it's not a plaintext password. sigh read about plaid. I linked to it.

web authentication is really not my area, but would you care to explain how this is safe ? For instance, I recognize when an app or a site is trying to use google to authenticate me, I am taken to google to authenticate. I'm not taken to the bank in this case. From https://blog.plaid.com/getting-started/, it looks like a curl request with plaintext password request made to plaid's servers.

Also from https://plaid.com/legal/longtail/, "You acknowledge that in accessing your data and information through the Service, your provider account access number(s), password(s), security question(s) and answer(s), account number(s), login information, and any other security or access information, and the actual data in your account(s) with such provider(s) such as bank and other account balances, credit card charges, debits and deposits (collectively, "Provider Account Data"), may be collected and stored in the Service."