[HN Gopher] Stripe Identity
___________________________________________________________________
Stripe Identity
Author : thomaspark
Score : 801 points
Date : 2021-06-14 14:32 UTC (8 hours ago)
(HTM) web link (stripe.com)
(TXT) w3m dump (stripe.com)
| tomytosian wrote:
| After reading the HN below comments. It seems a sizeable portion
| of those comments are "incredible products from stripe" "amazing
| news" with very little backing content. Did they pay bots to post
| on HN???
| gurubavan wrote:
| _Please don 't post insinuations about astroturfing, shilling,
| brigading, foreign agents and the like. It degrades discussion
| and is usually mistaken. If you're worried about abuse, email
| hn@ycombinator.com and we'll look at the data._
|
| https://news.ycombinator.com/newsguidelines.html
| s_dev wrote:
| Stripe is a YC company and will always have cheerleaders on HN
| -- it is also arguably the most successful YC company. One of
| the few companies who simply wouldn't need to astro turf on HN.
| cyral wrote:
| I think many developers have used Stripe for payments after
| dealing with legacy payment APIs like Authorize.Net and have
| seen how Stripe does it right and makes the process so much
| less painful, I'd assume their other products like this are as
| equally well built due to their reputation in the payments
| industry.
| nrmitchi wrote:
| I don't think it's fair to assume that this is astroturfing in
| any way. Stripe just has a large following of people who like
| _anything_ they release. Stripe has "fans" just like Apple
| does.
| gruez wrote:
| The landing page contains logos for clubhouse, discord, and
| shippo, which are presumably companies use the service. Does
| anyone find those usages to be unnecessarily intrusive? Maybe
| it's just me, but a chat app or shipping site asking me for a
| drivers license scan + selfie would make me never want to use the
| service again. It's appalling how this sort of stuff is getting
| normalized, eg. google asking for id scans for age verification.
| dubcanada wrote:
| I honestly find it weird having all of these things suddenly
| want a copy of my passport in the cloud just sitting there
| waiting to be hacked in years to come when the security
| measures drop.
|
| At this point there is giant databases containing everything
| people need to take complete control of your identity sitting
| there just waiting to be hacked.
|
| I have no idea how to change it/fix it. But it seems weird to
| me.
| emdowling wrote:
| You've nailed the complexity of this. On privacy, people are
| rightfully spooked about this for all the reasons you've
| mentioned. On safety, people are really happy about these
| initiatives as accounts backed by user identity are less
| likely to be used for harm. On security, leaks of these
| databases create issues to other sites and companies (eg: if
| Company X is compromised, then identity documents could be
| used to disable/bypass 2FA for Bank Y).
|
| To make it even more complicated, regulators often hold
| contradictory views. They want to see increased safety, but
| in the same breath will announce actions against companies
| for violating privacy. This is a super-difficult balance to
| strike.
|
| Specifically for Stripe, I trust them. So if I see that a new
| start-up is using them rather than rolling their own
| solution, that increases my trust. But it means there is now
| a big giant server in the cloud with millions (billions?) of
| identity documents that is worth a lot of money for hackers.
| agwa wrote:
| > Specifically for Stripe, I trust them. So if I see that a
| new start-up is using them rather than rolling their own
| solution, that increases my trust
|
| Note that Stripe allows their customers access to the
| "captured images of the ID document, selfies, extracted
| data from the ID document, keyed-in information"[1]. So you
| still have to trust any company using Stripe not to
| download, store, and later leak your personal information,
| and you also have to trust them not to let their Stripe API
| token be compromised and exploited by identity thieves.
|
| [1] https://support.stripe.com/questions/managing-your-id-
| verifi...
| wolverine876 wrote:
| > people are really happy about these initiatives as
| accounts backed by user identity are less likely to be used
| for harm
|
| Has anyone told you they are really happy about it? I
| haven't heard someone say that. Most users have no idea
| about it.
| truffdog wrote:
| > Specifically for Stripe, I trust them
|
| The problem with this is that the user isn't trusting
| Stripe today, they are trusting Stripe today, and all
| future Stripe managers and owners until the user dies and
| no longer cares. That's a big bet! Bad CEOs and sales
| happen.
| lotsofpulp wrote:
| The fix is for the government to make it a service. Right
| now, the government is punting responsibility to private
| actors who do not have the legal tools to operate an identity
| service.
|
| The government already operates an identity service via
| passports. The only reason they do not have an electronic
| identity service yet is because it is beneficial for them to
| be able to blame private actors when things go wrong.
| markdown wrote:
| > The fix is for the government to make it a service.
|
| Agreed. An example: https://www.realme.govt.nz/
| toomuchtodo wrote:
| This is coming, it's just taking Government Time
| (Login.gov, USPS for in person proofing, etc).
| duped wrote:
| This isn't a problem to fix. Internet businesses don't have
| an absolute right to your identity.
|
| The government (in the US at least) does offer some form of
| identity services like everify for employment.
| specialist wrote:
| This is The Correct Answer(tm).
|
| Misc governments already operate 1,000s of identity,
| credentialing, and licensing services.
|
| Wouldn't it be great if profiles on DoorDash, Yelp, Hotels,
| etc. were required to be linked to IRL identities and
| licenses?
| nkohari wrote:
| I suppose it depends on how much you want ~all of your
| online activity to be attributed to your real identity,
| in such a way that could be easily examined by the
| government.
| danShumway wrote:
| But at a fundamental level, why do Discord and Clubhouse
| need to verify my identity?
|
| I don't think the question GP is asking is whether or not
| Stripe is a good way to confirm someone's real-life
| identity, or whether it would be better for the government
| to do it. I think what they're asking why we're doing
| identity verification for chat applications. Is this a good
| direction overall for the Internet to be moving in?
|
| I don't like the idea that I should have one real-life
| identity that every service I sign up for online knows,
| even trivial services like social networks. I would argue a
| world like that is abridging on people's Right to Hide
| (https://anewdigitalmanifesto.com/#right-to-hide)
| lotsofpulp wrote:
| Who is "we"? Maybe the people operating the chat app have
| determined that it is in their businesses' best interest
| to verify identity. I can certainly see it reducing costs
| for the business.
|
| I am not suggesting all businesses be required to do it.
| But I do not see why businesses should be prohibited from
| doing it. If you do not want an identity linked service,
| then buy a website name, and start a business and do not
| require people to identify.
| danShumway wrote:
| "We" in this context means the overall population of
| users on the web, including non-corporate users and
| individuals who are exercising their freedoms online.
|
| We can't justify every architecture decision about the
| web via only business costs, if that was the case we'd
| make adblockers illegal and deprecate HTML. You need a
| stronger argument if you want me as a user to care about
| or support your business interests. If you want my
| support you have to show how this benefits the web
| overall, not just your company.
| lotsofpulp wrote:
| Is this a discussion about the architecture of the web?
| Or about specific websites? If Costco wants me to login
| to their website to buy things, or Facebook wants me to
| use real identity, that does not stop me from using
| alternatives that do not.
|
| Am I entitled to alternatives that do not verify
| identity? Maybe the operating costs are too high?
| Nextgrid wrote:
| > Facebook wants me to use real identity
|
| We're already living in a world where you have to "login
| with Facebook" to do many things, but at the very least
| you can currently still create a fake account if you have
| no other option. If reliable identity verification starts
| becoming commonplace, that option goes away.
| danShumway wrote:
| Your proposal is for a government-run identity
| verification system.
|
| The "we" in this context (ordinary users) also comprise
| the majority of voters and regulators who will ultimately
| decide how the system you propose is built and what
| restrictions it will have; and that is a group that is
| not solely motivated by your business interests -- so it
| is kind of important for you to be able to convince them
| that your system benefits them, and not just a few
| businesses.
|
| Why should a Congressperson vote to build the system you
| propose instead of introducing a harsh privacy law that
| restricts which businesses are allowed to collect
| identification?
| lotsofpulp wrote:
| I think we can do both. Or at least restrict what a
| business can do with identification information that is
| mandatory, such as not being able to use it for marketing
| purposes or sold, and have it be temporary.
| Kiro wrote:
| > why do Discord [..] need to verify my identity?
|
| > the overall population of users on the web
|
| You keep arguing about a non-issue. Normal users do not
| need to verify with Discord. It's only for bot owners of
| popular bots to prevent the widespread abuse Discord saw.
|
| https://news.ycombinator.com/item?id=27505905
| cardine wrote:
| > But at a fundamental level, why do Discord and
| Clubhouse need to verify my identity?
|
| Because of credit card fraud. I've run services where >5%
| of attempted transactions were done using stolen credit
| cards. So we used services that determine the risk of a
| transaction being fraudulent, and if the risk was too
| high, we required identity verification.
|
| The alternative was to reject those transactions outright
| and permanently lose those customers, which is terrible
| when there is a false positive.
|
| If credit card fraud is high, it doesn't matter whether
| you are a chat app or a bank app.
| Nextgrid wrote:
| Credit card fraud can be solved by other means though.
| 3D-Secure for example will offload the liability to the
| bank.
|
| The proper way to do it is to either enforce 3D-Secure or
| offer passport as an _option_ when 3DS is unavailable,
| but because ID verification is getting easier and cheaper
| with services such as this one, there will be no reason
| to spend extra engineering time to implement solutions
| such as this one when you can just ask for everyone 's
| passports especially when this also allows you to use the
| data for marketing purposes or be able to reliably ban
| "undesirable" people (and "undesirable" in this case
| doesn't mean "bad" or "illegal", it could simply be
| someone who uses an ad-blocker or doesn't "engage" with
| dark patterns like the company wants them to).
| supertrope wrote:
| The bank should handle KYC. Mastercard and Visa forbid
| requiring ID. Handing PII opens up the customer to
| "identity theft" fraud which is much worse than having to
| cancel a credit card.
| danShumway wrote:
| It sounds like you're asking for a payment verification
| system, not an identity verification system.
|
| Does Discord need to know my identity, or does it need to
| know that my card hasn't been stolen? If it's the latter,
| then I'm unsure why Stripe is offering the business
| access to my passport/license, and I'm unsure why we
| would want to build a government ID system for Discord
| instead of a government payment system.
| ZainRiz wrote:
| I suspect that those places need to verify your identity
| if they want to pay you money (e.g. you're accepting tips
| on clubhouse).
|
| There are a ton of legal requirements around you having
| to verify a person's identify before sending them money.
| These laws are often put in place to avoid money
| laundering, etc.
|
| I doubt they'd require every single user to go through
| the friction of verifying their identity.
| 4b11b4 wrote:
| What's the difference between filling out your address in text
| versus scanning? Is your face not on the internet yet? Just
| curious what specifically would make you never want to use it?
| wyager wrote:
| I can easily provide a fake address to protect my privacy.
| Harder and legally risky to provide a fake ID to protect
| privacy.
| DharmaPolice wrote:
| If you enter an address in as text you're in control of the
| data you're supplying. If you have to upload/scan a document
| then there might be other information they extract/store. I'm
| not someone concerned with such things but it's easy to see
| how they're different.
| floatingatoll wrote:
| Scanning lets you audit for photoshopping and sets a vastly
| higher bar for counterfeiting. (For example, Blizzard's name
| change process _requires_ you to cover irrelevant areas of
| your ID with actual paper, because no digital editing
| permitted.)
|
| See also: https://news.ycombinator.com/item?id=27503674
| oauea wrote:
| Why would these companies need to gather enough data to steal
| my identity?
| huhtenberg wrote:
| > _Is your face not on the internet yet?_
|
| Careful there, mate. This is just another form of the
| infamous "Nothing to hide" fallacy.
|
| https://en.wikipedia.org/wiki/Nothing_to_hide_argument
| mcrae wrote:
| Clubhouse lets you collect payments to join some channels.
| Isn't KYC reasonable in that case?
|
| Re: Age Verifications on Google & YouTube: this has been
| covered well elsewhere. Google is required to do so by EU law.
| Blame regulators not the companies.
| wyager wrote:
| > Isn't KYC reasonable in that case
|
| No. This is something we've become dangerously desensitized
| to.
| gruez wrote:
| > Clubhouse lets you collect payments to join some channels.
| Isn't KYC reasonable in that case?
|
| If it's limited to only people receiving payments, then it's
| far more reasonable than what I thought was happening (eg.
| people getting randomly asked for ID scans to use their
| service).
| nucleardog wrote:
| Others have said it's limited to people who have a bot
| joined to more than 75 servers, or use certain sensitive
| scopes. So it's not quite that restrictive (only payments).
|
| But I can say that I'm in... about 10 servers as a user and
| have a couple of bots I hacked together for various things
| operating in 3 of them and have never been asked for
| anything but my email. And across all the people I know
| using Discord, I was totally unaware that they even did
| that sort of identity verification because it seems like no
| one I know's ever run into it.
| arthur_sav wrote:
| I completely agree. Also we don't know how this data is shared
| or used. Can't wait for new privacy laws to come in place for
| such data handling.
| tootie wrote:
| I'd imagine it's for creators/sellers moreso than
| buyers/customers.
| Kiro wrote:
| Regular Discord users don't need to send in anything. It's used
| to verify your bot (only applicable for bots that are in more
| than 75 servers), which seems like a reasonable use case.
| sascha_sl wrote:
| More a requirement at this point. Discord had to crack down
| on malicious bot developers after some decided to log
| essentially every bit of information ever sent to them to be
| put on the internet, including information from private
| channels. Some scopes require this verification outright now.
| oefrha wrote:
| Does Discord only allow bot developers from Stripe Identity's
| supported countries to verify? Stripe is only supported in 44
| countries[1], and Stripe Identity seems to support 56 (by
| counting options in the select dropdown in [2]), so that
| leaves out a lot of countries.
|
| [1] https://stripe.com/global
|
| [2] https://stripe.com/docs/acceptable-verification-documents
| avree wrote:
| Probably, and that's a good thing. The amount of fraud and
| bad actors outside of those supported countries represents
| a significant threat to Discord's user base. They might
| accidentally block a couple good developers making bots to
| help people along the way, but in doing so, protect the
| greater good.
| floatingatoll wrote:
| Presumably they have alternate verification processes for
| such countries as are not supported, when they deem it
| relevant to their business to do so; I expect it's handled
| more as a case-by-case consideration and less as a well-
| defined policy, but you could still ask Discord Support and
| report what they at back to us!
| judge2020 wrote:
| Yes, Discord only allows bot developers to become verified
| (which is required for bots to be in over 75 servers) if
| the developer is able to verify their identity via Stripe,
| no alternate process is provided for developers outside of
| the supported country list.
| judge2020 wrote:
| Discord uses it to verify the identity of bot makers - my
| understanding is that bots have been abused for a long time for
| data collection (think logging when users come online, go
| offline, change status, etc).
| gruez wrote:
| I don't get it. They're concerned about people abusing the
| system, and their solution is... requiring KYC? How does that
| solve the issue? It sounds like bot makes can still passively
| collect the info, it's just that when it gets discovered they
| can point to a real person to blame. Moreover, why do bots
| even need to know the online/offline status of users? Why not
| add a permission system so users can opt in/out of providing
| this sort of information to bots? I'm not a discord bot
| maker, but there's plenty of hobby/side projects I'm willing
| to provide to users for free, but not willing to attach my
| real life identity to.
| Kiro wrote:
| > I'm not a discord bot maker
|
| You don't say. Go to a random Discord server and you will
| see how bots are used. Your solution makes no sense and
| would kill most of the current use cases.
| nucleardog wrote:
| > Why not add a permission system so users can opt in/out
| of providing this sort of information to bots?
|
| The bots provide a function for the "server" and the server
| operator. That's like saying "Why not just provide a system
| for users to opt out of ChanServ/NickServ".
| floatingatoll wrote:
| It lets them hold the bot author legally liable for
| malfeasance, which is difficult if you're only a throwaway
| Gmail address.
| edwinwee wrote:
| Chat apps use Identity to verify bots and prevent _bad bots_
| from spamming real users. And shipping services use Identity
| when a user is suspected as a fraudster--to double check before
| creating fraudulent shipping labels.
| dubcanada wrote:
| I am on several discords and get 4-5 messages a day from
| crypto pumps and other spam.
|
| This doesn't seem like it works.
| easrng wrote:
| Those are usually from automated user accounts, not actual
| bots.
| dubcanada wrote:
| And the difference is?
| kivlad wrote:
| Bots are officially sanctioned as such and have an
| application ID in the developer console as well as a
| label in the client. Alternatively, nothing's stopping
| someone from taking a user account's authentication token
| and making the same calls, but that's against TOS
| (Discord calls them selfbots). The KYC they use won't
| protect against this kind of abuse.
| Nextgrid wrote:
| But doesn't that prove the ineffectiveness of requiring
| KYC in this case? Bad actors will just scrape the private
| API, bypass the verification and do their mischief, while
| good users who want to create bots now have to compromise
| their privacy by providing identity information.
| gruez wrote:
| > Chat apps use Identity to verify bots and prevent bad bots
| from spamming real users.
|
| Is bot spam rampant on discord or something? Are less
| invasive forms of verification (eg. SMS, credit card, or
| requiring a deposit) not enough? Can it not be solved via
| technical means? eg. requiring users to opt-in before
| receiving messages from a bot?
|
| > And shipping services use Identity when a user is suspected
| as a fraudster--to double check before creating fraudulent
| shipping labels.
|
| Yet I can buy hundreds of dollars of goods off amazon (or any
| other e-commerce site) without uploading my ID and giving
| them a live video feed of my face.
|
| For both of these use cases, I don't doubt that ID
| verification provides benefit, I just find the privacy
| tradeoff to be unacceptable. As an analogy, a store can
| probably cut down on shoplifting if they performed ID checks
| at the entrance and kept a visitors log, but I think most
| people would find that unnecessarily intrusive and would
| refuse to patronize that store.
| stu2b50 wrote:
| >Is bot spam rampant on discord or something?
|
| It definitely is. If you don't turn off DMs from all the
| public servers you're in you'll inevitably be hit with the
| crypto spam bots.
|
| There's also the issue of bots silently sitting on servers
| and logging all chats, user statuses, etc.
| nightpool wrote:
| Discord only uses identity verification for a small subset of
| developer accounts--when your bot application fetches the full
| member list or timestamped "online/away" data, AND is in more
| than 100 servers. Normal Discord users (and most bot
| developers!) don't interact with the identity verification
| process.
| superasn wrote:
| Had to do this on a site recently and it didn't work for me at
| all.
|
| It wanted to scan the back of my dl but Indian dls are totally
| blank at the back. Then it said my webcam wasn't good enough and
| showed me a QR code to use for my mobile. The link never opened.
| Tried it 3 times and 5 minutes later I just googled the next
| alternative site and bought it from there.
|
| Lesson being use this only if it is totally necessary. You may
| lose paying customers in your overzealousness to be super tech
| savvy to KISS sites using a Paypal button.
| wantsanagent wrote:
| When you say "this" do you mean "Stripe Identity?"
| superasn wrote:
| Yes I'm talking from a customer point-of-view. Was trying to
| buy a vps and they for some reason wanted to scan my driver's
| lic using this before I could pay through Paypal. Yes I was
| trying to buy via PayPal but this was step 1 for some reason.
|
| So I have only seen this work from the customer's point-of-
| view and it was not a good experience for me. I am a very
| patient person as i scanned my dl 4 times on desktop using a
| webcam capable of recording 1080p. Then i tried with a mobile
| and that didn't work either. A less patient man would have
| quit much sooner. I tried my best then just bought from the
| next site because they connected the Pay button directly to
| Paypal.
| judge2020 wrote:
| I think they mean 'was it stripe identity' (there is stripe
| branding during verification) or was the company using some
| other solution. The experiences I've heard from bot
| developers using Discord and thus their Stripe Identity
| verification haven't had any issues.
| btmcnellis wrote:
| Another commenter on this post said that this service isn't
| available in India, so it seems like the real flaw is that this
| shouldn't have been presented to a user in India by whatever
| site you were using.
| randompwd wrote:
| The only way to _verify_ an identity is to call out to the
| identity issuer and confirm the details and pics on the id.
|
| A fake ID is still a fake ID. Just because it passes a looks-
| similar test doesn't mean it's being verified.
|
| verify > verb > make sure or demonstrate that (something) is
| true, accurate, or justified.
|
| If it's not confirmed by issuer(in person or programmatically),
| it can never be 100% thus can never be _verified_.
| AnssiH wrote:
| The way domestic services (both public and private) in Finland
| verify user's identity is via bank credentials (Finnish Trust
| Network), via Mobile ID (Mobiilivarmenne), or via government
| FINeID. All these involve multi-factor authentication.
|
| The service then gets the user's personal identity code as a
| return value.
|
| Looks like that kind of flow is not supported.
|
| Finnish users will be very hesitant of giving scans of their ID
| documents to foreign companies as no domestic online services
| require them. And of course Finnish companies cannot practically
| use this for now, at least for domestic users.
| jollybean wrote:
| Please no.
|
| If we need to use our identity online for Age Vertification, then
| why doesn't the government step in with an anonymous service for
| that?
|
| That - and - sites should have to get some kind of basic
| regulatory approval for asking for id.
|
| And then liable if they leak the data.
| snickmy wrote:
| If I was an AWS, GCLOUD or AZURE I'd acquire stripe right now and
| go super vertical on 'Everything for your business'
| nceqs3 wrote:
| If only the FTC/DOJ would say yes...
| troelsSteegin wrote:
| Wow, I would like to know about this has been engineered and
| QA'd. Owning this system on the product side would keep me awake
| nights. One question is tolerance on false negatives (you don't
| look enough like your govt id) - maybe they collect additional
| information, and use third party service for corroboration.
|
| If my Stripe Identity can be used across vendors, it's almost
| like a digital passport. I'll ask, in jest, are Stripe and
| Estonia (https://e-resident.gov.ee/) in competition?
| TameAntelope wrote:
| They've been doing it for years internally, I'm sure it's not
| _much_ more stressful from a, "Oh did we let a bad guy
| through?" perspective, at least.
|
| Definitely more stressful from a, "Did we let a customer of a
| new product down?" perspective though, for sure.
|
| Also, not for nothing but has Estonia kept their system up to
| date? I've not been impressed with how it had aged last time I
| looked into it (a few years back).
| [deleted]
| edwardmp wrote:
| Given their docs state that they use third-party services to
| offer this service, isn't Stripe just providing a wrapper API
| around Onfido and charging a premium? If so, how is this really a
| useful proposition?
| edwinwee wrote:
| Identity was built in-house over the last decade from learnings
| from Stripe's experience as a payment company.
|
| We've invested heavily in creating an end-to-end verification
| product with an ergonomic API, responsive capture experience,
| and advanced fraud detection and verification capabilities.
|
| Scaling ID verification globally also means working with others
| --we supplement our homegrown system with a number of partners
| for the best experience for the user. (e.g. Analogous to Stripe
| credit card payments, we also work with banking institutions.)
| edwardmp wrote:
| Thanks for the detailed reply, Edwin!
| howellnick wrote:
| https://cognitohq.com/ is another YC company that's already in
| this space. I haven't tried either service, but I wonder how they
| compare.
| choppaface wrote:
| Sift has a longer list of logos on their landing page, though I'd
| imagine even at this point that Stripe has more data. Sift got
| hit hard being unprepared for CCPA, I wonder what Stripe's
| position would be. I'm naive but it strikes me that if Stripe
| were to offer a cheaper version of this product that does not
| transactions but for UGC, then Sift might have trouble retaining
| customers.
|
| I'm also impressed that Stripe called this "Identity" instead of
| something more like "Trust and Safety." The current name makes it
| sound more like Okta or something but that's not the case. At
| least today. Perhaps they want this to grow to overtake stuff
| like Experian.
| edwinwee wrote:
| Identity is the step that comes after Sift (or Stripe Radar).
|
| If Sift flags that a user may be suspicious, you may need to
| collect more information about them to confirm if they are
| legitimate or not. That's where Identity comes in.
|
| Oftentimes, this is handled manually via an ops team asking a
| user to reply with a photo. Instead they can collect this
| automatically by surfacing Stripe Identity.
| fenospro wrote:
| Instead of being super serious, let me give a huge WELL DONE! to
| the UI/UX and frontend devs at Stripe to build such magnificent
| Web Pages!
| ngoel36 wrote:
| I've never seen a company release incredible products with as
| high velocity as Stripe has over the last few years. Truly
| incredible. $1.50/user may sound outrageously expensive at first,
| but having seen all the engineering power it takes to build
| something like this at Uber...it's a totally fair price.
| vishnugupta wrote:
| > $1.50/user may sound outrageously expensive at first, but
| having seen all the engineering power it takes to build
| something like this at Uber...it's a totally fair price.
|
| I observed other teams struggle to build and have tackled
| challenges posed by identity, 1.5$/user is terrific price.
| Handling PII data in itself is a rabbit hole of engineering,
| product, and regulatory challenges. Let alone creating unique
| identities, matching, and what not.
| varispeed wrote:
| Sadly out of reach for small projects. For example if you had a
| site with 100k users, you'd barely cover server costs with Ad
| Sense. $150k to check all of them? Would never happen :/ Maybe
| if they could pay for verification themselves?
| jhugo wrote:
| In many cases you don't need to verify the identity of every
| user. You can use some signal to determine when you need ID,
| or require it for accessing certain products/features.
| spoonjim wrote:
| You don't need to verify a user's real identity to serve them
| AdSense.
| varispeed wrote:
| They can post AdSense violating image and report the URL to
| get the page demonetised. Users of similar project done
| that many times.
| whimsicalism wrote:
| If you're not offering a service for $, why do you need to
| verify identity?
|
| What is the usecase?
|
| This strikes me as classic HN bikeshedding.
| varispeed wrote:
| Spam and other malicious behaviour. It's time consuming for
| mods to block spammers.
|
| Instagram also don't charge users and yet they verify
| identity.
| arcturus17 wrote:
| Instagram may be verifying identity now (I didn't know...
| letting FB scan my id would be one of the last things I
| would want), but I'm pretty sure they reached a massive
| scale without such a measure.
| michaelt wrote:
| Stripe's website shows users scanning their government ID
| documents and taking selfies.
|
| Using that as a means to block spammers would be....
| unusual.
| ankurpatel wrote:
| The tech stack has something to do with it. Stripe has such
| high velocity because of Ruby on Rails.
| arcturus17 wrote:
| I can't even find any evidence that they use Rails, and I'm
| pretty sure their outstanding velocity is minimally explained
| by their choice of tech stack.
| 0xFACEFEED wrote:
| lol!
|
| When are we as a community going to move past treating
| frameworks/languages/tools as a silver bullet? Frameworks
| don't make teams better; good management, technical
| leadership, and great infrastructure does.
| ankurpatel wrote:
| You are right but frameworks help with long term
| maintainability of code and also being able to build out
| features quickly which is what the comment was referring to
| originally. If they use Go lang of some other tech stack
| without framework it can help them achieve their goal but
| not at the same speed.
| [deleted]
| sunvalley wrote:
| Stripe does not use Ruby on Rails
| Androider wrote:
| https://www.quora.com/What-programming-languages-does-
| Stripe...
| andy_ppp wrote:
| I know that KYC checks for Onfido we had no volume but we're
| being charged around $10. Is the $1.50 for KYC or some lesser
| verification?
| grouseway wrote:
| I'd put Twilio and Cloudflare in the same category for vision
| (expanding product offering) and execution.
| jonplackett wrote:
| I thought that too - until I tried to use Twillo for the
| first time in a couple of years. Holy crap they
| overcomplicated the interface! There's 3 or 4 levels of menu
| all shown at the same time in different directions. The docs
| are also way worse. The product is still great, but the
| interface is a complete mess!
| benburleson wrote:
| Yep, these are all examples of top engineering organizations.
| tyingq wrote:
| That it's flat, and not a percentage, is a welcome surprise.
| privatdozent wrote:
| Any news on IPO plans?
| recursive4 wrote:
| This is on the less expensive side of alternatives and doesn't
| require a minimum annual spend quota. They nailed this for
| startups, which I imagine is a combination response to /
| anticipation of regulatory requirements in Web3 apps.
| jonplackett wrote:
| Just what I was thinking.
|
| Can Stripe hurry up and go public so I can buy some shares?
| boringg wrote:
| While that sounds like a great ... in all likelihood by the
| time it hits the public market most if not all the value will
| be extracted by the investors. With a branded company like
| this and equity markets as frothy as they are. I doubt there
| will be much value left for retail. Hopefully Im wrong
| though.
| tshaddox wrote:
| Wouldn't the idea be that the company would continue to
| create value after going public?
| boringg wrote:
| The idea of going public is to raise another round of
| financing for the company while being able to get
| liquidity for private shareholders. It is not necessarily
| to create value going forward.
|
| The best option is for the company to raise a good deal
| from the public markets (high valuation on limited
| equity) and then execute successfully without needing to
| raise again. If they do need to raise again they have
| hopefully not done a poor job on their original public
| IPO so that they can go back to the public markets. That
| said it isn't that important a factor.
| tshaddox wrote:
| > The idea of going public is to raise another round of
| financing for the company while being able to get
| liquidity for private shareholders. It is not necessarily
| to create value going forward.
|
| Perhaps the company doesn't necessarily intend to create
| value going forward, but they must at least pretend to
| have that intention. What I meant was that the idea of
| _the people buying public stock in a company_ is that the
| company will create value going forward.
| gwright wrote:
| > It is not necessarily to create value going forward
|
| Not sure where you are going with that thought. A
| business that isn't creating value is going out of
| business or selling to someone who has an idea of how to
| use its assets to create value.
| boringg wrote:
| Actually not all companies create value. Monopolies
| create profits through pricing distortions but not
| necessarily value. My point is that creating value is not
| a key component of a company going public.
|
| In this current moment I would wager that if you are
| suggesting that you will create value in the market going
| forward you will get a great return on your investor
| dollars but you may not actually execute that value
| creation. (relevant news: lordstown motors)
| tshaddox wrote:
| Perhaps my original wording should have been "delivering
| value" rather than "creating value." Of course it's true
| that some things that companies do are at best shifting
| value around and at worst extracting or even stealing
| value from elsewhere. But my point was that people who
| buy public stock from a company almost certainly expect
| that company to somehow be more valuable in the future.
| franl wrote:
| I always hear this line of thinking, but there aren't ever
| supporting examples presented. Stripe reminds me of
| Cloudflare. Cloudflare is over 5x what it was at IPO (as of
| 6/14/21). Maybe what you describe is the case "on average"
| for most IPOs, but it seems to not be the case for
| extraordinary companies like Cloudflare (and maybe Stripe).
| Obviously just an n of 1 but I'm sure others could chime in
| with similar examples.
| boringg wrote:
| There are numerous examples on both sides for sure. I
| would add that performance also does well for companies
| operating in a bull market.
|
| In the case of cloudflare (And many tech stocks) they had
| a black swan event of a large portion of the global
| economy going online during the pandemic which has juiced
| their returns.
|
| Not saying it doesn't happen but rather that it isn't how
| people typically price their IPOs to generate value to
| the retail investor.
| franl wrote:
| Yep, makes sense. A little nitpick: I wouldn't call it a
| Black Swan because multiple people called out the
| potential for such a global event to happen (Gates,
| Taleb, etc.), but to your point it certainly further
| accelerated the move to online commerce, mainstream
| remote work, etc. Cloudflare and Stripe are/were both
| well positioned for that type of world.
| marvin wrote:
| I have been thinking the same thing for some time now.
| Unfortunately, I wouldn't hold my breath. If they are able to
| stay private, they probably will. It's easier to build a
| business when you don't have to deal with the hassle and
| interference of public markets.
| boringg wrote:
| "In March, Stripe, which describes itself as "payments
| infrastructure for the internet," became the most valuable
| private company in Silicon Valley, raising $600 million at
| a valuation of $95 billion. The Journal reported Stripe is
| considering going public later this year or early next
| year."
| thisiscorrect wrote:
| What would that do to all the Stripes holding illiquid
| shares in a private company?
| marvin wrote:
| I'm not familiar with Stripe's situation, but there are
| non-public markets available for this kind of stock sale.
| You just can't _buy_ from them unless you 're already
| rich. I'd guess that long-term employees do have an
| amount of flexibility in that regard.
| IgorPartola wrote:
| Can you form a mutual fund/ETF that invests into those
| kind of companies via the non-public markets and then
| sell shares publicly for the fund?
| reportingsjr wrote:
| This is already a thing, large investors like Fidelity do
| exactly this.
|
| e.g. Fidelity has a significant investment in SpaceX
| through a handful of their mutual funds, which you can
| then purchase and basically invest in SpaceX indirectly.
| snowwolf wrote:
| Scottish Mortgage (SMT) in the UK does this and has a
| stake in Stripe (https://citywire.co.uk/investment-trust-
| insider/news/boost-f...)
| [deleted]
| jagged-chisel wrote:
| Publicly traded organizations can have any kind of
| private investment. I wonder, though, if there is
| regulation around how much of the public org's capital
| can be put in private stock purchases...
| [deleted]
| hartator wrote:
| I think some VCs are already also offering shares via
| mutual funds.
| Panther34543 wrote:
| Unfortunately many companies have clauses in their
| options grants that prohibit employees from selling
| shares to any investor not approved by the company board
| (e.g. EquityZen).
| [deleted]
| sudhirj wrote:
| I've seen companies doing buy backs to give people
| liquidity. In India, anyway. Check out Zerodha.
| andy_ppp wrote:
| If only Stripe would start a pre-ipo stock market. I guess
| only incumbent regulation prevents this, it's not a
| technology problem.
| jabo wrote:
| I believe Carta already does this: https://cartax.com/
| edoceo wrote:
| CarTax.com? Good jerb marketing team!
| jaywalk wrote:
| I'm sure OP was implying "for retail investors" in his
| wish. Carta is just another way for rich people to access
| things that are only available to rich people.
| andy_ppp wrote:
| I think Stripe pre-ipo-ing on their own platform would
| show great cojones, but I think they are more careful
| than I'd be about such things.
| arcturus17 wrote:
| You can buy it by proxy through funds or similar.
|
| I've been eyeing Scottish Mortgage which despite the name is
| actually a high-tech fund packaged as a stock publicly traded
| in the London Stock Exchange. They hold Stripe among many
| other interesting investments.
| petters wrote:
| Stripe is 0.9% of their holdings so they are of limited
| value of you sell exposure to Stripe specifically.
| boringg wrote:
| If you want exposure to them - go get Shopify stock - they
| just disclosed being in on the round of Stripe.
|
| https://betakit.com/shopify-reportedly-invests-in-stripe-
| bri...
| andymoe wrote:
| Cross posting this from Twitter but please consider marketing to
| states. They are using a company called IDMe to verify
| eligibility for benefits in the US and a family member (and
| thousands of others) have wasted days on the phone with them
| trying to get them to do verifications because their automatic
| verification tech does not work. (There are class actions against
| this co they are so bad)
| ianhawes wrote:
| This is a refreshingly affordable and beneficial offering.
|
| I did a deep-dive on KYC providers last year. The more well-known
| folks commanded 5 figure setup fees, wanted 1 to 2 year
| commitments, and sought to have you pre-pay for verifications. It
| reminded me of internet credit card processing pre-Stripe.
| xtat wrote:
| FWIW there are waaaay cheaper and yet decent options.
| donjh wrote:
| This marketing page is really delightful. The ID scan is a nice
| touch.
| 3np wrote:
| It doesn't have to be this way. What Stripe (and others) are
| doing is a compromise, specifically compromising integrity and
| privacy of individuals, or as we like to call them, users.
|
| There are ways to securely address the problems Stripe Identity
| is solving for that don't involve a single centralized honeypot
| that both collect and retain all identification documents, build
| profiles of individuals, and handles authentication and
| attestation. These should be broken up.
|
| A company like Stripe sets and maintains norms. They have the
| means to work towards something better, instead of bidding up on
| the status quo with a blackbox moated vertical integration where
| market capture wins over everything else. If we don't get either
| industry cross-collaboration on open federated standards and
| networks, the only option will be strong government regulation
| enforcing well-intended but poorly executed alternatives.
|
| There are a lot of existing work on more open protocols,
| federated standards, and whatnot. All of that is being ignored,
| and nothing else is proposed as an alternative.
|
| Both companies (Stripe Identity's customer base) and individuals
| deserve better.
|
| ---
|
| Anecdote:
|
| I apologize if I am more verbose than I would have been if I
| hadn't just spent most of the past 5h in a Kafkaesque series of
| phone calls with Paypal. Replace Paypal payments with Stripe
| Identity in the following and tell me I'm exaggerating when I say
| that this is a danger to society:
|
| I was trying to do a single webshop purchase where the vendor
| only had Paypal integrated as an option. Something (supposedly
| with my IP/browser) made them require registering an account to
| proceed, which required phone verification in the country of my
| credit card. Account immediately got flagged and completely
| locked before the purchase was completed, everything got changed
| to the language of my credit card country (which I don't speak or
| read) and they told me to call Paypal support in that country, on
| a given number. I called and despite speaking great English, they
| were unable to help me in English, and told me I had to call the
| NA support instead. The robot voice on the other end asked what I
| wanted and after a couple of honest attempts, I tried with "live
| agent". At first it seemed like there was no way to get to a real
| person instead of the robot. It demanded me to verify the credit
| card associated with the number I was calling from - a Skype
| number that is not on any account of mine. I persisted in saying
| only "live agent" as an answer whatever the question as the voice
| persisted in its demands for information, until after 6~8 I was
| actually patched through.
|
| I was after that escalated/sent around 5 different times, each
| agent taking a good time to repeat the same conversation from the
| beginning, making me repeat each line of information they had and
| a fresh round of either of SMS or e-mail validation. The final
| agent stayed with me for the last couple of hours as we went
| through everything in detail. They guided me through another
| e-mail validation, a password change, each step involving a
| browser taking painfully long time due to extended reCaptchas at
| every step. At some point it seemed like it would just not work
| as there was an infinite loop of reCaptcha and login form. The
| agent refused to proceed as apparently this was the only way to
| verify my e-mail address. All this as I was actually still logged
| into the blocked account and clicking links in e-mails. Trying
| from another device and network connection, that loop finally got
| broken. Eventually it came to that I had the option of an "appeal
| process", involving me uploading a photo ID. I said I was not
| comfortable doing that. My only option then was to close my
| account. Which requires providing a photo ID. At this point I was
| very frustrated and told the agent that as a resident of the EU,
| I would like to request data deletion. After arguing a bit about
| that, it turned out that there was another way to close the
| account, but it involved another appeal process. The agent told
| me that should take about 3-5 business days. After the call I
| received an e-mail saying account closure had been initiated but
| will take a minimum of 180 days to complete.
|
| As for the purchase, the same agent actually stayed with me on
| the line as we tried from the beginning to do a "guest checkout",
| which is what I had been attempting to do from the beginning. It
| took a bit of back and forth until the conclusion was "it usually
| works but computer says no and I can't tell you why".
| baybal2 wrote:
| I was once enticed by AirBnB's promise of "we don't store your ID
| data after validation"
|
| Few years down the line, it requested me to submit my ID data for
| a booking in China.
|
| All my ID data was pre-filled.
| msoad wrote:
| A host asking you to do something is not Airbnb asking you to
| do something.
|
| I know in China, the host have to submit a copy of your
| passport to the government for regulatory reasons. I don't like
| and I don't want to travel to China for similar reasons
| (Government is constantly spying on you). But it is not fair to
| say Airbnb is asking you for your ID.
| wyager wrote:
| His point was that they lied about not retaining ID.
| [deleted]
| baybal2 wrote:
| > A host asking you to do something is not Airbnb asking you
| to do something.
|
| It's not the host asking. In China, AirBnB does, it's a
| passport form in the app you can't skip.
| dvfjsdhgfv wrote:
| Even though I have zero confidence in similar claims by big and
| small players, in this case I would give them the benefit of
| the doubt and blame your browser instead, because exposing
| themselves in this way would be extremely stupid.
| smithza wrote:
| The poster said it was done in the App, not on the browser.
| brainzap wrote:
| All identity services we use keep all the data.
| dean177 wrote:
| Was this your browser filling for you?
| baybal2 wrote:
| Their app
| MetaWhirledPeas wrote:
| If this was an Android phone, Android remembers credentials
| at the OS level now. It'll prefill app forms.
| floatingatoll wrote:
| Was the data cached locally in your app?
| gpm wrote:
| That's still storing the data. Nothing says that the user
| typically lets this sort of information stay on their
| phone.
| scrollaway wrote:
| Difference being you're still in full control of that
| data, can delete it at any time, and Airbnb the company
| doesn't have direct access to it.
| gpm wrote:
| They're not told it's there, there is no tool for them to
| view the data, to see what kind of data is there, or even
| delete data short of deleting the entire apps data.
| Airbnb the company can access it at approximately any
| time by pushing out an app update.
|
| Legally you may have an argument, morally I don't think
| there's much of a difference. I would certainly not be
| pleased to find out an app was doing that.
| floatingatoll wrote:
| That's nice, but I'm not here to argue for one viewpoint
| or another, I'm just trying to explore the complaint that
| originated this thread.
| boulos wrote:
| Off-topic bug report: Montoya is the last name, not the first
| name. (Also, in the book / movie the spelling is Inigo not Inigo
| nor Inigo, but people use all the variants)
| spywaregorilla wrote:
| How does this work?
| ceejayoz wrote:
| > Detect fake IDs and spoofed photos with machine learning
|
| > Match the ID photo with selfies of the document holder
|
| > Validate SSN and addresses against global databases
|
| Seems fairly clear.
| Muromec wrote:
| So you just need to print physical (fake) id and claim to be
| in Europe to get around all three.
| andylynch wrote:
| This sort of thing is definitely usable in Europe; if
| you're thinking of GDPR the legitimate interest and legal
| obligation rules are likely to apply to users of this
| product. Eg at least one of my banks uses something like
| this for account identity validation (I see KYC is high on
| their list of use cases). Things like car rentals would
| find this really useful too.
| c7DJTLrn wrote:
| Awesome, can't wait to be irreversibly put on a blacklist
| because a black box algorithm has decided something doesn't
| look right.
| pc wrote:
| It's actually pretty cool (IMO; I'm biased). Drop-in browser-
| based user authentication that:
|
| * Uses various sophisticated heuristics to detect real vs fake
| IDs.
|
| * Matches the ID to the human face.
|
| * Detects whether the human face is live or not.
|
| * Dynamically requests more or less information depending on
| the confidence level.
|
| It also gets better over time based on the attacks and fraud
| attempts that Stripe itself sees.
| spywaregorilla wrote:
| Ahh I see. This is really great.
|
| Those are 4 great bullets btw. They helped me understand the
| service a lot more than the landing page for identity. Might
| want to consider a view like this.
| nceqs3 wrote:
| pc how are you biased? Do you work at Stripe or something?
| gip wrote:
| I think pc is one of the Stripe co-founder.
| [deleted]
| tomjen3 wrote:
| >* Uses various sophisticated heuristics to detect real vs
| fake IDs.
|
| This means it will fail for a few individuals and you will be
| stuck trying to reach support who are going to be pointless
| and useless.
|
| Mostly this will be an issue with people of non-white ethnic
| origins and people with older laptops/phones with poorer
| cameras.
|
| This is obviously a useful product, but it is one the world
| would be much better of if it didn't exist at all.
| sebmellen wrote:
| This is amazing. Did you build all of the scanning logic
| yourselves?
|
| We're exploring different options for scanning IDs like
| Anyline and BlinkID right now, but this looks incredibly well
| suited for what we're building and would save us a tremendous
| amount of time if it works.
| edwinwee wrote:
| Yes, we've spent a lot of time on the scanning logic--
| especially to help guide users through photo-taking, since
| that's half the battle for a successful verification.
|
| * Document detection
|
| * Blur and glare detection
|
| * Tool-tips during the user flow
| judge2020 wrote:
| https://stripe.com/docs/identity/verification-checks
|
| > Document checks verify the authenticity of government-issued
| identity documents. Stripe uses a combination of machine
| learning models, automated heuristic analysis and manual
| reviewers to verify the authenticity of hundreds of different
| document types.
|
| > Selfie checks look for distinguishing biological traits, such
| as face geometry, from a photo ID and a picture of your user's
| face. Stripe then uses advanced machine learning algorithms to
| ensure the face pictures belong to the same person.
|
| > ID Number checks provide a way to verify a user's name, date
| of birth, and national ID number. Stripe uses a combination of
| third-party data sources such as credit agencies or bureaus,
| utility or government-issued databases and others to verify the
| provided ID number.
| Dowwie wrote:
| @pc - This should be a pass-through / ephemeral type of service
| where a document is verified in-transit and then purged from
| memory. Stripe should not save any of these documents. Let Stripe
| customers deal with the decision whether to save in their own
| systems. Otherwise, this looks like yet another great value-added
| service -- congrats!
| jmuguy wrote:
| We've been using this to verify short term rental guests (non-
| Airbnb) for the past year and it's been extremely positive. Given
| that our guests have trouble even following a link for check-in
| the identity product has some great UX, they rarely get stuck on
| it.
| grey-area wrote:
| This is the problem I wish cryptocurrencies had focussed on -
| verified identity is the central problem in payments.
| ape4 wrote:
| I wonder... It can pull up a user's drivers license - so what
| about their covid vaccination record (maybe in the future).
| jokethrowaway wrote:
| I'm pretty sure it can't.
|
| They can't know for sure whether an ID is real or fake (they're
| not the government).
| pbowyer wrote:
| At work we do eIDV of customers and we tested 5 companies. One
| was quality but too expensive and required too large commitments;
| two couldn't detect badly photoshopped frauds we threw together,
| another couldn't detect a printed or on-screen copy of a document
| being captured (vs the real document - difficult to do, but
| important). The fifth which we're using can detect printed copies
| of documents around half the time, but their OCR is shockingly
| poor when it comes to recognising DoBs so we have to manually
| check and update the age.
|
| We'll try Stripe and see how much fraud they can detect.
| maxpert wrote:
| Will you update this thread? I am highly interested in results.
| pbowyer wrote:
| Yes - but it won't be for a few weeks as I'm on holiday and
| snatching 5 minutes unobserved on the laptop!
| Aaargh20318 wrote:
| It is absolutely impossible to validate the authenticity of an
| ID document from a photo. Even if you capture a high-res photo
| and have it inspected by a trained document expert.
|
| Fortunately, it is not necessary to do this. Modern passports
| and many identity cards contain NFC chips that allow you
| validate the data on an identity document with complete
| certainty (as in: you know that the data is correct and not
| tampered with). In the majority of cases (depending on the
| document supporting the necessary protocols) it is also
| possible to prove that the chip is authentic and not a clone.
|
| Since the chip also contains a good quality color photo of the
| document holder, it is then possible to match this with the
| person holding the phone and do liveness detection.
|
| Remote optical verification of documents is impossible, and
| anyone who claims they can do it isn't being honest.
| supertrope wrote:
| It's a cheap way out. Anti-counterfeiting feasures like color
| shifting ink, paper feel, polymers, watermarks,
| microprinting, UV strips cannot be checked over a webcam.
|
| Original paper documents are an anachronism. Any serious ID
| verification involves phoning home. Like police searching
| their database, border guards scanning your passport, or
| calling the car insurance company. Visa has depreciated
| offline EMV transactions. Offline credentials can't revoked
| so there's only the expiration date.
| Aaargh20318 wrote:
| You don't need to call the issuer. The NFC chip contains
| data signed by the issuing country. All you need is a list
| of trusted country CA's.
|
| You can check if it's an original by performing a
| challenge/response protocol. You can read a public key from
| the signed data, the private key is not externally
| accessible. You ask the chip to sign some data with it's
| private key and you check against the public key.
|
| You can do all this from a mobile phone.
| orf wrote:
| Why hide the names of the companies you tested?
| Ensorceled wrote:
| NDAs?
| mousetree wrote:
| Very curious to hear your results. In the past we used Onfido
| but eventually switched to Jumio. This was mostly due to Jumio
| performing better with Passport and VISA documents. We may in
| future move to Persona as we use them for SSN verifications and
| their customer support / account management team is fantastic.
| f38zf5vdt wrote:
| Does Stripe intend to make a giant online database of
| international identity documents? Why should we trust Stripe to
| secure these? It could be Equifax levels of problematic if there
| would be a intrusion, but I also can't tell how Stripe plans to
| use this information.
| jtsiskin wrote:
| Remember Stripes main offering - credit card data. They are
| already PCI compliant
| rejectedandsad wrote:
| Stripe hires elite Stanford grads unlike Equifax is the
| simplest answer they probably wouldn't say publicly. But the
| pedigree and engineering talent is miles better.
| objclxt wrote:
| There isn't a correlation between graduating from Stanford
| and being able to write secure code.
|
| If there was, all black-hats would be coming from Ivy League
| schools. They're not.
| oefrha wrote:
| Being a Stanford grad myself, I wouldn't put too much trust
| into Stanford grads, or <any elite university> grads.
| rejectedandsad wrote:
| In what sense? Looking at incoming classes it's apparent
| you people are objectively superior to people like me
| before college than I am several years after. It's almost
| definitely innate too, all the more depressing for
| strivers-turned-failures/underachievers like myself.
|
| The Stanford thing was really the basis for Palantirs
| competitive advantage in the consulting space over
| companies like Booz Allen Hamilton etc.
| imhoguy wrote:
| I don't think they are going to beat Facebook in this race.
| edwinwee wrote:
| No. 1. Stripe cares tremendously about and knows the importance
| of security--we've learned a lot from securely processing
| hundreds of billions of dollars in payments annually, and
| Identity is built from those learnings.
| (https://stripe.com/docs/security/stripe).
|
| 2. Any biometric identifiers that are created to perform the
| verification are never stored or retained--they are fully
| removed from all of our systems within 48 hours (usually within
| minutes).
|
| More on this at https://support.stripe.com/questions/managing-
| your-id-verifi....
| huhtenberg wrote:
| The problem is that companies evolve, ethics change, but the
| data and vendor lock-in remains.
|
| No need to go any further for an example than Google and its
| "Don't be evil" somehow evolving into "Normalize the creepy".
| f38zf5vdt wrote:
| > We will typically store the rest of your submitted identity
| information for 3 years. This includes all images captured,
| extracted data from your ID document including name, date of
| birth, and ID number, and any information submitted via forms
| such as name, date of birth, SSN, email, and phone number,
| and the verification response.
|
| That doesn't make me feel a lot better. :( The images are
| enough to generate biometric data such as facial recognition
| profiles.
| edwinwee wrote:
| We are very specific about collecting consent before doing
| anything with your data. We ask for permissions before
| beginning the verification process, and if you consent, we
| will only use your biometric identifiers for the
| verification itself. (And again, those identifiers--which
| contain the most sensitive info--aren't stored.)
| Specifically, we ask for an additional level of permissions
| before conducting any additional biometric analysis.
| https://support.stripe.com/questions/common-questions-
| about-...
| michaelt wrote:
| _> We are very specific about collecting consent before
| doing anything with your data._
|
| How do you foresee that consent working if your product
| is used in account recovery flows?
|
| For example, imagine if Steam adopted Stripe Identity as
| their only way to allow people with $$$$ worth of games
| to recover hacked accounts. If the user's only choice is
| to "consent" or lose their valuable account, that makes
| the "consent" something of a joke.
|
| I'd be interested to hear how you plan to square that
| circle!
| oefrha wrote:
| I think you might be missing the point. I'm sure gp does
| not doubt that you collect consent before collecting and
| using data. However, when presented with the choice of
| not giving up personal data and not using
| $awesome_service (or maybe even $essential_service), I'd
| imagine all but a very tiny percentage of people would
| reluctantly give up personal data. The data is then
| stored for three years, and if there's ever a leak, it
| would be hugely damaging given the scope:
|
| > all images captured, extracted data from your ID
| document including name, date of birth, and ID number,
| and any information submitted via forms such as name,
| date of birth, SSN, email, and phone number, and the
| verification response.
| theptip wrote:
| Any Money Services Business / payments processor needs to
| adhere to strict government regulations. In the US this
| would be (among other things) the Banking Secrecy Act:
| https://www.occ.treas.gov/topics/supervision-and-
| examination....
|
| It's simply not legal to "not keep records" if you are
| running payments.
|
| If you ran a payment to "O Bin Laden" but you have a
| driver's license picture showing that it is Oscar Bin
| Laden, from CA, DoB 2001, you'd better keep all that
| information for your records in case you get audited for
| potential OFAC violations.
| tchalla wrote:
| Well, I don't believe what Stripe (or anyone) says; I believe
| what you do.
|
| Does Stripe have a legal contract with users that says
| something to the effect of "if it does 1 and 2 above (by
| mistake or by choice doesn't matter) - that they will be
| liable for it". If not, all the support documents and
| technical security documentation is moot. I want to see "skin
| in the game" by Stripe. If you're so sure about "security"
| sign a legal contract.
| [deleted]
| mtnygard wrote:
| Exactly right.
|
| Trust and goodwill is enough to get me to consider a
| service, not enough to sign up.
|
| Also, data outlives management regimes. Eventually, any
| data set that can be used will be used.
| nightpool wrote:
| This is only about the specific image processing Stripe does
| to match your selfie with your ID document. The rest of the
| information on the document--which is what the GP comment was
| asking about--is retained for 3 years. Referencing the 48
| hour retention period instead of the 3 year one is very
| misleading in this case.
| edwinwee wrote:
| Since we are storing these IDs on behalf of businesses
| using Identity, we need to retain non-biometric information
| for a period of time to support their use cases.
|
| For example: KYC is a core use case for identity, which
| requires us to retain ID information for audit purposes.
|
| For businesses who don't need to keep the ID for as long,
| we provide a deletion API that lets them automatically
| delete the IDs from our system.
| nightpool wrote:
| Yes, I agree that Stripe's policy makes sense here. But
| your original comment was misleading, in that it implied
| the information contained on your ID card was deleted
| after 48 hours. (It looks like you may have since edited
| it to clarify that you were talking about biometric
| signals? Maybe you haven't edited it, but it was
| definitely unclear enough that I, like the other
| responders, was confused.)
| rokobobo wrote:
| I never wanted Equifax to have any of my data, and yet here we
| are. After the breach, I wouldn't ever be a paying customer to
| them if I had a choice. (Indirectly, I am still a "customer" in
| the sense that they probably still have my data and get new
| data about me--but apart from canceling all my cards, not sure
| what choice I have). In comparison, Stripe seems to charge for
| each product it offers. I think that's a more fair and
| transparent model.
| NegativeLatency wrote:
| For equifax you're the product, not the customer
| tchalla wrote:
| > In comparison, Stripe seems to charge for each product it
| offers. I think that's a more fair and transparent model.
|
| They could be charging you AND creating an international ID
| database.
| rokobobo wrote:
| Edit (sorry, I don't think I can edit my own comment at this
| point): I think I was missing the point. Storing user data
| for 3 years after verification seems unnecessary for the
| user. So yes, it does sound like some data-mongering f*ckery
| is going to happen/is happening.
| franciscop wrote:
| Vote for representatives that pass laws similar to the GDPR
| but for USA? If Equifax or you were EU-liable, you could ask
| them to show, modify or remove any and all of your data.
| f38zf5vdt wrote:
| If the company you're interacting with uses Stripe ID
| verification and you are forced to use it to pay them, I'm
| not sure it's much better than going to a bank and opening an
| account and then Equifax getting the information immediately.
| falcolas wrote:
| You are not a credit bureau's customer - the stores, public
| utilities, cell phone companies, banks, and so forth, are.
| They share that information to minimize their risk in
| extending credit (even something like billing you at the end
| of the month for services rendered is a form of credit) to
| you.
|
| And frankly, if Stripe is offering any form of credit, it's
| likely working with the credit unions too.
| nightpool wrote:
| These databases already exist. For example, all driver's
| licenses issued in a state are part of the public record, and
| many companies already maintain databases of them. For example,
| you can sign up for an account with the NY DMV that allows you
| to search all DMV records, as long as your use falls within one
| of a dozen permissible use-cases (including "To verify the
| accuracy of information submitted by the individual to the
| business"). Identity documents are designed to be _verifiable_
| , which in this case generally precludes them from being secret
| arthur_sav wrote:
| Seriously.
|
| The only way i would trust such a thing is if i have complete
| control over my data and how it's used (that's probably never
| gonna happen from a for-profit imo)
| tootie wrote:
| These databases already exist. Typically the way it works is
| after you claim an identity, they will look up past addresses,
| phone numbers or employers then present multiple choice
| questions asking which one is part of your past. The companies
| I've seen that do these are not hosting (or claim to not host)
| any of the data, but rather have hooks to fetch it from
| financial institutions. I think it's mostly credit bureaus, but
| could also be banks.
| ______- wrote:
| > It could be Equifax levels of problematic if there would be a
| intrusion
|
| I'm sure they're not as lax as Equifax. I would hope that
| Stripe compartment all these documents so that a compromise of
| one database is not a compromise of the _whole_ database. That
| 's basic data storage hygiene in the information age. `Don't
| put all your eggs in one basket` as the saying goes.
| f38zf5vdt wrote:
| I think the Estonian e-Card scheme is the right one despite
| hiccups in its implementation and ID verification should be
| the domain and responsibility of governments. Each ID card
| has an embedded private key-public key pair and you can sign
| to reveal your identity without having to resort to giving
| away anything else about yourself. There is already a zero-
| risk way for customers to verify themselves, so giant ID
| databases are a step backwards.
| dante_dev wrote:
| Many other countries in Europe can do it as well.
| The electronic identity cards of Austria, Belgium, Estonia,
| Finland, Germany, Italy, Liechtenstein, Lithuania, Portugal
| and Spain all have a digital signature application which,
| upon activation, enables the bearer to authenticate the
| card using their confidential PIN. Consequently they can,
| at least theoretically, authenticate documents to satisfy
| any third party that the document's not been altered after
| being digitally signed. This application uses a registered
| certificate in conjunction with public/private key pairs so
| these enhanced cards do not necessarily have to participate
| in online transactions.
|
| [0] https://en.wikipedia.org/wiki/National_identity_cards_i
| n_the...
| _jal wrote:
| >I'm sure they're not as lax as Equifax
|
| I am too, but that's not an endorsement. And more
| pertinently, that is nowhere nearly enough.
|
| Every database of value tends towards uncontrollable sharing
| over time. The more available and more valuable it is, the
| harder it is to fight that trend.
|
| The best thing for humanity is to stop making high-value data
| hordes like this. Unfortunately, the interests of smaller
| groupings are the reverse.
| nceqs3 wrote:
| If Stripe were to get hacked who would pay the GDPR fine?
| ceejayoz wrote:
| Their insurer?
|
| (I'd also expect the ID photos etc. aren't stored long-term.)
| ForHackernews wrote:
| This sounds hopeless naive. Do companies even bother carrying
| insurance for data breaches?
| ceejayoz wrote:
| Yes?
| [deleted]
| andylynch wrote:
| In their TOS and Privacy Policy it's made clear they are also
| data controllers. Unless you contribute to the breach it would
| almost certainly fall on them.
| edwinwee wrote:
| Yep, Stripe would be the data controller in this situation
| (and we comply with GDPR).
| https://support.stripe.com/questions/managing-your-id-
| verifi...
| anilakar wrote:
| As USA is no longer Safe Harbor compliant, transferring PII
| outside EU's jurisdiction requires a legitimate interest.
| Does Stripe do the assessment on behalf of its customers,
| or does it rely on the customer being truthful and risk
| exporting data without consent?
| edwinwee wrote:
| Stripe supports the legal processing and transfer of data
| by our users -- and EU requirements are top of mind.
| (Feel free to me at edwin@stripe.com if you have more
| questions.)
| motives wrote:
| Out of curiosity, given that this is among the most
| sensitive PII that can be stored, where is this data
| located for Stripe? I think this looks like an excellent
| product and can absolutely see the utility for so many
| businesses, but as a European I would never want such data
| to be stored outside of the EU. If there could be
| flexibility in the location the data is stored I think many
| European customers would appreciate that. Thanks.
| edwinwee wrote:
| We store data in the US right now
| (https://support.stripe.com/questions/managing-your-id-
| verifi... ), but we'll look into region-specific storage
| in the future.
| [deleted]
| mvanga wrote:
| Amazing how Stripe consistently executes fantastic solutions for
| all the very real and difficult pain points of building
| commercial products on the web. Fantastic work!
| ericlewis wrote:
| Has anyone used this? If so, how fast does it seem?
| edwinwee wrote:
| Verifications typically happen in 2 minutes, oftentimes 30
| seconds (for common IDs like state driver's licenses). And
| we're working on making this faster!
| willeh wrote:
| Absolute game changer, other actors in this market have big bulky
| sales processes with difficult pricing models and high
| commitment. If Stripe is competitive on pricing they will
| definitely win this market.
| Sr_developer wrote:
| This is a little Big_Brother-esque for my taste.
| xyst wrote:
| Besides banks, brokerage, my accountant, or the government. Why
| would I give a private entity my ID to store as a 'global' user?
|
| Sounds like an epic data leak that's waiting to happen.
| jsonne wrote:
| Can't tell you what a lifesaver this is and we're so excited to
| give it a shot. One of the challenges of adtech is there's a lot
| of bad actors trying to defraud ad platforms and a non
| insignificant amount of our time is thinking about how to
| minimize (can't eliminate) fraud. Having this baked into Stripe
| is a small miracle for us.
| rbaxt wrote:
| One of the creepiest products of the last decade. Let's wait for
| the inevitable data breach.
| cyral wrote:
| Better than every company that needs to comply with KYC
| developing their own half-baked solutions.
| Mindwipe wrote:
| Not really, it would be better for KYC to collapse under it's
| own weight.
| traspler wrote:
| Does anyone know if it does liveness checks for the "selfie
| verification"? The docs are a bit vague on that.
|
| And do I understand "Stripe uses a combination of machine
| learning models, automated heuristic analysis and manual
| reviewers to verify the authenticity of hundreds of different
| document types." correctly in that I do not only upload
| video/images of my passport, face to stripe for automatic
| analysis but in some cases a human would even review it? Or is
| this a specific option I could choose?
| edwinwee wrote:
| Liveness check is coming soon!
|
| At the moment we take live photos of the individual to help
| confirm that there's a real person behind the camera.
| [deleted]
| MattIPv4 wrote:
| Having experienced the end-user flow for Identity when doing bot
| verification on Discord, this was an incredibly seamless product
| back then, when it was presumably in beta. Can only imagine its
| even cleaner and faster now its officially released.
| ericlewis wrote:
| Curious, do you recall if it was slow? like, great than 2
| seconds or?
| terminator38 wrote:
| > Access captured images of ID documents and selfies
|
| Why is this necessary? I thought the point was to trust Stripe
| with this data instead of many small companies which could abuse
| the data
| rStar wrote:
| it's a data black hole. just wait a few years.
| elric wrote:
| There's definitely a market for this. Back when I worked in porn
| (in the camming sphere), we had a team of moderators whose main
| job was verifying the identity (especially age) of performers.
| With over 10k performers, this was a lot of work. And you can't
| just do it once. You have to do it every time a performer starts
| a performance. People would try all sorts of tricks, like taking
| a picture of themselves with an older sister's ID, all kinds of
| fake IDs, some better than others. Verifying an identity over
| webcam is no easy feat, those moderators had to be able to tell
| different passports apart (many, many, nationalities), tease out
| the fakes, and then make sure that they person in the ID is the
| same person presenting the ID. Problem is multiplied by the
| number of performers in the room. Performers who are eager to
| start making money instead of satisfying the moderators
| checklist.
| cam-perry wrote:
| Agreed, there is a big market here. I worked on a real estate
| rental platform where we required ID verification for all
| listings and applications. At the time we used Berbix (YC
| company), which is practically the same as Stripe Identity. I
| would probably just use this Stripe feature today, since we
| were already using Connect for payments.
| whimsicalism wrote:
| > like taking a picture of themselves with an older sister's
| ID, all kinds of fake IDs
|
| How would Stripe solve something like this?
| elric wrote:
| Oh I'm not saying Stripe has a magic way of solving this. I'm
| merely stating that this is a hard and annoying problem, that
| many businesses would gladly let someone else handle.
| hn_throwaway_99 wrote:
| The Stripe Identity product is fantastic. Some of the most
| impressive things:
|
| 1. If you are at a desktop, there is an easy transition to using
| your phone to take a picture of your ID (or a selfie if that's
| the use case - it will match selfies with ID photos), and then
| complete verification on the desktop.
|
| 2. It does all the image analysis (i.e. is the ID in focus, etc.)
| _in browser_ without the need for a native app.
| anonymouse008 wrote:
| This almost proves that webapps are a competitive substitute to
| AppStores - making the consumer detriment very hard to prove in
| the current anti-trust framework.
| patrickmcnamara wrote:
| Proves it for this one use case maybe. I don't even think you
| can get webapp notifications on iOS.
| jtbayly wrote:
| The fact that Apple has refused to deliver that only proves
| the point. If they did, many apps wouldn't be forced to be
| in the App Store. It's certainly possible, as iirc, it
| works on Android for years now.
| jsmith45 wrote:
| Incredibly annoying that apple does not support this,
| while also trying to crack down on apps that is
| considered to just be a wrapped web-application. (In
| which case they want you to make a proper web app
| instead). Even using notifications is not considered
| enough of a reason to get an app they feel is just a
| wrapper approved.
| Me1000 wrote:
| They have supported it on desktop Safari for years, so it
| really is just a political decision for them at this
| point.
| jtbayly wrote:
| Financial decision, more like.
|
| They are using it to force developers who don't need the
| App Store to use the App Store. Thus, Apple can force
| them to pay their tax.
| yunohn wrote:
| This is not an app, more like a rich form? It just so happens
| that the APIs it needs are available in mobile browsers, i.e.
| camera.
|
| Other apps cannot do the same.
|
| Like messaging or social networks need things like
| notifications. Or those for IoT related tasks, which would
| need Bluetooth or such.
| wongarsu wrote:
| Google is certainly trying. On Chrome for Android you can
| do both of those. Whether that's a good thing is debatable
| though.
|
| https://developer.mozilla.org/en-
| US/docs/Web/API/Notificatio...
|
| https://developer.mozilla.org/en-
| US/docs/Web/API/Web_Bluetoo...
| yunohn wrote:
| Nobody forces you to use PWAs. I'm tired of this constant
| PWA bashing on HN.
| roblabla wrote:
| The problem with having those APIs in the browser is that
| it increases the attacker surface area, which makes the
| browser less secure for everyone, including those who do
| not use PWAs.
|
| The only saving grace is that you have to accept the
| permission box (I hope so at least...), which, for the
| average user, may not be much protection.
| samtho wrote:
| Simply existing in the world increases your attack
| surface; everything is a trade off between usability and
| security. Given the pressures browsers are under, they
| have incentives built into their business model to
| provide very good security which is a departure from most
| other software where security is just a nuisance at best
| and totally ignored at worst.
| wyager wrote:
| People bash them because they suck 99% of the time.
| darksaints wrote:
| Okay stretch armstrong
| kgraves wrote:
| how are mobile notifications on the web going for iOS?
| anonymouse008 wrote:
| Said it in another thread -- SMS's are a tangibly better
| user experience. You get to say stop in the moment, instead
| of searching through opaque settings... you can set DND to
| certain numbers for certain times...
|
| The whole ecosystem is there and very few are playing with
| it.
| easrng wrote:
| On Android you: 1. Swipe the notification
| halfway to reveal the buttons 2. Tap the options
| button 3. Flip the switch that shows up
|
| On SMS you: 1. Tap reply on the
| notification 2. Type STOP (4 taps or one swipe)
| 3. Hit send
|
| There's no difference in complexity, if anything SMS is
| more complicated and less discoverable.
| ceejayoz wrote:
| Any iOS notification permits you to "say stop in the
| moment" - you just swipe on the notification and select
| "Manage". The options are pretty well thought-out.
| anonymouse008 wrote:
| That's actually a whole different user flow -- you leave
| the notification to enter a separate system of controls
| with esoteric commands, over just typing what you want to
| happen..
|
| "Stop" - forever until I want you back
|
| "Stop this week" - self-explanatory
|
| "Not during work hours" - also ^
|
| "Consolidate weekly" - get a digest
|
| "I don't care" - make better suggestions
|
| So many contextual pieces to make better notifications
| are right there... and though a toggle button appears to
| be 'easier' the cognitive dissonance is less the
| conversational environment of SMS.
| ceejayoz wrote:
| Texting "stop this week" will stop SMSes from that number
| forever because of the STOP keyword.
|
| I've never seen any SMS system that would correctly
| interpret and adjust to things like "not during work
| hours" or "consolidate weekly" responses.
| anonymouse008 wrote:
| > I've never seen any SMS system that would correctly
| interpret and adjust to things like "not during work
| hours" or "consolidate weekly" responses.
|
| I know!! I built a stupid simple bot for myself that just
| reminds me of things I want in SMS form... I text it
| things like 'For tomorrow - x, y, z' and then 9am the
| next day it messages with what's behind '-'...
|
| There's a bit of configuration the first time you text
| the bot, for timezones and things like what does tomorrow
| afternoon mean to me? 2pm or 3pm? If multiple 'tomorrow
| afternoons come' do you want that as a digest or just
| individually, or w/e.
|
| But for me, I love it because I forget things so quickly,
| so as I quickly as I can send a text, I can get reminded
| at an appropriate time. (and yes, I hate reminder apps.)
|
| I'm still struggling how to keep it 'safe' - because
| Twilio keeps all the message data in plain text (more a
| byproduct of SMS) and holds a record of it, so while I
| can encrypt the db entries, I'm not sure how to make it
| 'secure' for other folks yet.
| FearlessNebula wrote:
| SMS aren't encrypted. I don't want my mobile carrier
| knowing whatever sensitive data is being sent as a push
| notification.
| anonymouse008 wrote:
| This is the biggest drawback and requires creativity -
| but yes, the central issue.
| lxgr wrote:
| SMS are a _horrible_ user experience for notifications!
|
| For push notifications, I can set them to silent by
| application, they take me to the right place in the app
| when clicking them, very often they offer quick responses
| directly from the notification itself...
|
| Finally, it's bad enough to require a phone number for
| 2FA (or worse, as the primary user identifier). Why
| should I have to give my phone number to a service?
| flixic wrote:
| SMS messages are probably 1000x to 100 000x more
| expensive to send than push notifications.
| anonymouse008 wrote:
| Sounds like better incentives for customers.
| easrng wrote:
| Push is free, assuming you have network connectivity, and
| 100000*0 is still 0.
| iudqnolq wrote:
| Edit: Totally wrong
|
| You need to buy from apple/google if you want battery
| efficiency, as you want to be included in the one
| persistent channel the OS manages.
|
| Even without that your own servers cost money.
| lxgr wrote:
| Apple's and Google's services are free, as far as I know;
| it's only if you want to send through some third-party
| provider that you pay per message.
| iudqnolq wrote:
| Thanks for the correction
| edwardmp wrote:
| This sounds exactly how Onfido does this as well. Either it's
| inspired by this, or they are just wrapping the Onfido APIs.
| tomjen3 wrote:
| Just be aware that, no matter how seamless it is, you still
| getting crazy bounce rates for it. You would need a really good
| reason to use it (basically, be a bank and need KYC or
| something).
| PanosJee wrote:
| Several richly valued startups must be having a nervous breakdown
| right now.
| pg_bot wrote:
| Any folks at Stripe want to chat about a HIPAA compliant version
| of this? I know some folks who may be interested...
| myko wrote:
| Sign me up for that discussion as well
| morpheuskafka wrote:
| Worth noting that if you need the SSN verification for a
| marketplace type app for tax compliance purposes, the IRS has a
| free taxpayer ID validation service you can use. The SSA also has
| one that employers can use.
| JacobiX wrote:
| Unfortunately for this demo, they will successfully verify
| everyone. I was hoping for a real demo, in the past I had some
| interesting problems with selfie KYC checks because the photo in
| my passeport and my actual look are quite different ...
| gip wrote:
| I've worked in risk & fraud for some time now. As online
| platforms become mainstreams and are easier to build I think
| Trust and Safety is going to become the key differientiator.
| Stripe Indentity will no doubt play a big role and benefit the
| whole internet.
|
| Are any accuracy numbers for Stripe Identity currently available?
| I'm working with a merchant in Europe who is struggling due to
| fraud. Would be cool to figure out if Stripe Identity will
| improve over their current solution.
| paulcnichols wrote:
| Was this product from an acquisition or home grown?
| seaorg wrote:
| I've been saying for years that identity services will be a huge
| deal. In a world where captcha is less and less reliable and
| where fake posts are cheaper, faster and more convincing (GTP),
| there are almost no websites that can function without using an
| identity service. I've been screaming from the rooftops and
| nobody listened.
| pqdbr wrote:
| Any estimates of when this will be available for Brazil?
| evtothedev wrote:
| I am so excited to see this!
|
| Previously, you'd have had to use something like Jumio for this,
| which was (to be generous) pretty wonky.
| motohagiography wrote:
| Smart. Banks haven't been allowed to monetize their KYC data, but
| this new non-bank class of payments companies have this
| opportunity. Interac has been trying to do this for many years.
|
| Some years ago I worked on a system let banks do identity
| assertions with proofs via SAML attributes instead of sharing
| customer PII. It is now a federation of banks in wide use for
| govt services in Canada. The use cases were really limited
| because the federation partners were too conservative to extend
| the identity services to relying party consumer applications real
| people actually wanted to use, and institutional sales cycles
| meant product feedback was glacial, so it has existed for over a
| decade in this relative backwater of gov-tech. I think identity
| companies have mostly failed to get traction because of a
| terminal lack of consumer sexiness, whereas Stripe has the jelly.
|
| Other companies in the identity space have been working on
| protocols and platforms, but none of them had a user base to
| extend an identity federation services into, which means they
| have never been able to make a real or viable product, just
| interesting techs. An internet payment provider with young
| consumer traction getting into identity is a Very Big Deal.
|
| It's going to position Stripe to knock out a lot of retail banks
| who can't offer similar services. Imo, this could make them
| bigger than Apple.
| cycop wrote:
| "Banks haven't been allowed to monetize their KYC data"?
|
| I work for a major US Bank and they are most definitely
| monetizing KYC data, in fact we have made several billion
| dollar acquisitions just to scoop peoples data.
| motohagiography wrote:
| The convention in Canada was there were limits on how much
| customer PII banks and the payment networks could collect,
| use, and share or sell, and how. "Monetize," in my comment
| means "sell to others like a social platform / ad-tech
| company," whereas I would agree it could be monetized in
| other ways.
|
| What I see is that Stripe doing IAM for platforms and
| services that people use daily sets them up to dominate
| retail and small business banking services if they wanted to
| go there.
| jsmith99 wrote:
| Do banks _want_ to monetise their KYC data? In the UK, the
| government launched a similar system in 2014 called Verify, a
| platform for banks and other firms with existing customer
| relationships to offer identity verification as a service to
| the government, and eventually, third party sites. Users would
| choose a participating bank they has a relationship with and
| login to their account as verification.
|
| But despite paying over PS20 a user for each verification they
| only got one or two banks to join, and the scheme was a
| disaster.
| TheTrotters wrote:
| In Poland I can use my bank login (a "Trusted Profile") to
| sign in to government websites and access my data.
|
| E.g. when I registered for Covid vaccine I logged in using my
| bank login.
|
| There are other ways to do it too but since I already had an
| account in a participating bank I didn't bother looking into
| them.
|
| I don't know if banks earn anything from it. I'd be surprised
| if they did.
| throwaway201606 wrote:
| Actually, it seems that this did go into production - you can
| now verify identity using the service. For example, you can
| identify yourself for Govt. of Canada services (immigration,
| taxes) by logging into to your banking platform that then
| vouches for your identity using a service called
| SecureKeyConcierge / Verified.Me - note that ALL of Canada's
| major and quite a few minor banks are signed up to the service.
|
| See this page:
|
| https://services.securekeyconcierge.com/cbs/saml/login?l=1&l...
|
| The way the service works by getting permission from you, the
| user, to share some part of your identity with the destination
| and you can chose what you share. You could pick for example
| just to share name and not DoB.
|
| The one reason I hate this otherwise superbly designed service
| and refused to use it is that is has a dark pattern where it
| creates a "SecureKey / Verified.Me Concierge Account" for "you"
| when you use it and starts proxying/pre-emptying the bank-
| login-as-verification process.
|
| WHICH IS STUPID AND SCAMMY IF YOU ARE READING THIS VERIFIED.ME,
| THIS IS DARK PATTERN BEHAVIOR AND IT IS NOT RIGHT OR FAIR
|
| /start rant
|
| From my perspective, the whole point is - inhale - "I sorta
| trust my bank because I have to so I will log on to them so
| that they can vouch for me but I definitely don't trust you so
| why are you being a dick and making me make an account with
| your service that I don't trust and will never trust" - exhale
|
| Just let the bank vouch for me each time, this is what I expect
| a reasonable and non-scammy service provider to do. Don't wait
| till you have my info then tell me, hey, I will make an
| verified.met / secureconcierge account for you so that <insert
| your preferred monetization rationale here> before you do what
| you promised to do.
|
| I get the idea that they want to consolidate a profile so that
| you can pick what to share without entering it each time but
| they way it is done right now feels really slimy.
|
| /end rant
| sublimefire wrote:
| There is still some room for improvement:
|
| * country code search - allow to search by a full country name or
| by other types of code. Was searching for Ireland and "irl",
| "ire" does not yield any results, only a direct match to "ie"
| does.
|
| * "Provide personal information" - could default to the country
| where the text message went or at least could have a search
| instead of a <select>
|
| Not sure if it is possible but some of the orgs will ask to limit
| the phone numbers to just one region, e.g. only UK. I know I need
| to RTFM
| toomuchredbull wrote:
| Seems handy for building crypto companies
| gima wrote:
| EU is apparently about to design and roll out Europe-wide digital
| ID service:
| https://ec.europa.eu/commission/presscorner/detail/en/IP_21_...
| rattray wrote:
| Wow. Will it be good?
| gshakir wrote:
| Any connection to NIST 800-63-3 (Digital identity guidelines) ?
| Does it provide Identity assurance level 2 ?
| tracedddd wrote:
| I really despise this trend of uploading your ID and a selfie for
| verification. I know it makes sense in some legal frameworks, but
| beyond that I find it invasive and risky (and rude.)
| edwinwee wrote:
| It's not really a "trend"--if you think about it, ID
| verification is already required when checking into hotels,
| buying alcohol, or when visiting a bank teller.
|
| As more commerce moves online, Stripe Identity was built to
| significantly reduce the number of organizations and humans
| that would touch your ID--in a faster, secure way that's hosted
| by Stripe (https://support.stripe.com/questions/common-
| questions-about-...).
|
| We are also very direct about collecting consent:
| https://support.stripe.com/questions/common-questions-
| about-....
| seany wrote:
| It's not a good trend though. I actually prioritize doing
| business with vendors that don't do this (I only shop at
| stores that don't generally card for alcohol for instance)
| butt__hugger wrote:
| Why are you shilling the product you made out of data
| collection and surveillance if it isn't trendy? What other
| value proposition is there?
| wyager wrote:
| One of the nice things about the internet is/was that it
| requires less bullshit and red tape than many real-life
| interactions. The internet becoming as bureaucratic and
| oppressive as, say, international travel, is absolutely a
| trend - and a very harmful one.
| nowherebeen wrote:
| > It's not really a "trend"
|
| > As more commerce moves online
|
| It is very much a trend and that is very much what you are
| describing. The problem with identity verification is
|
| a) Business that have no business requesting them do so.
| Linkedin, Google, Facebook does this when they suspect you
| are a bot. But if you have been a long time user, they hold
| your account with your personal data as hostage. You cannot
| delete your account if you object to providing your official
| documents.
|
| b) There is very little legal protection if companies (not
| saying Stripe will) use your official documents to build an
| extremely detail online profile of you. Its all based on
| trusting what these companies say.
| tracedddd wrote:
| Just last month I had a DJ company ask for an ID and selfie
| for a $200 software purchase.
|
| Maybe these things are designed for KYC'ing crypto and buying
| alcohol but it's definitely a trend to apply this process
| broadly. All for the fear of generally preventing everyday
| fraud, piracy, and maybe just collecting data for some
| nebulous future use. Of course they rarely do the actual
| basics and apply any thought to not treating your real
| customers like criminals.
|
| I don't doubt Stripe can make the process better and do it in
| a good way, but can Stripe minimize what this process is even
| applied to in the first place and avoid manufactured consent.
| toufka wrote:
| In very few of those use-cases does the entity 1) _retain_
| any of that data, 2) posses an internet-scale database of
| identities.
|
| And as we've all come to know the distinction between "able
| to surveil" and "collect it all" crosses a threshold to make
| it of a different kind.
|
| If one's mindset is that in general, tech companies, unlike
| those other entities store it all, then there actually is a
| recent "trend" to migrate a normal behavior into an
| abnormally socially adjusted space.
| sascha_sl wrote:
| It is already illegal to retain copies of ID cards or even
| some of the data in many countries. Just requesting a copy
| without redactions is wandering into a gray area in
| Germany.
| [deleted]
| sascha_sl wrote:
| It also outright disincentivizes usage for some people. The
| biggest group is probably people without a proper ID (a very
| US-only issue), but I personally avoided showing or sending my
| ID anywhere before I was able to change my legal name to one
| that didn't make me want to rip my eyes out.
|
| MasterCard and their "True Name" program did a good thing
| there.
| TacticalCoder wrote:
| I recently had, twice, to do stuff WAY more intrusive.
| Video/conf call, need to hold my passport, need to have my
| phone on hand... People on the other side would call me on my
| phone to verify it's my number and they'd also send me a SMS
| with a code to verify on that phone.
|
| After that they have: my face, copy of my passport, my voice,
| my phone number, my IP (unless I'm really going out of my way
| to obfuscate it), my email, etc.
|
| Once I did this, then the series of documents to sign using
| Docusign came in.
|
| That was the most serious KYC/AML I've ever seen.
|
| I don't like it much but I gotta say: I can definitely see how
| it raises the bar for would be scammers/impersonators.
| cantrevealname wrote:
| You said it happened twice. I haven't yet had to face this
| level of intrusiveness, but I fear that it's coming for all
| of us. May I ask what companies these were? If you don't want
| to name the exact companies, could you say the general
| purpose (opening a bank account, buying or selling real
| estate, incorporating a business, etc.)? Also, which country
| (I'm assuming the U.S.)?
| huhtenberg wrote:
| Until these people are breached and someone takes out a
| mortgage in your name using all these lovely personal
| details.
| jmatthews wrote:
| Not to take away from the accomplishment, but hopefully the
| "selfie auth" isn't considered the penultimate verification. With
| no social engineering, just finding a public photo of someone,
| one could composite a short video that would be very hard to
| distinguish from reality.
| agwa wrote:
| Considering that Stripe was originally known for letting websites
| accept credit card payments without seeing your credit card
| number, one might assume that Stripe Identity only allows
| websites to see the verification result, and not your selfies and
| scans of your identity documents.
|
| That would be an incorrect assumption. Per
| https://support.stripe.com/questions/managing-your-id-verifi...
| customers of Stripe Identity have API access to "captured images
| of the ID document, selfies, extracted data from the ID document,
| keyed-in information, and the verification result".
|
| Thus, when you use Stripe Identity to verify your identity, you
| have to trust that:
|
| 1. The website doesn't download, retain, and later leak your
| selfie and identity information.
|
| 2. The website's Stripe API token isn't compromised and exploited
| by identity thieves to access your selfie and identity
| information.
|
| Stripe appears to be leaning heavily on their claim that they
| don't disclose "biometric identifiers" to websites and that these
| "biometric identifiers" are deleted from their systems within 48
| hours. This is extremely deceptive considering that biometric
| identifiers can be reconstructed from the selfie.
| mLuby wrote:
| I wonder if instead Stripe could have routed calls through
| itself, filling in the secret info. Perhaps it was discussed?
|
| For example, imagine Joe Biden buys a widget from WidgetsR.us
| and wants it shipped to his home address of 1600 Penn Ave in
| DC. WidgetsR.us -> Fedex.com/order_XYZ/ship-
| to/Joe Biden at 1600 Penn Ave in DC WidgetsR.us <-
| Fedex.com "201 CREATED"
|
| Instead they could route through Stripe (where 123_joe
| corresponds to Joe Biden's identity docs in Stripe), which
| fills in the missing info. WidgetsR.us ->
| Stripe.com/identity/123_joe?redirect=Fedex.com/order_XYZ/ship-
| to/$NAME at $ADDRESS Stripe.com ->
| Fedex.com/order_XYZ/ship-to/Joe Biden at 1600 Penn Ave in DC
| Stripe.com <- Fedex.com "201 CREATED" WidgetsR.us <-
| Stripe.com '"201 CREATED"'
|
| That way WidgetsR.us never knew the $NAME or $ADDRESS of user
| 123_joe, but was still able to use them. (Yes, they could send
| that info to themselves, but then they're on the hook for
| protecting it.) The huge downside here is putting Stripe in
| your business's critical path. But if it's already there for
| payments, then why not for identity?
| nrmitchi wrote:
| > Considering that Stripe's original selling point was that it
| let websites accept credit card payments without seeing your
| credit card number
|
| This is true, but it's also kind of a misleading statement; the
| original selling point was that you could accept credit cards
| without having to deal with the requirements of PCI compliance
| and merchant accounts, which is done (partially) by you not
| ever seeing the card data.
|
| If there was similar compliance regulation around document
| storage, I would assume that Stripe would use "Identity-
| Document-Standards" compliancy as a selling point. As far as I
| know, there are no such requirements.
|
| I do think your #2 point though is exceptionally valid, and
| would _hope_ that the majority of Stripe keys are scoped to not
| even provide access to this data /endpoints.
|
| _Edit:_ grammar
| edwinwee wrote:
| Edwin from Stripe here. The two cases are actually very
| similar. If you want to avoid ID documents ever being stored on
| your servers, Identity makes it easy to do that. (Just as
| Elements/Stripe.js makes that easy for card numbers.) On the
| other hand, if you want to score card numbers or ID documents
| (and there are sometimes good reasons for doing this!), Stripe
| makes that straightforward.
| agwa wrote:
| I do agree the cases are very similar, which makes it all the
| more jarring how differently Stripe treats the data.
|
| If you want to export credit card numbers from Stripe, you
| can only have it transferred directly to another PCI DSS
| Level 1-compliant payment processor, and Stripe imposes
| rather strict requirements on the transfer:
| https://stripe.com/docs/security/data-
| migrations/exports#whe...
|
| If you want to export ID documents or selfies, you can just
| make an API call or use the web interface. This can and will
| be abused.
| prague60 wrote:
| Conflating credit card #'s and personal biometrics/SSNs is
| your first mistake. You think they are the same, they feel
| the same, but the risk to the customer is so much bigger.
|
| When a hotel copies my passport, they get a jpg. If they use
| Stripe, now I know they have my biometrics serialized to
| JSON. That feels way riskier and scarier to me, especially
| now that it's all centralized by Stripe.
|
| We hear about our personal data getting leaked and hacked
| every day, and here is Stripe making themselves an enormous
| target and serializing all the data for malicious actors.
|
| This feels like a really tone deaf misstep by the company.
| wdb wrote:
| Hotels don't even get a full copy of passport but a
| redacted version of my passport. That's my government's
| guidance only select entities should get unredacted copies.
|
| If not possible, I should mark the copy to the specific
| user.
| ibeitia wrote:
| I'm an engineer on the Identity team. There are two
| somewhat separate questions here. (1) Whether the business
| should ever have access to this data. And (2) how exactly
| the business should access that data and the security
| properties around it. On (1) this data is fundamentally the
| user's, and there are often important compliance reasons as
| to why the user needs access to the raw data because of
| obligations that they themselves are subject to. It's
| important to remember that you should trust both Stripe
| _and the business_ that's asking you to verify your
| identity. They are in control of explaining to you how they
| are using this data and giving you an option to opt out--or
| lose you as a customer. On (2) we're working on a way to
| restrict access via secret keys very soon.
| PuffinBlue wrote:
| > On (2) we're working on a way to restrict access via
| secret keys very soon.
|
| Hmm, this doesn't really seem to me like the sort of area
| where you bring out a MVP and then work out basic
| fundamentals like this afterwards.
| tomc1985 wrote:
| It is trivially easy to key-in identity info from a JPG
| scan
|
| They are both toxic, IMO. Businesses need to stop relying
| on this stuff.
| xur17 wrote:
| Isn't the problem that businesses are required to store
| this type of information (kyc verification information)?
| At what point are we going to have a logical system for
| verifying identity that doesn't require transferring the
| same list of data that every other 3rd party you've
| verified with also has?
| openthc wrote:
| Right but -- the attack vector is different. Scan/parse
| 10000s of JPG, and all that jazz -- to get identites. Not
| Trivial. Or if the hotel stored the copy as a physical
| photo copy -- you're not bulk scanning 10k pieces of
| parchment at super speed for your identity-theft ring.
|
| But download JSON blobs? From 10k records the hotel
| didn't store properly (cause they are not IT experts, or
| don't have experts at close hand) -- if you get in to
| their system the JSON is loads easier to parse than the
| JPEG.
|
| Methods for KYC could(should!) be improved.
| tevonsb96 wrote:
| But like one of the Identity team folks said, the hotel
| would only have the OPTION to download and store those
| blobs. They aren't required to, and I'm assuming they
| would not. They'd be happy with the verification result
| and letting Stripe handle storing the PII.
|
| Speaking from experience as we use Stripe Identity, and
| love not having to store the PII.
| echopom wrote:
| It's unfortunate , I'm an Enterprise Architect in Banking and
| honestly I wouldn't have let that feature go in production.
|
| Businesses that do not have a legitimate reason to view my
| sensitive document like Passport , should not be allowed to do
| so.
|
| Only authorized institutions like Licensed Payment Institution
| / Banks / Insurances etc... should be allowed to do so and
| AFTER they've been approved.
|
| It's sad because you can tell right away that this will we be
| abused by Stripe's customers inadvertently. Just like Uber "God
| View" thats you view any customer ride...
|
| Pretty sure the amount of "Identity Theft" or "Privacy" Scandal
| is going to explode with such technology available for
| everyone.
|
| I don't know how a product manager at stripe could tell himself
| that "Yes , it make sense to give access to sensitive
| documents" in an age where people are seeking more privacy.
| ridruejo wrote:
| My take is that if you need it, Stripe will be better and
| more secure than rolling your own
| noizejoy wrote:
| More data concentration makes for a more worthwhile target,
| thus wiping out at least some of the potential upside. The
| net effect may very well be negative.
|
| Given the regular stream of extremely large data leaks even
| from providers who should have size, motivation and
| competency to protect that data, I find it incredibly hard
| to believe anyone who tries to assure me, that they won't
| be breached.
| wdb wrote:
| As a person that still is trying to recover from identity
| fraud that happened many years ago. I am always very weary of
| companies that demand ID papers. Most of the time I will
| avoid them.
|
| Most companies aren't even supposed to ask for identity
| papers is Stripe verifying with the passport issuer whether
| the country allows given their passport to some identity?
|
| I think there should be some sort of consent system built in
| were when the API consumer wants to download a passport the
| customer gets an email with the question if they consent in
| them fetching a copy.
| ROARosen wrote:
| > Businesses that do not have a legitimate reason to view my
| sensitive document like Passport , should not be allowed to
| do so.
|
| I get parent comment's totally legitimate security concerns.
| And businesses that have no business having my identity
| should surely not be asking for it. But I don't honestly
| understand how this has anything to do with Stripe. These
| businesses (which for whatever reason are asking for ID
| verification before doing business with you) are just using
| Stripes API to verify identity instead of just taking your
| info themselves.
|
| Any customer giving their information presumably _knows_ they
| are giving said business their identity documents, the
| customers might not even _know_ that the business is using
| Stripe 's API.
|
| Furthermore, Stripe is ostensibly coming in here to
| streamline the process for business taking identity info from
| customers. Why - in your opinion - is it worse for consumers
| when these-type businesses (which ask for identity), use
| their own-rolled id verification than using Stripe's?
| marzell wrote:
| You seem to be contradicting yourself. Businesses are
| asking for Stripe to verify identity. These businesses just
| need verification, not copies of documents, but Stripe
| makes them available anyway. That's the whole contention.
|
| As a consumer, I would expect Stripe would do the
| verification and give the business partner the result, but
| not all the data they used to get the results themselves.
| tevonsb96 wrote:
| I actually disagree with this as well. The Hacker News
| user is not the average user. The average user has no
| idea what Stripe is, they assume that the business
| requesting a verification will have access to anything
| they submit.
|
| I know this because we use Stripe Identity ourselves (in
| beta) and user's have no idea that Stripe and us are
| different companies.
| logifail wrote:
| > user's have no idea that Stripe and us are different
| companies.
|
| Doesn't that imply that if there's a security breach at
| Stripe, that your users will blame _you_ [too]
| booi wrote:
| That seems right. Businesses aren't islands, they work
| with other businesses to provide their services. But you
| as a business have an issue with a vendor/supplier,
| that's still on you. If McDonalds can't get fries, I
| don't blame farmer X for a failed harvest, I blame
| McDonalds for a fragile supply chain.
| bifrost wrote:
| We should figure out who McDonalds' ice cream machine
| maker is and ask them why their product keeps breaking
| down.
| wikyd wrote:
| This might be an interesting read:
| https://www.wired.com/story/they-hacked-mcdonalds-ice-
| cream-...
| echopom wrote:
| > Why - in your opinion - is it worse for consumers when
| these-type businesses (which ask for identity), use their
| own-rolled id verification than using Stripe's?
|
| The point isn't so much using third party , we use a third
| party on prem.
|
| My point is very simple : Why on earth would you let
| discord view my passport ? JUST WHY ?!
|
| Those documents are very sensitive and no one should have
| access to them unless they have a VERY good reason to do
| so. PCI DSS treat "card information" like hot lava, the
| same model should have applied here.
|
| Stripe should have acted as a "Trusted Party" and securely
| store those documents without giving access to it but just
| let you extract the information from it.
|
| Thus you would been able to have uniquely identified user ,
| backed up by government id , but you can't get access to
| the documents and sensitive data should have been redacted
| .... just like Card Number...
|
| Again unless you are a Fintech / Financial Instituion ,
| with a VALID in effect license , you should not have access
| to those documents.
| derefr wrote:
| If you've ever been carded at a bar/liquor store in a
| foreign country, then that random small business has seen
| your passport, no? How do you feel about that?
| KptMarchewa wrote:
| In EU, you don't hand over ID/passport like credit card
| in US. You show it while keeping it in your hand. Second
| party can verify your age, while being unable to copy
| stuff like machine readable zone.
| tracedddd wrote:
| Presumably they aren't taking photographs of the passport
| and viewing them at some later date from personal
| computers.
| supernovae wrote:
| Being human to human, unless they're wearing tech that
| would allow them to scan/archive it, normally they just
| verify (eyeball it) and you get it back.
|
| Here, with this system, they could verify and keep the
| data regardless of what I think is going on.
| derefr wrote:
| If you can't assume that a website you upload a scan of
| your ID to _isn 't_ capturing details about it, then you
| can't assume that a bouncer checking your ID _isn 't_
| wearing a surreptitious HMD, no? In both cases, you're
| submitting your PII to an unknown process that _seems_
| like it should be safe, but with no previous experience
| or brand-image there to tell you whether there 's
| actually any _proof_ that it 's safe.
| jlokier wrote:
| That's a silly stretch. It's _vastly_ more likely that a
| website fetching copies of a passport image is leaking
| copies or leaving the files where it shouldn 't by
| accident and has the data exfiltrated by third party
| identity thieves, compared with a bouncer having a secret
| scan-quality camera installed by identity thieves without
| the bouncer noticing.
| derefr wrote:
| Who said anything about the bouncer not noticing? I'm
| presuming that the bouncer _is_ the identity thief. If
| you 're looking to make money as an identity thief, being
| a bouncer is the perfect job!
|
| There was a story on Reddit a few months back, about a
| bouncer who, when handed _real_ ID cards, claimed they
| were fakes, and proceeded to immediately "cut them up"
| (so that people didn't feel any need to demand them back,
| since what are you going to do with scraps of an ID
| card?) The bouncer was actually palming the real ID and
| cutting up a random piece of plastic instead, and then
| later handing the real ID card off to the owner, who sold
| them on the black market. The victim of this later
| figured this out when they were a victim of identity
| theft, and traced back the photo from the ID submitted to
| a specific place to the one that got "cut up." The police
| raided the establishment and a whole ring of people were
| caught up in it. It was a whole thing.
|
| There's nothing that leads me to believe that this isn't
| a simple, obvious, repeatable, low-stakes, high-margin
| criminal business model. As such, it probably happens _a
| lot_.
| ROARosen wrote:
| I totally agree. Businesses should not legally be allowed
| to access more information than they need. Like why do
| hospitals ask for my Social Security number? I know I can
| refuse it, but if they really don't need it shouldn't it
| be illegal for them to needlessly probe my identity?
|
| And the list goes on...
| OJFord wrote:
| But, also as an Enterprise Architect in Banking, if you were
| considering Stripe Identity wouldn't you rely on it for KYC
| compliance? You can't just say Oh we outsource that to a
| third-party called Stripe, can you?
| echopom wrote:
| That's not my point , here my point is very clear and
| straightforward.
|
| Some people at Discord now have access at the pictures of
| my Passport that I uploaded during the verification process
| because they use "Stripe Identity".
|
| The FAQ is very clear , Stripe give you full access to
| those documents. It should NEVER do so.
|
| Now the very smart people have Discord have access to my
| passport they can now take a 50K Loan using my documents
| and face-check video , social security and some fake income
| documents.
|
| They can also destroy my entire life because I maintain a
| political blog with views they don't really like that they
| consider "hate speech". These are exaggerated examples ,
| but you get the idea.
|
| I'm concerned by this , because more and more startups are
| going to use it to increase the value of their userbase to
| reduce fraud and look more attractive for their planned
| exit.
|
| In the meantime, people having access to my personal
| documents is going to go exponential...
|
| Again , I'm an Architect in Banking we have 500+ Partners
| selling Loan for us , they have NEVER access to your
| documents / personal data. They can only tell if the
| document has been approved , income range and some basic
| information. You don't know what they are going to do those
| sensitive documents / info , even if you have contractual
| agreement with them.
|
| Banking industry has had a very simple rule that everyone
| has been following for decade : DON'T TRUST THIRD PARTY.
| Stripe has decided to do otherwise I guess and I'm pretty
| scared about it.
|
| Stripe Identity seems like Identity Theft as a Service.
| mLuby wrote:
| > DON'T TRUST THIRD PARTY
|
| This is a good policy when ALL first parties meet a
| certain (regulatory) bar. For banks, I assume that bar is
| "don't become insolvent" and more recently "don't lend
| money to terrorists."
|
| The problem is that, as we've seen from the countless
| hacks in recent years, the first parties are NOT all
| meeting the bar when it comes to security, namely "don't
| leak (or abuse) users' private personal info."
|
| And that's unfortunate, because a lot of the time, all a
| company really needs to know is a "does the registered
| account correspond (uniquely) to a real human (with
| certain legal characteristics)." Sometimes they need to
| know for compliance reasons ("our users are adults" or
| "aren't terrorists") and other times for uniqueness/fraud
| reasons ("We want to reduce spam accounts" or "we're
| paying users $10 to sign up and so need to make sure
| users aren't signing up multiple times.") _It 'd be great
| to be able to answer those questions without having to
| protect all that personal data_ that goes into answering
| it, similar to credit cards.
|
| But your main point stands: if Stripe is allowing
| companies access to the collected data, then from a
| security point of view it's little better than having the
| companies collect and store it themselves. Hopefully
| Stripe explains their reasoning, or even better, course-
| corrects early in this launch.
| OJFord wrote:
| I know it's not your point, but it's mine.
|
| Why would you upload a copy of your passport to Discord,
| via a third-party or not? The issue here is just trusting
| people you shouldn't be trusting with things you
| shouldn't be trusting them with.
|
| The alternative isn't WhizzBangApp doesn't request you
| upload documents, the alternative is they roll their own
| WhizBang ID service, or use a Stripe Identity competitor.
|
| I know my bank needs to verify my driving licence or
| whatever, and I tr.. well banks are heavily regulated
| anyway, so I'm happy to upload it without caring whether
| they use Stripe Identity or their own or whatever.
|
| I know Discord has no business with my passport or
| whatever, so they're not getting it whatever they use
| under the hood.
| toomuchtodo wrote:
| It is entirely fair to have to provide KYC documents for
| a service you need or desire to use but have the digital
| artifacts usage governed and access limited.
|
| I let my Congressperson know policy is needed about
| online identity service providers needing better
| governance over identity data, as businesses aren't going
| to do it voluntarily unless the law requires. This should
| probably be overseen by the CFPB, even though identity is
| a bit of a walk from finance (while Stripe is still
| primarily a financial services provider).
| pc wrote:
| (Stripe cofounder.)
|
| > _Considering that Stripe was originally known for letting
| websites accept credit card payments without seeing your credit
| card number, one might assume that Stripe Identity only allows
| websites to see the verification result, and not your selfies
| and scans of your identity documents._
|
| A few points:
|
| - Fundamentally, Identity makes it possible to choose how much
| of this data traverses / is stored on your servers, just as
| Stripe did with card numbers.
|
| - There's a basic difference between card numbers and identity
| verification. With card numbers, you (generally) don't really
| care about the number -- you just want the payment. With ID
| verification, however, many businesses have good reason to want
| more than just the verification result. For example, they are
| often subject to compliance requirements that mandate that they
| themselves possess or have access to the raw information. They
| may need or wish to perform additional checks on their side.
| Etc.
|
| - The relevant UI in Identity is deliberately very clear on
| this points in order to avoid the assumption you're stating.
| The flow explicitly says "Stripe and [Business] may each use
| your data." Even though an end user might consider it
| suboptimal for the business to have their data, we still view
| it as an improvement to the usual status quo, where this data
| is frequently stored in very ad hoc fashion and without
| rigorous security protections.
|
| - While many of the businesses initially building on Identity
| _wanted_ access to the raw information, it may well make sense
| for us to enable them to restrict themselves in the future. In
| this world, Stripe could tell their customers that the business
| doesn 't have access to the raw details. (This might even make
| sense for Stripe payments in the future.) As a philosophical
| matter, we consider ourselves to serve _the business_ , which
| means that limiting access to what we consider to be the
| business's own information feels a bit strange. That said, it
| might sometimes be in the interests of the business to allow
| them to limit themselves in this fashion (especially as
| Stripe's brand recognition among consumers grows).
|
| - There's a separate concern about compromise of the business's
| credentials leading to inadvertent disclosure of this
| information (a situation analogous to an S3 bucket key getting
| leaked). This is of general concern to us in lots of
| situations, not just with Identity. We have some new
| functionality on the way here.
| jart wrote:
| Do you verify when a business downloads our identity
| documents from your servers that they're only doing so to
| meet regulatory requirements? What promise do we have you're
| not just making it as easy as possible to obtain drivers
| licenses, passports, birth certificates, etc. so that every
| little monster who has something we want will start making it
| a requirement? Have you considered how your service might
| impact trans people or undocumented citizens?
| hn_throwaway_99 wrote:
| Very glad to see that 4th bullet point there. I really like
| the option of, as a business, being able to say "No, I want
| to know whether the ID matches their Name/Address, but I
| don't want to be able to access the image data".
| neolog wrote:
| > it may well make sense for us to enable them to restrict
| themselves in the future. In this world, Stripe could tell
| their customers that the business doesn't have access to the
| raw details
|
| This sounds great -- I don't want to be handling sensitive
| data of users, and I don't want to give sensitive data to
| businesses. But I'd rather this be a separate Verification
| product, with different branding, docs, and UI, so users and
| businesses are all clear on what's happening to user data.
| agwa wrote:
| Thanks for your reply.
|
| > _Fundamentally, Identity makes it possible to choose how
| much of this data traverses / is stored on your servers, just
| as Stripe did with card numbers._
|
| There's a stark difference in how Stripe treats exports of
| card numbers versus exports of raw identity verification
| data. This makes it way easier, and more likely, for Stripe
| customers to choose to store raw identity verification
| information.
|
| > _With ID verification, however, many businesses have good
| reason to want more than just the verification result. For
| example, they may be subject to compliance requirements that
| mandate that they themselves possess or have access to the
| raw information. They may need or wish to perform additional
| checks on their side. Etc._
|
| I acknowledge that some businesses have a need for this. But
| I see Discord and Clubhouse among your customer logos, and
| your product page talks about non-KYC use cases. Many of your
| customers will have access to identity documents without
| really needing it. That sucks for the end users of Stripe
| Identity, because it makes it more likely their data will be
| misused.
|
| A concrete suggestion: make it possible for businesses to
| choose whether they have access the raw data, and expose the
| choice to the end user in the Stripe Identity flow. Ideally,
| businesses that want the raw data would be subject to
| security compliance requirements. This is an opportunity for
| Stripe to be a leader in setting high standards on how this
| type of data should be handled.
| taurath wrote:
| Fully agree here - I would say that I am a bit shocked at
| the lack of regulation regarding access to people's
| identity documents as compared to credit cards.
| Credit/debit cards are your money, and there's an entire
| network of both regulations and intermediaries working
| against fraud in this space.
|
| Your identity can create new credit cards. It can take out
| loans. It is inherently a higher order security risk, and
| therefore should by default have more restrictions. I as a
| consumer trust Stripe to do the right thing, but I do not
| trust its customers. This seems to be the most reasonable
| stance, but yet the policy does not reflect that. I am
| concerned that this wedges open a really big new avenue for
| cybercrime without having any sort of regulations in place
| a-la PCI audits.
| hansvm wrote:
| > I would say that I am a bit shocked at the lack of
| regulation regarding access to people's identity
| documents as compared to credit cards.
|
| To some degree it's because there isn't much point. You
| can call up my home state today, pinky promise that
| you're me, hand over $20, and they'll ship you my birth
| certificate or other important documents. We don't have
| private keys or other kinds of unique identifiers
| assigned at birth, so attempts to lock it down further
| would lock people out of their own identities.
|
| Scale does matter, and a breached database of identity
| documents is definitely worse than having to pay a
| nominal fee and wait a few days, but given the context of
| other manual labor like securing loans I'm not sure the
| extra ease would result in much more fraud.
| breakfastduck wrote:
| Depending on where you're located, there is a
| responsibility to only take information you require.
|
| I get your point, but you seem to be implying this data is
| captured without the customer being aware. That will not be
| the case, surely.
| pc wrote:
| Appreciate your feedback. On the first point, limitations
| on what the secret key can access are coming very soon.
|
| > _A concrete suggestion: make it possible for businesses
| to choose whether they have access the raw data, and expose
| the choice to the end user in the Stripe Identity flow.
| Ideally, businesses that want the raw data would be subject
| to security compliance requirements. This is an opportunity
| for Stripe to be a leader in setting high standards on how
| this type of data should be handled._
|
| Yes, per GP comment, I think this is a good idea. I suspect
| we'll do it.
| caslon wrote:
| Do you feel in doing this that you're making the web worse?
| As a business, you certainly have no obligation to be
| ethical, but doesn't it feel a bit strange as a person who
| presumably grew up with the web to be playing such a big role
| in harming the people who use it?
| echopom wrote:
| Hey Patrick,
|
| > As a philosophical matter, we consider ourselves to serve
| the business, which means that limiting access to what we
| consider to be the business's own information feels a bit
| strange.
|
| Maybe I'm wrong , but once a customer upload the document on
| Stripe Identity they are supposed to be YOUR documents.
|
| I worked in Bank as a Service , fundamentally when a customer
| goes through a verification process , the documents uploaded
| are not the owned by the partner using our APIs. They are
| owned by us , the Bank.
|
| For Stripe Identity the same should have apply. Here the goal
| is not "Lock the Partner" but rather to protect them.
|
| Now that discord has access to my Passport , in case of an
| identity theft could you tell me EXACTLY whose liable for the
| leak in regards to the law ?
|
| With BaaS it's pretty clear , the Bank carry the
| responsibility to keep those documents safe , thus it's safer
| to not give access to a basic business to the raw details.
|
| With the current API design you are offering, it's more
| ambigous and more prone very large leak within a business
| information system like Discord or Uber etc..
|
| Those leak will happen.
| rbobby wrote:
| > With card numbers, you (generally) don't really care about
| the number -- you just want the payment.
|
| I don't ever want to have a card number in my database or via
| a administration system (my own or my provider's).
|
| So I care... but just perhaps not in quite the way you're
| thinking :)
| alexchamberlain wrote:
| I suspect most (if not all) KYC regulations require you to keep
| the evidence you used to verify the identity - even landlords
| in the UK are required to keep the evidence they saw of your
| right to live in the UK, let alone any institution that
| actually needs to prevent fraud etc. I suspect it's just a
| basic requirement of selling such a service to most medium-
| large businesses.
| agwa wrote:
| You're probably right about KYC, but KYC is just one of the
| four use cases presented by Stripe, and their customer logos
| include Clubhouse and Discord, which I highly doubt have KYC
| requirements or any need to access the underlying evidence.
|
| Stripe could do this differently:
|
| 1. Allow the customer to choose whether or not they need
| access to the evidence.
|
| 2. If customer has chosen to receive access to the evidence,
| the Stripe Identity UI should clearly disclose this. (And
| they shouldn't try to deceive users by talking about deleting
| biometric identifiers.)
|
| 3. Require customers with access to evidence to adhere to
| certain security standards, similar to how they treat exports
| of credit card numbers:
| https://stripe.com/docs/security/data-
| migrations/exports#whe...
|
| Stripe could have been a leader in setting high standards on
| how this type of information is handled. Instead they've
| opted to go the easy route and maximize profits while the
| rest of us pay the negative externalities from identity
| theft.
| poorman wrote:
| >Considering that Stripe's original selling point was that it
| let websites accept credit card payments without seeing your
| credit card number
|
| I thought that Stripe's original selling point was that you
| could easily accept payments online without having to integrate
| with complicated bank and payment processor tech.
| agwa wrote:
| As I understood it at the time, alternatives required PCI
| compliance, which Stripe allowed you to sidestep thanks to
| tokenization, so I do believe that was a selling point. But
| this is besides the point I'm making, so I've edited my
| comment.
| nati0n wrote:
| Certainly a market for this sort of thing, but agree, dangerous
| privacy management.
| searchableguy wrote:
| The pricing link on the top doesn't refer to any pricing section
| on the page. Is it missing?
|
| Edit: This seems to be an internationalization problem. I am from
| India. The pricing section for Indian page https://stripe.com/en-
| in/identity#pricing is missing so the link doesn't work.
| NelsonMinar wrote:
| For anyone looking for the answer, in the US it's $1.50 / ID
| verification and $0.50 for Social Security Number lookup (an
| American tax number that is officially not for identity
| purposes but used that way all the time).
| SloopJon wrote:
| I'll give my SSN to a healthcare provider, and maybe a bank.
| Random vendor using Stripe? Probably not.
|
| Edit: to be a little less flippant, what is an example of a
| Stripe user to whom you _would_ be comfortable giving your
| SSN?
| 908087 wrote:
| You know you don't actually have to give your SSN to
| healthcare providers, right?
|
| I leave it blank and tell them (in vaguely more polite
| terms) to fuck off if they probe me about not providing it.
| voiper1 wrote:
| It mentions KYC, so for example Etsy might use it to verify
| a vendor that it sends earnings along with a 1099.
| burntwater wrote:
| An employment related service could legitimately require a
| valid SSN.
| judge2020 wrote:
| Yes - most U.S. post-degree jobs require background
| checks which will almost certainly require giving your
| SSN to the employer.
| edwinwee wrote:
| Identity isn't available in India today, but that anchor link
| is indeed broken (we'll fix this now--thank you!).
| [deleted]
| mikeiz404 wrote:
| This seems like a really useful service but I am concerned this
| is going to normalize requiring identity info for sites which do
| not legally need it. I imagine the pretext for most will be fraud
| prevention, and while this might be true, I cannot see how this
| wouldn't eventually be used for ad targeting and other "consumer
| is the product" funding models without regulation restricting it.
| foota wrote:
| Is knowing who the customer is with more certainty really
| useful though for targeting beyond just having their info they
| provide on sign up?
| SLWW wrote:
| It really makes you wonder what kind of optics they are looking
| through when coming up with these things. Literally no one (at
| least not the majority of individuals) wants this.
|
| It's one of those things that you expect a more shady company to
| release. Then again (and it's all hearsay mind you) that they are
| not a good company to work with, and when talking to employees
| who left, they don't seem like a good company to work for.
|
| Stick to CCs, that's intrusive enough.
| endisneigh wrote:
| It's not clear to me how you can detect a fake ID with machine
| learning. A persons appearance can change drastically - seems
| intractable
| manigandham wrote:
| Some things don't change, like the dimensions between features
| like eyes, nose, ears, etc. Coinbase had an interesting
| presentation on this a few years back about how they verified
| IDs from pictures and dealt with all kinds of fraud.
|
| Worst case, if the appearance is really drastic then it would
| just fail and require a manual intervention.
| kgraves wrote:
| How does this compare to Onfido?
| axiom92 wrote:
| This is very cool!
|
| Looks like they have been working on it for a few years now.
| Here's a video from 2019 where someone from Stripe is giving a
| demo: https://www.youtube.com/watch?v=TDocEZ4f5ow.
| odiroot wrote:
| I'm really surprised they don't support Polish IDs. We've had
| them in the same format for ages and I've done automatic
| verification with some other companies (e.g. Revolut).
|
| Multiple much smaller countries' IDs are supported.
| edwinwee wrote:
| Working on it! Coming soon.
| plopilop wrote:
| Maybe Stripe is not that much popular in Poland compared to
| other countries? I would not be surprised that they put
| priority on the countries where they already have a significant
| user base.
| plumeria wrote:
| Curiously, they support validating identities from Costa Rica but
| so far they don't support processing payments there. I wonder if
| the payments service is in-the-works for this country.
| sidcool wrote:
| Isn't this a privacy nightmare? All that data in Stripe data
| centers.
| wussboy wrote:
| I think Stripe's opinion is that their current business is
| already a privacy nightmare (being a payments processor) and
| that they've learned a bit about it through the years so they
| feel they have the experience to do this right. I'm neither
| here nor there on Stripe as a company, but having worked with
| PCI and PII for many years, I'd trust a company more who had
| been through this process before.
| edwinwee wrote:
| 1. Stripe has strict access controls--only those working on
| Identity/verifications can access the data.
|
| 2. Biometric data is not stored! It's gone from our systems
| within 48 hours (usually in just minutes).
|
| 3. We think this'll actually make the state of global privacy
| better--rather than having individuals collect, and verify your
| ID, Stripe will securely handle verification.
| agwa wrote:
| > 1. Stripe has strict access controls--only those working on
| Identity/verifications can access the data.
|
| > rather than having individuals collect and verify your ID,
| Stripe will securely handle verification.
|
| The above statements are materially false. You allow
| customers of Stripe Identity the ability to access and retain
| "captured images of the ID document, selfies, extracted data
| from the ID document, keyed-in information, and the
| verification result".
| [https://support.stripe.com/questions/managing-your-id-
| verifi...]
| apexalpha wrote:
| Is this new? (to the USA?)
|
| Because I've used similar services inside apps dozens of times.
| Sometimes to verify a drivers license to ride a car, sometimes to
| verify my ID to register a bank account.
|
| Every time is was done in a few seconds so I assumed the
| companies used an API rather than every car-share building it
| themselves.
| travellingprog wrote:
| there are existing startups that specialize in ID verification.
| E.g. in my current freelancing gig, my client uses Passbase.
| rootsudo wrote:
| Stripe has lost it's way.
| newsbinator wrote:
| Why do you think so?
| client4 wrote:
| I've been waiting for a service like this. I suspect we're on the
| precipice of a new Internet split, where one can be accessed with
| identity and the other is anonymous as we know it now. In some
| arenas, like comment sections, I welcome removing anonymity [1].
| In other arenas I wonder if it will be used to divide populations
| online in some futuristic dystopian manner. For instance, only
| citizens of the United States with Good Credit and Good Social
| Score are allowed to read the Financial Times.
|
| [1] https://www.penny-arcade.com/comic/2004/03/19
| ngngngng wrote:
| This is funny timing. My neighbor is the CTO at a company
| managing identity and building out frameworks and products to
| help other companies do it themselves. He was trying to pitch me
| on joining. Sounded neat until I found out how much they focus on
| the blockchain. It's far too likely it's a gimmick tacked on for
| no reason but getting hype and investment. Blockchain just
| attracts all the wrong people in my experience.
|
| This looks cool though, and no gimmicks.
| maxehmookau wrote:
| This just won in terms of simplicity, ease of use and cost.
| Especially in the UK. There are no other competitors at this
| price point right now.
| benjaminjosephw wrote:
| They are building a platform where other companies are clearly
| just selling a product.
|
| Identity verification is definitely something that gets better
| with more data as more people use it. Pricing low to gain
| market-share is the obvious move for companies which don't have
| pressure to show immediate returns.
|
| Maybe it shows a more general difference in ambition between
| companies in the UK to those across the pond.
| xtat wrote:
| Really confused why this blew up so big when there are so many
| such KYC options. Someone enlighten me?
| verytrivial wrote:
| That's a mighty efficient process you've got there. I'll just
| leave this here: https://en.wikipedia.org/wiki/Bureau_of_Sabotage
| joshuarubin wrote:
| Those are some seriously amazing photos on the example IDs. I'd
| kill to have anything half as good on mine.
| flixic wrote:
| They don't look like photos. My guess is that Stripe's designer
| re-drawn passport designs.
| orliesaurus wrote:
| If this even reduces 20% of having to call up a human to verify
| my account because 'our systems have detected that you have
| accessed your account from an unknown location' then, yes please
| and thank you! Also interested to see what form of IDs it will
| accept! Only negative: Expensive...but I guess it's fair for it
| doing all the heavy lifting.
| ullevaal wrote:
| I'm surprised that they are not providing PAdES signatures here
| at the same time, do you think this is a direction they will be
| moving in?
|
| Also surprised they are not leaning more heavily into the
| existing identity solutions in the countries they are already
| operating in, like the Netherlands and the Nordics. Maybe hard to
| differantiate from existing competitors?
| plumeria wrote:
| Yeah, it would be easier and more private to validate your
| identity through an official digital signature, rather than
| providing biometrics (pictures).
| methyl wrote:
| This is a great way to provide free trials to your users while
| minimising the risk of frauds. Great job!
| strifey wrote:
| I used this for an online car rental service recently. My only
| main complaint was that it didn't work with FF for Android. Once
| I switched to Chrome, everything was great, but I'm disappointed
| in how often sites expect to be ran in a Chromium-based browser
| these days.
|
| Still appreciate seeing Stripe's name when taking a pic of my ID
| rather than just the rather small startup I was using. No offense
| to small startups, but I might've balked at it otherwise.
| edwinwee wrote:
| Hm! Could you email me with more on the device and browser
| versions? edwin@stripe.com
| float4 wrote:
| Shout out to Stripe for translating all their web pages!
|
| When an HN post sends me to a Dutch page, it's always Stripe.
| 100% of the time.
| Sr_developer wrote:
| That is assuming the translation is of high quality and sadly
| that is not always the case. I am a native Spanish speaker and
| for the life of me I cannot understand most of the "Spanish
| Version" technical pages I read.
| jlhonora wrote:
| I work at Stripe, though not on the L10N/I18N or identity
| teams. It would be tremendously helpful if you could send me
| some feedback so that we can improve, jlh at stripe dot com.
|
| I'm a native Spanish speaker too, and nothing in this
| announcement strikes me as unintelligible, but that might be
| my own biases at play given the familiarity with Stripe's
| lingo.
| Sr_developer wrote:
| Are you going to pay me? If not, good luck!
| jlhonora wrote:
| Probably not the answer you expect, but the I18N team is
| hiring :)
| https://stripe.com/jobs/listing/internationalization-
| enginee...
|
| Otherwise, if you're a trained linguist and have
| demonstrable consulting experience QA'ing technical
| documentation then we'll be happy to arrange something.
|
| In either case, we appreciate your feedback, and my
| emails are open!
| Sr_developer wrote:
| No trabajo de gratis para multinacionales cuiquito. Tu
| credencialismo barato y sobrador lo puedes archivar donde
| mas te convenga.No se si es la respuesta que estabas
| esperando.
| jlhonora wrote:
| Not sure what makes you evoke such a strong reply. If
| it's something I said, then I apologize.
| wussboy wrote:
| Google translate says: "I don't work for free for small
| multinationals. Your cheap and spare credentials can be
| filed wherever it suits you. I don't know if this is the
| answer you were waiting for."
| manigandham wrote:
| Not only unexpected but that's about the best reply
| possible. Nicely done.
| newsbinator wrote:
| What a quality answer! I get very poor quality support
| from Stripe's live chat, but the professionalism and
| helpfulness on HN from Stripe people like you and Edwin
| is beyond reproach, that's for sure.
| gip wrote:
| That is an interesting data point. In my case the support
| I got from Stripe over the years (email, chat, IRC, ...)
| has been consistently stellar. Are you in the US?
| newsbinator wrote:
| I'm not in the US. Typically I use live chat during
| European evening hours, and I often get agents with
| upper-intermediate English skills, who miss the crux of
| my question or who are completely unfamiliar with
| Stripe's own dashboard or services. Not even on an API-
| level. Simply on a "here's a thing that Stripe has and
| here's something it can do" level.
| throwaway9398 wrote:
| I gave up on Stripe because they clearly are a US-focused
| company, and do not have a global outlook. I find it
| disappointing that after so many years of being in business,
| their payment processing services are still only available to a
| few dozen countries. This for example makes it impossible to rely
| on them to build a global marketplace with Stripe Connect
| accepting merchants from all over the world.
|
| Stripe is not for those seeking to run truly international
| businesses. We've been patient, but we eventually realized that
| they simply do not care. We care about Sub-Saharan Africa and
| Latin America, but they do not. We do not trust them to
| prioritize the global availability of their offerings at this
| point, and as a result we no longer even bother checking out
| their offerings. What's the point if instead of empowering us,
| they restrict our business model.
| pqdbr wrote:
| I haven't given up on them, but LATAM is definitely not their
| focus and we've moved 95% of our payment volume to a local
| payment processor, even tough we were one of the first private
| beta testers back in 2015 (wow, it's been 6 years already).
|
| My angle is in Brazil. Even after all these years, they still
| don't support monthly installments, which is literally a single
| line API param that, honestly, I don't know any other payment
| gateway in Brazil that doesn't support it. Monthly installments
| is a huge deal in Brazil.
|
| They also only now started the private beta of Boletos, which
| is unfortunate since Boletos are being phased out in Brazil due
| to the new PIX, which allow for instant payments 24/7. So they
| are basically releasing just now a feature that nobody really
| wants anymore.
|
| Stripe connect also isn't available (AFAIK only the "standard"
| account is available, which mandates for Stripe onboarding and
| can't accommodate any white label marketplace integration).
|
| The lack of focus is noticeable even from their marketing
| pages. Notice how in https://stripe.com/br/connect the
| explanation for "Cobrancas diretas" and "Cobrancas de destino"
| are exactly the same (the text "Os compradores fazem transacoes
| diretamente com os vendedores, mas quase nunca notam a
| existencia da plataforma, que pode cobrar tarifas de transacao"
| appears in both), making it impossible to understand the
| difference, while if you visit https://stripe.com/us/connect
| you see two different texts for each option.
|
| Their support team has always responded quickly and politely,
| but we've had an impossible time trying to understand how they
| could allow us collect payments from abroad as a marketplace
| operating in Brazil, and that's even pointing out we didn't
| rule out opening a US-based company via Stripe Atlas if that
| was necessary. Lots of contradictory information and when we
| pressed on, they always end with them noticing that Brazil is
| still in preview and they still can't operate properly with
| Connect in Brazil.
|
| Which is weird, considering it's LATAM's biggest market. This
| release of Stripe Identity missing out Brazil on launch, even
| tough it's a country that badly needs antifraud solutions, is
| only one more evidence of this.
| marciovm123 wrote:
| We're making up for lost time in Brazil and hope to change
| your mind in the next 6 months.
|
| I'd love your feedback on installments, Pix, and Custom
| Connect. Can you reach out to Marcio@Stripe?
|
| Thanks for the marketing typo, on it.
| pqdbr wrote:
| That's great to hear Marcio. I've emailed you. Cheers.
| kebman wrote:
| How would you construct a secure zero knowledge proof to do this
| kind of thing over an API?
| paul_f wrote:
| Ooh, we could use this. Curious, can anybody point me to other
| similar products out there? I'd be interested in comparing. BTW,
| my uses case is USA only.
| jokethrowaway wrote:
| OnFido with a clear pricing.
|
| Love it.
| tiffanyh wrote:
| So is this simply a straight up competitor to Jumio? Or is it
| more.
| mtnGoat wrote:
| looks like a cool solution. having researched these tools very
| recently, i will say, the pricing is very high. there are other
| offerings on the market for $0.50 per look up and only bill you
| if its a positive lookup.
| client4 wrote:
| It looks like it's missing the user side of the equation. As in a
| user can validate they-are-who-they-say-they-are *once*, but
| Stripe is missing an opportunity to allow users to: validate
| themselves to a website regularly (OTP tied to identity), allow
| individuals to update their information (address change), allow
| individuals to revoke authentication, etc. It is a great
| foundation and there's huge opportunity for growth in this
| product.
| edwinwee wrote:
| Neat idea and something we'll think about.
| punnerud wrote:
| Is Stripe's backend still Ruby?
|
| And how is the development process?
| arthur_sav wrote:
| Yeah, let's make a for-profit corporation an identity management
| entity. What could go wrong.
|
| - Did you say something politically incorrect? Banned. - Stripe
| employees don't like you? Banned. - They just feel like it.
| Banned.
|
| Yeah. No.
| supertrope wrote:
| There's a tendency to conflate identification with endorsement.
| Twitter muddied the two together instead of keeping it as anti-
| spoofing measure. Users are trained to see HTTPS as a sign a
| website is legitimate or secure and not just a way to confirm
| the public key. Democrats want to use the unconstitutional no
| fly list to ban individuals from buying guns. After the Boston
| Marathon bomb attack some senators wanted to require KYC on all
| cellphones and encourage the police to not read suspects their
| defendant rights. The reflexive opposition to COVID-19 vaccine
| verification is because people don't trust the government.
| Etheryte wrote:
| Looks like the page was freshly edited to remove the pricing
| information (?), but it's telling they're targeting a very
| similar price range as Veriff [0], a startup that's been working
| in the same space for quite a while.
|
| [0] https://www.veriff.com/pricing#starter-plans
| edwinwee wrote:
| This is a small localization bug that we're fixing now (the
| pricing section doesn't properly show for countries where
| Identity isn't available in yet), but you can see pricing for
| the US at https://stripe.com/en-us/identity#pricing.
| hmate9 wrote:
| I wish Stripe would go public so I could invest a good chunk. Who
| wouldnt want to invest in the backbone (or soon to be) of the
| entire internet payment infrastructure.
| areichert wrote:
| Oh man, really excited about this. I'm curious how far Stripe
| wants to go down the path of KYC-related products... it feels
| like a huge market with a lot of pain points where having Stripe-
| quality APIs would be amazing.
| rStar wrote:
| this seems to be the opposite of what all the regular people
| getting into crypto are wanting. i will only adopt systems that
| give me more privacy, on balance, not less. make that decision a
| few times, even in modern life, and your privacy increases
| substantially from your naive neighbors.
___________________________________________________________________
(page generated 2021-06-14 23:00 UTC)