Fair enough - It's just that I feel like they need to make this really apparent before I would feel comfortable enough to use this as a product.
Purely from a product point of view, I wonder if this is one of the cases where having more friction to send money from one account to another, is a good thing.
Perhaps there is now a stronger motivation to write a javascript browser exploit
Step 1: that detects an active gmail (or other webmail) session
Step 2: then sends out an email of small enough $ amounts from a large number of email addresses
Step 3: send the email to a federated set of email accounts that Square considers legitimate users with associated debit cards
Step 4: Rinse, repeat this for a few hops to make tracing a trifle harder.
Step 5: Make Ocean's 11 bag of tricks look as bad as a O(2^n) algorithm.
If they have indeed figured this part out - then I would be really curious to learn what that gotcha is!
http://balajiviswanathan.quora.com/Indian-Space-Mission-Pove...