0

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money.

As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, which should hopefully help prevent hackers seeing the data if the database ever gets dumped (luckily no actionable financial data exists, simply transactional data).

The problem here, however, is that if I wanted to I could decrypt (using Vault) any user's data as the owner of the app. I don't want to be able to do that.

Is there a way to encrypt incoming data from Plaid and make it available to the user through a web UI, without me being able to decrypt it as the developer of the app?

Unfortunately private keys won't work since I would have to store them to encrypt the data coming in from Plaid.

Thanks so much!

1

Is there a way to encrypt incoming data from Plaid and make it available to the user through a web UI, without me being able to decrypt it as the developer of the app?

Yes. Encrypt it using the public key of the end user, and implement the client such that the private key - which is in their hands, and no one else's - decrypts the data for their consumption.

This requires a fatter client than simply using a web browser, but if you're implementing your own app, you can do that. It also means you have to implement all your logic out at the endpoint, since the server is blinded to the meaning of all that data.

An example of a (multiplatform) application that uses this model is Keybase. Not only do they allow the end user to have protected access to files that are stored in the cloud, they allow groups of users to share, with each other, access to files that traverse and are stored in the cloud but only decrypt-able by the right end users.

Unfortunately private keys won't work since I would have to store them to encrypt the data coming in from Plaid.

Secret (symmetric) keys won't work for you for that reason. Public (asymmetric) key pairs, where you encrypt using the public key and the user decrypts with their private key, will work.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.