Disturbed by @DonorBox-powered UI's interaction with Web's security model: it asks for bank login/password on origin that's not the bank's.
1
3
The criminal could be someone who sets up a site similar to yours, using something that looks like @DonorBox, but steals the password
1
1
5
Replying to @davidbaron @Donorbox @Plaid @stripe
It could also be somebody who hacks the @yimbyaction website, since users entering bank passwords into that site makes it a valuable target

Aug 18, 2017 · 3:18 AM UTC

1
5
Replying to @davidbaron @yimbyaction @Donorbox @Plaid @stripe
The fundamental problem is that the browser URL bar says who you're communicating with. Users should never enter bank password at not-bank.
1
1
7
Teaching users that that's OK sometimes is teaching them to do things that put them at very serious risk online.
4