Ask HN: Are you terrified of Plaid’s account verification approach?

Re:Ask HN: Are you terrified of Plaid’s account verification... by tialaramex on Thursday September 02, 2021 @08:44AM (#28391384)

If your user authentication flow is WebAuthn your users can't mistakenly give their credentials for your service to anybody short of literally FedExing their physical Security Key to the bad guys.

In fact even you can't give your users credentials away, they're the only ones who have them.

This is if course intended to cure phishing but it also ensures this Plaid scraping flow can't make sense.

[ Parent | on HN ]

Re:Ask HN: Are you terrified of Plaid’s account verification... by YeBanKo on Thursday September 02, 2021 @03:04PM (#28395989)

Banks still use text messages for two factor, not even an authentication app. And it’s been proven multiple times that stealing numbers is way easier than it should be. I don’t expect banks to migrate to WebAuthn any time soon.

[ Parent | on HN ]

Re:Ask HN: Are you terrified of Plaid’s account verification... by SAI_Peregrinus on Thursday September 02, 2021 @10:50AM (#28392757)

I do wish banks used WebAuthn. But I don't expect them to start, they largely seem to rely on the ability to reverse transactions instead of avoiding illegitimate transactions in the first place.

[ Parent | on HN ]