• Nollij@sopuli.xyz
    link
    fedilink
    English
    arrow-up
    103
    ·
    3 days ago

    At most employers, this is grounds for immediate termination, and rightfully so. Rarely are the credentials to view paystubs entirely separate from the rest.

    You’ve now given your potential landlord access to a much wider system. In many places, the potential landlords are then criminally guilty of unauthorized access to a computer system, AKA “hacking”. The potential tenant typically does not have the authority to grant the authorization.

    • NaibofTabr@infosec.pub
      link
      fedilink
      English
      arrow-up
      47
      ·
      3 days ago

      Yeah this is a massive security risk. Even if the landlord doesn’t intend anything malicious, I seriously doubt they’re putting much effort into protecting that information. Juicy target for a ransomware gang.

      • bobs_monkey@lemmy.zip
        link
        fedilink
        arrow-up
        22
        ·
        edit-2
        3 days ago

        Even if the landlord doesn’t intend anything malicious

        Except, you know, determining that you’re “eligible” and can “afford” for an 80% rent hike

      • socsa@piefed.social
        link
        fedilink
        English
        arrow-up
        15
        ·
        3 days ago

        Especially since this has been an identity theft scam for decades. People post fake, too good to be true, rental listings on Craigslist and the application asks for SSN and a “family reference” (asking for mother’s maiden name) and a weirdly small deposit paid by check. Now you’ve got all the info you need to steal someone’s identity. And I assume this kind of thing has gotten more sophisticated in the digital realm since I was last renting.

  • foggy@lemmy.world
    link
    fedilink
    arrow-up
    67
    ·
    3 days ago

    My landlord tried using some app that wanted my fucking bank credentials. I told her I could t use the app she was asking me to use because it would violate my banks policy and I would then not have a valid way to pay rent.

    It’s fucking insane what tech illiterate tech businesses are asking if the customers.

    • bss03@infosec.pub
      cake
      link
      fedilink
      English
      arrow-up
      21
      ·
      3 days ago

      Probably Plaid. They ask for online banking credentials instead of doing the “traditional” collect ACH, do two sub-dollar transactions, confirm amounts.

      They settled a lawsuit that claimed they were scraping private transactions and selling them. They didn’t admit fault, but I still refuse to hand them my credentials.

      Despite that, they remain popular, since MOST users willingly provide those credentials and get a faster account linking experience, which makes them much more likely to stick around and transfer money into the service recommending Plaid as the linking method.

      I’ve also heard there as some services that refuse to use the “traditional” ACH method of account linking, only allowing Plaid.

        • QuarterSwede@lemmy.world
          link
          fedilink
          arrow-up
          1
          ·
          3 days ago

          Bingo. We don’t allow autopay since once they have it they can pull what they want, be it by accident, or just because we owe them. Hell with that. Still pay our mortgage, car loans, etc. manually each month.

        • bss03@infosec.pub
          cake
          link
          fedilink
          English
          arrow-up
          5
          ·
          edit-2
          3 days ago

          Yeah. It would be nice for the U.S. banking system to get updated to have the same capabilities the populace in other nations have. I don’t trust the current administration to do it without baking in massive grift and corruption. But, I don’t see the banks doing it themselves, individually or in blocks.

          We have dumb things like Zelle, Venmo, and CashApp that are entirely unnecessary in proper countries but banks are invested in and profit from them. Also, this way they can tie customers down with a TOS that would clearly be against banking regulations if any of these service was “a bank”.

  • jjjalljs@ttrpg.network
    link
    fedilink
    arrow-up
    41
    ·
    3 days ago

    Why do we even have laws if they’re not going to protect people from abuse? Shit like this is why people cheer for Luigi. People are just trying to get the basics - health care, shelter, food - and the rich are taking too much.

  • jordanlund@lemmy.worldM
    link
    fedilink
    arrow-up
    29
    ·
    edit-2
    3 days ago

    Providing that level of access would violate my employment agreement.

    Legally, they can ask for a paystub or other proof of income, they can’t demand access to employer networks.

  • Elbow@lemmy.zip
    link
    fedilink
    English
    arrow-up
    46
    ·
    3 days ago

    This likely violates the employer’s policies too. At my employer, it’s all single sign on.

  • Buffalox@lemmy.world
    link
    fedilink
    arrow-up
    29
    ·
    3 days ago

    This is very cool and very legal, but only in the USA.
    Or is it hacking by the landlord? A crime almost worse than terrorism, that can put you 20 years in jail!

    Landlords are using a service that logs into a potential renter’s employer systems and scrapes their paystubs and other information en masse, potentially in violation of U.S. hacking laws,

    Oh boy, those idiots don’t know what they are risking!

    • PhobosAnomaly@feddit.uk
      link
      fedilink
      arrow-up
      18
      arrow-down
      1
      ·
      3 days ago

      My other half worked for a large retail chain in the UK. One of her colleagues (let’s call him Bevin Koyle for no reason whatsoever) was a particularly tiresome dude - not a bad guy by any means, but just super fucking irritating. Very self-centred, happy to dodge responsibility and let a colleague take a fall, and a bit of a gobby twat.

      Back when she worked the quieter hours and mobile data plans were quite anaemic, she would put her mobile phone hotspot on for her colleagues to listen to music or whatever.

      This one shift, Bevin had run out of data, and already forseeing this situation happening, she had already set the password accordingly. “I can see your WiFi”, says Bevin, “but what’s the password?”

      “BevinKoyleIsACunt”, she loudly announces.

      “No seriously,” says Bevin, “what’s the password?”

      “BevinKoyleIsACunt” she once again says loudly.

      Bevin is getting a bit fucked off now, and is like “stop being nasty, give me the WiFi code”

      Not grasping the rudeness of his own demands, she says “I tell everyone the same thing, BevinKoyleIsACunt”

      He stormed off oblivious to how helpful she had been each time. I still raise a wry smile whenever I remember how supremely helpful she had been.

  • ChicoSuave@lemmy.world
    link
    fedilink
    arrow-up
    10
    ·
    3 days ago

    The article didn’t seem to have a lot of details like which state this took place in. Re-reading it just feels like fear propaganda showing how easy it would be to extort data from renters.

    • EtherWhack@lemmy.world
      link
      fedilink
      arrow-up
      5
      ·
      3 days ago

      Atlanta (so, Georgia) is mentioned, though I don’t think it’s any particular state as the focus is on two screening services landlords may use. (similar to how Sterling works for background checks, but more invasive)

  • xia@lemmy.sdf.org
    link
    fedilink
    English
    arrow-up
    8
    ·
    3 days ago

    If done before starting a business relationship, at least it telegraphs the petty tyrant for who he is. If it’s a bait-and-switch, with all the inertia of moving your stuff and updating your address… ick…

  • TrackinDaKraken@lemmy.world
    link
    fedilink
    English
    arrow-up
    7
    arrow-down
    1
    ·
    3 days ago

    If this is the shit my kid is being asked to do, no wonder he came back to live at home.

    I agreed to turn off the camera in his bathroom, but I said I had to leave the camera in his bedroom on because there’s a window, and it’s a security risk. He agreed because it was better than where he was living before.

    (I’m totally kidding.)

  • circuitfarmer@lemmy.sdf.org
    link
    fedilink
    arrow-up
    5
    ·
    edit-2
    3 days ago

    Yeah, this needs to get regulated away right quick. But it won’t.

    Remember when “reaping the rewards” required “taking the risk”?