News for hackers. Stuff that matters.
Re:Plaid Launches in the UK by fortytw2 on Wednesday May 29, 2019 @12:01PM (#20041802)
There's legitimately no alternative, "secure" way to access someone's banking data other than by asking for a username/password and then 'impersonating' them / asking for 2FA codes etc etc. As a commenter on the issue says, there is no oauth-esque mechanism implemented by banks.

I think plaid is the lesser evil when compared to rolling all of that on your own for N different banking institutions.

Re:Plaid Launches in the UK by ChrisSD on Wednesday May 29, 2019 @12:51PM (#20042475)
Have you read about https://www.openbanking.org.uk/

The nine largest banks and building societies are required to participate. Many others do so voluntarily.

Re:Plaid Launches in the UK by novok on Wednesday May 29, 2019 @02:03PM (#20043389)
If I was plaid, I would use things like open banking if it's available, because it cost less to implement and maintain than the current html scraping norm we have now.

I'm guessing plaid uses oauth & open banking when available, and falls back to scraping when it's not.

Re:Plaid Launches in the UK by weberc2 on Wednesday May 29, 2019 @02:03PM (#20043385)
What percentage of the world's banks are covered? Or perhaps what percentage of the world's population banks in those covered institutions? Or perhaps what percentage of the total banked wealth (terminology?) is held in covered institutions?
Re:Plaid Launches in the UK by ChrisSD on Wednesday May 29, 2019 @02:12PM (#20043482)
On an article titled "Plaid Launches in the UK" I would assume the most relevant territory is "the UK".

But if instead the question is "what's the alternative" the answer is "government intervention" as shown by the UK.

Re:Plaid Launches in the UK by weberc2 on Wednesday May 29, 2019 @02:34PM (#20043728)
It depends on the audience. Many businesses don't want to restrict themselves exclusively to the subset of UK banks that follow that initiative. And government intervention is hardly a pragmatic solution (how many companies can afford to lobby every government in which they'd like to do business?).
Re:Plaid Launches in the UK by Nursie on Wednesday May 29, 2019 @02:29PM (#20043677)
>> There's legitimately no alternative, "secure" way to access someone's banking data other than by asking for a username/password

Not so true under Open Banking and other systems. Open Banking uses OAUTH2 style stuff, and a variety of certificate schemes (Open Banking's own, and EU ETSI qualified certificates) to allow participants to be delegated various forms of access and roles, in a much more granular way.

>> As a commenter on the issue says, there is no oauth-esque mechanism implemented by banks.

There is in the UK, and PSD2 solutions are rolling out all across the EU. Australia is also getting in on the action.

Re:Plaid Launches in the UK by fortytw2 on Wednesday May 29, 2019 @04:42PM (#20045214)
This is super cool! I was totally unaware of Open Banking.
Re:Plaid Launches in the UK by anfractuosity on Wednesday May 29, 2019 @12:53PM (#20042509)
I think soon banks may be forced to provide an API - https://en.wikipedia.org/wiki/Open_banking, not sure how long that'll take though.
Re:Plaid Launches in the UK by jeandenis on Wednesday May 29, 2019 @01:25PM (#20042903)
Not sure why the downvotes. What he says is true in the US and in Europe Plaid is relying on psd2/open banking.
Re:Plaid Launches in the UK by Eldt on Wednesday May 29, 2019 @05:00PM (#20045430)
I feel that until there is a secure way to do it, it shouldn't be done at all
Re:Plaid Launches in the UK by SpicyLemonZest on Wednesday May 29, 2019 @05:44PM (#20045869)
I generally feel that way too, but the US banking system just isn't built for it. It's hard to get too mad at Plaid for spoofing when my checking account's ID number is the only password required for authorizing electronic transfers.
Re:Plaid Launches in the UK by dbbk on Wednesday May 29, 2019 @01:17PM (#20042803)
That’s ‘legitimately’ not true.