Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents.
That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity have API access to "captured images of the ID document, selfies, extracted data from the ID document, keyed-in information, and the verification result".
Thus, when you use Stripe Identity to verify your identity, you have to trust that:
1. The website doesn't download, retain, and later leak your selfie and identity information.
2. The website's Stripe API token isn't compromised and exploited by identity thieves to access your selfie and identity information.
Stripe appears to be leaning heavily on their claim that they don't disclose "biometric identifiers" to websites and that these "biometric identifiers" are deleted from their systems within 48 hours. This is extremely deceptive considering that biometric identifiers can be reconstructed from the selfie.
> Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents.
A few points:
- Fundamentally, Identity makes it possible to choose how much of this data traverses / is stored on your servers, just as Stripe did with card numbers.
- There's a basic difference between card numbers and identity verification. With card numbers, you (generally) don't really care about the number -- you just want the payment. With ID verification, however, many businesses have good reason to want more than just the verification result. For example, they are often subject to compliance requirements that mandate that they themselves possess or have access to the raw information. They may need or wish to perform additional checks on their side. Etc.
- The relevant UI in Identity is deliberately very clear on this points in order to avoid the assumption you're stating. The flow explicitly says "Stripe and [Business] may each use your data." Even though an end user might consider it suboptimal for the business to have their data, we still view it as an improvement to the usual status quo, where this data is frequently stored in very ad hoc fashion and without rigorous security protections.
- While many of the businesses initially building on Identity wanted access to the raw information, it may well make sense for us to enable them to restrict themselves in the future. In this world, Stripe could tell their customers that the business doesn't have access to the raw details. (This might even make sense for Stripe payments in the future.) As a philosophical matter, we consider ourselves to serve the business, which means that limiting access to what we consider to be the business's own information feels a bit strange. That said, it might sometimes be in the interests of the business to allow them to limit themselves in this fashion (especially as Stripe's brand recognition among consumers grows).
- There's a separate concern about compromise of the business's credentials leading to inadvertent disclosure of this information (a situation analogous to an S3 bucket key getting leaked). This is of general concern to us in lots of situations, not just with Identity. We have some new functionality on the way here.
> Fundamentally, Identity makes it possible to choose how much of this data traverses / is stored on your servers, just as Stripe did with card numbers.
There's a stark difference in how Stripe treats exports of card numbers versus exports of raw identity verification data. This makes it way easier, and more likely, for Stripe customers to choose to store raw identity verification information.
> With ID verification, however, many businesses have good reason to want more than just the verification result. For example, they may be subject to compliance requirements that mandate that they themselves possess or have access to the raw information. They may need or wish to perform additional checks on their side. Etc.
I acknowledge that some businesses have a need for this. But I see Discord and Clubhouse among your customer logos, and your product page talks about non-KYC use cases. Many of your customers will have access to identity documents without really needing it. That sucks for the end users of Stripe Identity, because it makes it more likely their data will be misused.
A concrete suggestion: make it possible for businesses to choose whether they have access the raw data, and expose the choice to the end user in the Stripe Identity flow. Ideally, businesses that want the raw data would be subject to security compliance requirements. This is an opportunity for Stripe to be a leader in setting high standards on how this type of data should be handled.
Appreciate your feedback. On the first point, limitations on what the secret key can access are coming very soon.
> A concrete suggestion: make it possible for businesses to choose whether they have access the raw data, and expose the choice to the end user in the Stripe Identity flow. Ideally, businesses that want the raw data would be subject to security compliance requirements. This is an opportunity for Stripe to be a leader in setting high standards on how this type of data should be handled.
Yes, per GP comment, I think this is a good idea. I suspect we'll do it.
+1 on being able to choose. I’m building a personal finance app right now, and where I can I’m choosing to not ingest or retain sensitive data. While the origin of this is scratching my own itch, I suspect that I’ll get better traction if I can overtly say I’m not collecting data I don’t need or holding onto it for longer than you want me to. I’d love to be able to just get a Boolean back.
Businesses collecting identity information is nothing new. Somebody like Stripe putting a concerted effort out there to make it more secure and improve the experience so that identity information is stored in a less ad-hoc way is a win and will reduce the odds of some catastrophic leak. If you are only worried about identity leaks now then you are simply miss-calibrated on your assumptions about the nature of online identities. If you are seriously this worried, then you probably shouldn't be using the internet for anything.
> so that identity information is stored in a less ad-hoc way
It will be more ad hoc. Stripe does not decide how their client stores such data. Stripe will make asking for an ID very easy and that will vastly expand the number of businesses utilizing this method of registration.
Right now I think of Stripe as a reliable service. When one of their customer's data is breached or leaked, I don't know that everyone will still trust Stripe as a brand. News articles about such breaches won't be able to relate the nuance of who's at fault.
I'm not concerned about my online personas being linked to me. I'm concerned about making it easy for bad actors to perform identity theft en masse.
I'm not sure you understand. When a business needs your ID to do business, they ask you for it and store it in their infrastructure. This already happens today. Nothing Stripe is doing necessarily changes this. Stripe is simply providing a streamlined mechanism by which business can fulfill their KYC requirements and obtain this information. And now they have the choice to continue to store it in their infrastructure or look it up via the API as needed. If somebody breaches WellsFargo and dumps all the identity info of their customers, clearly Wells Fargo is at fault. Nobody will care if the entry form where they put their info in when they signed up for a bank account was hosted by Stripe and white labeled by Wells Fargo, or if there was a permission box that popped up from Stripe asking if you'd like to allow Wells Fargo access to your info, or if it was simply hosted by Wells Fargo. I don't see the problem here.
I get it. No need to say I don't. Streamlined means more companies will ask you for such identification. Eventually stripe will be part of a news story about a data leak. I imagine they've already factored this in and decided it's worth it, due to requests they've been getting from customers. Essentially, if they don't do it, someone else will. Personally I think they should let someone else do it, or break it into another company, but that's not my call.
I disagree a bit on this. Looking at previous data breaches, when something like an s3 bucket gets hacked, the news is not going to be about on how Amazon is responsible for company X's data breach but on how company X's servers got hacked. Stripe, like AWS, is the infrastructure, the onus is on a company to ensure their infrastructure security as it can be an existential risk. A philosophy of Stripe's is that that they succeed when their customers succeed, I'd like to think that they have a shared interest in try to prevent their customers being breached as much as possible.
You may be right about how breaches are received in the news by people. It may depend on how they roll it out. I'm sure Stripe will do their best to help clients secure their customers' data. At the end of the day, though, it seems inevitable that breaches will occur.
It’s great that you think that limiting the firehose-style wild-west dissemination of people’s identity data might be a good idea and I have good feelings about your suspicions, I suspect they might be well founded.
Might as well wait until anybody that can drag and drop Stripe code into their app gets as many photos of people’s IDs and faces and security questions from their users and squirrels it away into their private databases.
Once that’s done it’ll be a good time to fire off a blog post about how not doing that was always in the works and announce groundbreaking features like “basic privacy permissions for identity data “ will become default.
Fully agree here - I would say that I am a bit shocked at the lack of regulation regarding access to people’s identity documents as compared to credit cards. Credit/debit cards are your money, and there’s an entire network of both regulations and intermediaries working against fraud in this space.
Your identity can create new credit cards. It can take out loans. It is inherently a higher order security risk, and therefore should by default have more restrictions. I as a consumer trust Stripe to do the right thing, but I do not trust its customers. This seems to be the most reasonable stance, but yet the policy does not reflect that. I am concerned that this wedges open a really big new avenue for cybercrime without having any sort of regulations in place a-la PCI audits.
> Your identity can create new credit cards. It can take out loans. It is inherently a higher order security risk, and therefore should by default have more restrictions.
It's a security risk because of the first couple things you listed. The problem is that identity cannot be simultaneously a secret and a public identifier. As the name should suggest, identity serves a much better use as a public identifier. So we should stop treating it like a secret and start creating real infrastructure for actual secrets.
By the way, this is completely analogous to credit cards. There's a reason the industry has moved to chip cards physically and tokenized cards virtually. And that's because the card number was serving as both identity and secret, and that doesn't work. The deviation is that, in this case, we've decided to make the credit card numbers a secret which is cryptographically protected (chips) or at the very least stored in an opaque manner (tokens).
> I would say that I am a bit shocked at the lack of regulation regarding access to people’s identity documents as compared to credit cards.
To some degree it's because there isn't much point. You can call up my home state today, pinky promise that you're me, hand over $20, and they'll ship you my birth certificate or other important documents. We don't have private keys or other kinds of unique identifiers assigned at birth, so attempts to lock it down further would lock people out of their own identities.
Scale does matter, and a breached database of identity documents is definitely worse than having to pay a nominal fee and wait a few days, but given the context of other manual labor like securing loans I'm not sure the extra ease would result in much more fraud.
It's supposed to work in quite a few countries, and not all make it so easy. Given the requirement in my country for ID when obtaining any other ID, I'm actually puzzled about what happens if you lose everything.
For me, the general process would require a police report for lost/stolen ID (mandatory, so that it can be marked as lost/stolen so that it would be detected if someone tries to use it) and verification with the data they have on file - nowadays with EU biometric IDs they can be quite sure that I'm the same person as the one who got the previous ID as the face and fingerprints can be verified.
There's an honor system in many places. You sign a document stating you are who you say you are, and have it witnessed by someone who is "deemed trustworthy" - local police, teacher, clergy.
Just from an end user POV, would I be able to request from Stripe a logs for metadata about which type/how much of my personal data has been shared to the companies?
No. Unfortunately, most businesses in the US are not under any compliance requirements or regulations around identification. Certain states have special rules (like California I think?) but in most places US businesses can generally do anything they want with an ID card or relevant information, so long as they don't impersonate you or commit a crime with it.
Given the way Stripe has implemented this today, Stripe might as well be selling their business customers a <input type="file" /> tag for Driver's Licenses, because that's the level of security 99% of all business will be using around this. There's going to be Amazon S3 buckets filled up with Drivers Licenses JPEG's provided by Stripe Identity, in a few months time.
> There's going to be Amazon S3 buckets filled up with Drivers Licenses JPEG's provided by Stripe Identity, in a few months time.
What makes you think these don't already exist? Have you ever needed provide your identity information to use a service online (e.g. a insurance service, bank, alcohol/weed delivery, crypto market, etc.)? Where do you think the identity information you provided is stored?
If you don't use these type of services, then nothing will change--stripe won't magically have all your identity info. If you do use these services maybe they'll partner with Stripe, maybe not. The only outcome I can see from this news is that it's likely there will be fewer AWS buckets with your identity info moving forward, because Stripe can do that for you now.
Putting my lazy developer hat on for a second here… I think I would choose to store the Stripe Identity token in my db and then pull the JPEG’s on demand from Stripe’s API. Saving the image to S3 would be additional work, and well, I’m a lazy developer.
> As a philosophical matter, we consider ourselves to serve the business, which means that limiting access to what we consider to be the business's own information feels a bit strange.
Maybe I'm wrong , but once a customer upload the document on Stripe Identity they are supposed to be YOUR documents.
I worked in Bank as a Service , fundamentally when a customer goes through a verification process , the documents uploaded are not the owned by the partner using our APIs. They are owned by us , the Bank.
For Stripe Identity the same should have apply. Here the goal is not "Lock the Partner" but rather to protect them.
Now that discord has access to my Passport , in case of an identity theft could you tell me EXACTLY whose liable for the leak in regards to the law ?
With BaaS it's pretty clear , the Bank carry the responsibility to keep those documents safe , thus it's safer to not give access to a basic business to the raw details.
With the current API design you are offering, it's more ambigous and more prone very large leak within a business information system like Discord or Uber etc..
> Now that discord has access to my Passport , in case of an identity theft could you tell me EXACTLY whose liable for the leak in regards to the law ?
Discord only has access to your passport if you upload it to them. They don't have access to it by virtue ofthem being a stripe customer.
Do you verify when a business downloads our identity documents from your servers that they're only doing so to meet regulatory requirements? What promise do we have you're not just making it as easy as possible to obtain drivers licenses, passports, birth certificates, etc. so that every little monster who has something we want will start making it a requirement? Have you considered how your service might impact trans people or undocumented citizens?
There are many use cases where it's enough to verify that the user is an actual person, and also to prevent the same person to have multiple accounts. So, it would make sense that Stripe verifies the person, but keeps the details from the business itself.
I trust Stripe more than a random online forum, a dating app, or a social network, which might offer a higher quality service when people are verified. There's a high risk that the ID documents will leak from these services at some point if they get access to them. I don't want them to know who I am at all, if they don't need to know.
It would also offer a way for preventing sybil attacks on P2P networks, or help connecting to non-evil nodes on a P2P network (such as Bitcoin Lightning Network) without knowing the other person. In these cases there could be a some kind of signature generated by Stripe that could be used as an additional trust factor without centralizing the system.
One of the points brought up by privacy folks in review of Apple’s plan to have your ID in your digital wallet is that the mere convenience of allowing access to ID may create ID requirements for users where none existed before, which is a loss for privacy. Do you think that Identity is going to create such new requirements?
I sure hope so! Anonynimity is not a fundamental human right, it is a tool that should be used sparingly and only when the situation is appropriate (whistleblower, for example). The internet would be a better place if there were more identity requirements SO LONG AS companies are not legally allowed to sell or transmit that information to advertisers or other third parties without explicit opt-in consent ideally on a per-use basis. Or simply at all. If easier access to online identity systems means we as a society turn focus on legal ground rules governing how that data is treated and used, then we'll be in a really good position (: I'm excited.
What a terrible, broad statement to make, and on an anonymous forum of all places. There are plenty of places where default anonymity makes a lot sense and it is important to a good societal structure. History has shown time and again that those in positions of advantage will abuse their access to information for their own gains. Increasing the surface of your online activity trail can and will be used against you by a bad actor when the opportunity arises. There is simply no good reason to make identity requirement as the default. There is a reason identity requirements have traditionally been restricted to highly regulated entities, but off late there seems to be a trend of "internet companies" freely exchanging KYCs with each other. This blurring of boundaries between banks and regular companies is a dangerous precedent and I'm afraid it will be too late before we realise the net damage to society as a result.
> There are plenty of places where default anonymity makes a lot sense and it is important to a good societal structure.
Can you list some examples of the types of places where you think this property holds true and explain what you mean by "good social structure"?
> History has shown time and again that those in positions of advantage will abuse their access to information for their own gains.
What are some examples of scenarios where this has happened in relation to online identity where there have been legal restrictions in place that would have otherwise prevented it? The healthcare industry and credit card industry seem to do a pretty good job of protecting sensitive information, for example.
> Increasing the surface of your online activity trail can and will be used against you by a bad actor when the opportunity arises.
How anonymous do you think you are online? If you're not deliberately taking steps to conceal your identity, your trail is thick and clear for the people who know how to track it. And that's an actual problem: people track you even if you think you're anonymous and we have no legal protection in place to prevent abuse of data that can identify you online. If you are in a position where you need to *depend* on anonymity, you simply can't because nobody will respect your wish. So the internet operates in this grey zone where because we have no rules governing abuse of PII, everyone throws on the cloak and turns to anonymity as the answer. This degrades our ability to fight spam and makes things like strong mutual authentication very very hard to do because platform vendors can't ever expose any sort of fixed identifier because privacy. Look at the insane things Apple does: zero out your mac address when scanning for wifi networks and recently issue a new certificate for every single use so that a persistent identifier does not show up. And look at IPv6, we invented "privacy extensions" where you generate a random IP every few minutes. These hacks break functional systems because we don't understand how to regulate the internet as a society.
All that is somewhat irrelevant, though. We're talking about the identity relationship between you and a service, not necessarily "the features of interacting with the internet that can be recorded and tracked either on purpose or incidentally". Do you think your email address makes you anonymous? Again, unless you're deliberately taking steps to maintain pristine op sec with your online browsing, you identify yourself to service providers one way or another. And again, the problem is people think they're anonymous when they really aren't so they misinterpret what it means to be anonymous and its importance in good societal structure. I honestly don't see a difference between providing a service your email address or your physical address or telephone number. What's so bad about having a third party say "yeah, this person is who they say they are" and optionally "and here's the list of verified fields"? The internet is the only place where people get weirded out when someone asks for an ID. Do you not show the bar tender your ID when asked because you need to be anonymous at a restaurant? How about at the gas station, the liquor store, the axe throwing range, the DMV, the hospital, when making a purchase on a credit card, taking out a loan, etc. What real world interactions do you have that are primarily anonymous? It's not normal.
Strong identity combats spam and abuse. I would choose strong identity over spam almost every single time. I do not disagree that there are some online communities that are respectfully anonymous. But do you think e.g. Reddit is one of those? Because I do not. Regardless, you can still both a) identity check and b) run an anonymous community (and c. not store identity information). You don't have to expose the identity data in the product/community/forum itself, so nothing about making identity easier to use and more streamlined defeats the ability to operate pseudonymous services in the least. I really don't understand the "anonymity by default is good for a wholesome society" angle whatsoever.
Oh no, I'm not going to go down that slippery slope. We are not talking about CIA whistleblower levels of anonymity here. This is just basic sanity. You may never be able to fight abuse 100%, so it's good practice to reduce the surface of compromise as much as possible. If the information is not needed, just don't send it. It's about de-risking the possibilities. The fact that banks, healthcare institutions etc. are trusted within a boundary does not automatically mean every tom and dick company out there should be trusted as well. There must be a strong justification for access to identity and spam is certainly the weakest out there. Fake identity is not hard to create. Bank fraud is rampant in many countries where fraudsters run large rings using such fake accounts. If banks are not able to stop these, online communities for the purpose of bot detection most certainly won't.
Fake identity is is not hard to create online. You’re right! That is the problem. Fake identity is orders of magnitude harder to create in meatspace. You don't solve that problem by saying “welp I guess we just have to deal with spam to realize pseudo-security via anonymity”. I don't disagree about privacy, even. I think you’d find we agree about not sending information you don't need. Where we talking past each other is on the topic of anonymity vs privacy. I want strong identity and privacy and tools and laws that protect my identity and privacy online as well as offline. Tools that let me manage who has access to my private information and for what use cases. Tools that alert me when that information is accessed or shared. Tools to allow me to verify the information provided by others is genuine. This has nothing to do with anonymity.
> The internet would be a better place if there were more identity requirements
This is a completely baseless claim, as most arguments against weak (ie pseudo) anonymity seem to be. Outside of banks, healthcare providers, and payment processors, I see little of benefit. Before bringing up any arguments that involve poor behavior or misinformation, please refresh yourself on the current state of Facebook (where nearly everyone is using their full name).
I already think twice before (and often decide against) using a service that requires my phone number. I will _never_ use Discord or Twitter (in my personal life at least) for this reason. Except for banks, liquor, and the pharmacy, I am almost certain to decline doing business rather than providing my ID.
I'm curious, do you take this same stance in meat space? Would you rather not know who your friends are and address them by a changing handle? Would you rather be given a pseudonymous name to use for the duration of your trip to the grocery store? Would you prefer to be delivered a new car every time you need to go somewhere so people can't associate you with a vehicle? Do you really have these anonymity requirements.
The claim is not baseless. There are strong technical reasons why identifying the components in your system is a good thing. and there are practical social reasons.
> I'm curious, do you take this same stance in meat space? Would you rather not know who your friends are and address them by a changing handle?
There are many people I'm friendly with that I know little about. They could very well be giving me fake information about their life. I don't see this as a problem.
> Would you rather be given a pseudonymous name to use for the duration of your trip to the grocery store?
Well in most cases I wouldn't give anyone any name at all. Why does the grocery store require my name?
> The claim is not baseless. There are strong technical reasons why identifying the components in your system is a good thing. and there are practical social reasons.
There are also strong technical reasons not to. And there are practical social reasons not to. As far as I can tell, you've provided essentially no argument supporting this general claim:
> The internet would be a better place if there were more identity requirements
We already have a society that identifies people when doing business. The burden of proof is on an anonymity advocate to demonstrate why that is harmful and should be changed. I may mot have convinced you that having strong identity enables strong security and reduces spam (that is my argument). But it’s also not my problem if you aren’t aware of the nuances surrounding how security, privacy and anonymity work. You haven’t made any compelling argument as to why we don't need identity in cyberspace beyond a naive axiomatic assertion that “businesses don’t need them so they shouldn’t collect them” and some FUD level fear that strong identity is an Orwellian technology hell bent on ruining your life. There is so much nuance I don't feel like we’re doing the topic justice. There is a huge spectrum between “ad tech tracking everything you do” and “everyone looks like a spam bot”. The mindshare is heavily skewed toward spam bot because ad tech is abusive. You can have strong identity and privacy without invoking anonymity. You can be anonymous and still fall victim to fishing attempts and scams. Anonymity is not synonymous with security or privacy. Security means you know who you’re communicating with online so you can establish trust. Privacy means you don't need to share invasive personal details in the regular course of existing in society. Anonymity means nobody knows who you are. I want a society where my digital communication with other people is authenticated and a baseline of trust is established. Do you use a secure messenger app that has E2E encryption? Guess what, that depends on strong identity. You are not anonymous but you are private. I would take a secure and private society every time over an anonymous one that offers weak, if any, guarantees of security and/or privacy.
I work on a product that doesn't collect any PII. We made the decision very early on not to collect any information we don’t need because that’s literally not our business. I am deeply aware of the landscape on these topics. However, as a society we cannot run in a “normal meatspace anonymous cyberspace” mode. We need to bridge civil identity in a secure and private (those are fundamental human rights) way into the online era. That is the core focus of the product I’ve been working on. In reality people have identities whether they use them offline or online. The goal is to protect those identities so they cannot be abused, not remove them altogether.
> We already have a society that identifies people when doing business.
This is false. There are many cases in real life when this is not the case as explained in the very post you just responded to.
> The burden of proof is on an anonymity advocate to demonstrate why that is harmful and should be changed.
You are making certain claims and then saying it's up to others to disprove you? If that's your attitude why are you engaging in this discussion at all?
> But it’s also not my problem if you aren’t aware of the nuances surrounding how security, privacy and anonymity work.
Frankly I don't have the energy to engage with you. Take that as you will. You clearly think you know much more than everyone here already anyway.
It is not wholesale false by any stretch of the imagination. Yes, there are cash-only businesses that don't take credit cards with your name on them and smaller operations which don't have any KYC requirements or loyalty programs or otherwise engage with you in any activity that would identify you. I am not disputing that... it really feels like you're deliberately cherry picking my points and only responding in a fashion that reinforces your stance rather than actually addresses the discussion.
My point is that generally (not in all known cases) we are okay, in meatspace, (and quite familiar) with (and even require at times) exchanges that identify us whether it's putting our name on a coffee order, using a credit card to pay, signing a waiver, buying alcohol, visiting the hospital, opening a bank account, sending children to school, filing taxes, driving a car, etc. So to take the stance that anonymity is absolutely better to the point where it should be considered a fundamental human right and we should be worried about some company providing an identity verification api to online services because the whole shroud of pseudo anonymity of the internet is going to fall to pieces does require some supporting material, in the least. Otherwise it's just FUD.
> You clearly think you know much more than everyone here already anyway.
If I seem quip it's because I responded to a question asking if this API would mean we see more identity requirements because it possibly lowers the barrier to adding one with an affirmative "I hope so" and the tone of the responses has been "dude what a terrible thing to say this is hackernews doncha know anonymity is chic" followed by anectdotes about how sometimes you use an identity when doing business and sometimes you don't (so see! anonymity works). That's not a discussion it's just virtue signaling.. and it is certainly the responsibility of the virtuous (in this case those who are supporting the stance that my statement is terrible because anonymity is righteous) to back up their conviction (otherwise it is, simply, a virtue and nothing more). I've presented an argument that we needn't worry because meatspace society has figured out a good balance of security, privacy, and the occasional but rare anonymity, and it is perfectly functional so I don't think there's a qualified threat to the internet. I've described how strong identity backed security and accompanying privacy are not the same as anonymity and suggested that many people are conflating the two. And I've laid out rationale explaining that strong identity is better for security (this is not simply a "claim" if you know the first thing about security) and how if we want to see real privacy on the internet, not just the fake privacy that you get by being pseudonymous, then we need to fundamentally understand and legislate and engineer policies and systems that support such.
So far nobody has presented an argument as to why anonymity is, specifically, better than strong identity with privacy rules beyond "well sometimes you don't need strong identity for things to work so it should be the default" which is talking past me because I never made a claim to the contrary. I've backed up my assertions with the as far as I know factual evidence that identity both enables better security and deters spam (which are problems that are worse on the internet relative to meatspace). I don't know what else you want. I'm sorry my responses are laborious.
So do you provide your full name, street address, phone number, drivers license, and social, to everyone you meet? And do you require that from everyone you wish to be friends with? Otherwise how do either party know the other is not providing false information?
This is essentially what you are stating you are hoping for on the internet by allowing every company to request identity information.
> The internet would be a better place if there were more identity requirements SO LONG AS companies are not legally allowed to sell or transmit that information to advertisers or other third parties without explicit opt-in consent ideally on a per-use basis. Or simply at all
This is a pipe dream. The online world spans the globe and we can only enforce the law in our own respective countries.
And even if all countries were cooperative about enforcement, distributed communication tools already exist. The internet has always been a place where you can go to share your thoughts without worrying about what your family or friends think. I don't think that will change in our lifetime, if ever.
Anyway, the market can sort this out. If using an ID to authenticate your Twitter account makes Twitter more successful than its competitors, great! I would not count on it.
A fully anonymous society is also a pipe dream. It doesn't work.
You already provide your name and phone number and email to Twitter. You already identify yourself. We're talking about making that exchange more reliable and more secure...
I haven't called for a fully anonymous society. I said realistically we cannot force people to identify themselves across the world. And, once there is a breach of identities, we will be back to where we are now where we can't reliably sort out who's who. It is a pointless exercise that potentially enables authoritarian regimes to silence dissent indefinitely. No thanks.
> it may well make sense for us to enable them to restrict themselves in the future. In this world, Stripe could tell their customers that the business doesn't have access to the raw details
This sounds great -- I don't want to be handling sensitive data of users, and I don't want to give sensitive data to businesses. But I'd rather this be a separate Verification product, with different branding, docs, and UI, so users and businesses are all clear on what's happening to user data.
Very glad to see that 4th bullet point there. I really like the option of, as a business, being able to say "No, I want to know whether the ID matches their Name/Address, but I don't want to be able to access the image data".
How are you going to handle E.E.U. citizens? It seems that the GDPR applies here. The only real solution I see is to have a separate E.E.U.-based company.
Do you feel in doing this that you're making the web worse? As a business, you certainly have no obligation to be ethical, but doesn't it feel a bit strange as a person who presumably grew up with the web to be playing such a big role in harming the people who use it?
> They may need or wish to perform additional checks on their side. Etc.
So they get all the data in the off chance that a Stripe customer might want to do something with the data aside from the basic “yeah our large global identity verification service says this person is legit.”
I’m not super clear what a company might ”wish to” do with that data that isn’t served by the basic “this person is who they say they are” function (Does Stripe need their clients to act as guinea pigs to see if the service actually works as intended? If their mysterious black box “wishes” turn up a case where this isn’t working as intended, are your customers required to share that data with you to ensure the overall reliability of the Stripe Identity service? Or do they just get to build a database of info they get from Stripe Identity?)
> While many of the businesses initially building on Identity wanted access to the raw information, it may well make sense for us to enable them to restrict themselves in the future.
Oh nevermind, asked and answered! Just turn on the data hose to whoever has a website and will pay Stripe for identity data and maybe adjust it later if you catch some flack for this practice?
It’s kinda hilarious that the whole “people trust Stripe with their data” as part of the sales pitch as if this didn’t come across to me (a layperson) as a direct violation of that particular trust.
It's unfortunate , I'm an Enterprise Architect in Banking and honestly I wouldn't have let that feature go in production.
Businesses that do not have a legitimate reason to view my sensitive document like Passport , should not be allowed to do so.
Only authorized institutions like Licensed Payment Institution / Banks / Insurances etc... should be allowed to do so and AFTER they've been approved.
It's sad because you can tell right away that this will we be abused by Stripe's customers inadvertently. Just like Uber "God View" thats you view any customer ride...
Pretty sure the amount of "Identity Theft" or "Privacy" Scandal is going to explode with such technology available for everyone.
I don't know how a product manager at stripe could tell himself that "Yes , it make sense to give access to sensitive documents" in an age where people are seeking more privacy.
> Businesses that do not have a legitimate reason to view my sensitive document like Passport , should not be allowed to do so.
I get parent comment's totally legitimate security concerns. And businesses that have no business having my identity should surely not be asking for it. But I don't honestly understand how this has anything to do with Stripe. These businesses (which for whatever reason are asking for ID verification before doing business with you) are just using Stripes API to verify identity instead of just taking your info themselves.
Any customer giving their information presumably knows they are giving said business their identity documents, the customers might not even know that the business is using Stripe's API.
Furthermore, Stripe is ostensibly coming in here to streamline the process for business taking identity info from customers. Why - in your opinion - is it worse for consumers when these-type businesses (which ask for identity), use their own-rolled id verification than using Stripe's?
> Why - in your opinion - is it worse for consumers when these-type businesses (which ask for identity), use their own-rolled id verification than using Stripe's?
The point isn't so much using third party , we use a third party on prem.
My point is very simple : Why on earth would you let discord view my passport ? JUST WHY ?!
Those documents are very sensitive and no one should have access to them unless they have a VERY good reason to do so. PCI DSS treat "card information" like hot lava, the same model should have applied here.
Stripe should have acted as a "Trusted Party" and securely store those documents without giving access to it but just let you extract the information from it.
Thus you would been able to have uniquely identified user , backed up by government id , but you can't get access to the documents and sensitive data should have been redacted .... just like Card Number...
Again unless you are a Fintech / Financial Instituion , with a VALID in effect license , you should not have access to those documents.
I totally agree. Businesses should not legally be allowed to access more information than they need. Like why do hospitals ask for my Social Security number? I know I can refuse it, but if they really don't need it shouldn't it be illegal for them to needlessly probe my identity?
If you've ever been carded at a bar/liquor store in a foreign country, then that random small business has seen your passport, no? How do you feel about that?
Being human to human, unless they're wearing tech that would allow them to scan/archive it, normally they just verify (eyeball it) and you get it back.
Here, with this system, they could verify and keep the data regardless of what I think is going on.
If you can't assume that a website you upload a scan of your ID to isn't capturing details about it, then you can't assume that a bouncer checking your ID isn't wearing a surreptitious HMD, no? In both cases, you're submitting your PII to an unknown process that seems like it should be safe, but with no previous experience or brand-image there to tell you whether there's actually any proof that it's safe.
That's a silly stretch. It's vastly more likely that a website fetching copies of a passport image is leaking copies or leaving the files where it shouldn't by accident and has the data exfiltrated by third party identity thieves, compared with a bouncer having a secret scan-quality camera installed by identity thieves without the bouncer noticing.
Who said anything about the bouncer not noticing? I'm presuming that the bouncer is the identity thief. If you're looking to make money as an identity thief, being a bouncer is the perfect job!
There was a story on Reddit a few months back, about a bouncer who, when handed real ID cards, claimed they were fakes, and proceeded to immediately "cut them up" (so that people didn't feel any need to demand them back, since what are you going to do with scraps of an ID card?) The bouncer was actually palming the real ID and cutting up a random piece of plastic instead, and then later handing the real ID card off to the owner, who sold them on the black market. One victim of this scheme figured it out after being a victim of identity theft, as they traced back a submitted capture of the photo ID that some third-party had retained, to the one that got "cut up." The police raided the establishment, and a whole ring of people were caught up in it. It was a whole thing.
There's nothing that leads me to believe that this isn't a simple, obvious, repeatable, low-stakes, high-margin criminal business model. As such, it probably happens a lot.
I would still assume identity theft via websites being hacked is a lot more common, and likelihood is an appropriate factor when evaluating protective actions. But you make a good point about the bouncer.
In EU, you don't hand over ID/passport like credit card in US. You show it while keeping it in your hand. Second party can verify your age, while being unable to copy stuff like machine readable zone.
You seem to be contradicting yourself. Businesses are asking for Stripe to verify identity. These businesses just need verification, not copies of documents, but Stripe makes them available anyway. That's the whole contention.
As a consumer, I would expect Stripe would do the verification and give the business partner the result, but not all the data they used to get the results themselves.
I actually disagree with this as well. The Hacker News user is not the average user. The average user has no idea what Stripe is, they assume that the business requesting a verification will have access to anything they submit.
I know this because we use Stripe Identity ourselves (in beta) and user's have no idea that Stripe and us are different companies.
That seems right. Businesses aren't islands, they work with other businesses to provide their services. But you as a business have an issue with a vendor/supplier, that's still on you. If McDonalds can't get fries, I don't blame farmer X for a failed harvest, I blame McDonalds for a fragile supply chain.
As a person that still is trying to recover from identity fraud that happened many years ago. I am always very weary of companies that demand ID papers. Most of the time I will avoid them.
Most companies aren't even supposed to ask for identity papers is Stripe verifying with the passport issuer whether the country allows given their passport to some identity?
I think there should be some sort of consent system built in were when the API consumer wants to download a passport the customer gets an email with the question if they consent in them fetching a copy.
But, also as an Enterprise Architect in Banking, if you were considering Stripe Identity wouldn't you rely on it for KYC compliance? You can't just say Oh we outsource that to a third-party called Stripe, can you?
That's not my point , here my point is very clear and straightforward.
Some people at Discord now have access at the pictures of my Passport that I uploaded during the verification process because they use "Stripe Identity".
The FAQ is very clear , Stripe give you full access to those documents. It should NEVER do so.
Now the very smart people have Discord have access to my passport they can now take a 50K Loan using my documents and face-check video , social security and some fake income documents.
They can also destroy my entire life because I maintain a political blog with views they don't really like that they consider "hate speech". These are exaggerated examples , but you get the idea.
I'm concerned by this , because more and more startups are going to use it to increase the value of their userbase to reduce fraud and look more attractive for their planned exit.
In the meantime, people having access to my personal documents is going to go exponential...
Again , I'm an Architect in Banking we have 500+ Partners selling Loan for us , they have NEVER access to your documents / personal data. They can only tell if the document has been approved , income range and some basic information. You don't know what they are going to do those sensitive documents / info , even if you have contractual agreement with them.
Banking industry has had a very simple rule that everyone has been following for decade : DON'T TRUST THIRD PARTY. Stripe has decided to do otherwise I guess and I'm pretty scared about it.
Stripe Identity seems like Identity Theft as a Service.
This is a good policy when ALL first parties meet a certain (regulatory) bar. For banks, I assume that bar is "don't become insolvent" and more recently "don't lend money to terrorists."
The problem is that, as we've seen from the countless hacks in recent years, the first parties are NOT all meeting the bar when it comes to security, namely "don't leak (or abuse) users' private personal info."
And that's unfortunate, because a lot of the time, all a company really needs to know is a "does the registered account correspond (uniquely) to a real human (with certain legal characteristics)." Sometimes they need to know for compliance reasons ("our users are adults" or "aren't terrorists") and other times for uniqueness/fraud reasons ("We want to reduce spam accounts" or "we're paying users $10 to sign up and so need to make sure users aren't signing up multiple times.") It'd be great to be able to answer those questions without having to protect all that personal data that goes into answering it, similar to credit cards.
But your main point stands: if Stripe is allowing companies access to the collected data, then from a security point of view it's little better than having the companies collect and store it themselves. Hopefully Stripe explains their reasoning, or even better, course-corrects early in this launch.
Why would you upload a copy of your passport to Discord, via a third-party or not? The issue here is just trusting people you shouldn't be trusting with things you shouldn't be trusting them with.
The alternative isn't WhizzBangApp doesn't request you upload documents, the alternative is they roll their own WhizBang ID service, or use a Stripe Identity competitor.
I know my bank needs to verify my driving licence or whatever, and I tr.. well banks are heavily regulated anyway, so I'm happy to upload it without caring whether they use Stripe Identity or their own or whatever.
I know Discord has no business with my passport or whatever, so they're not getting it whatever they use under the hood.
It is entirely fair to have to provide KYC documents for a service you need or desire to use but have the digital artifacts usage governed and access limited.
I let my Congressperson know policy is needed about online identity service providers needing better governance over identity data, as businesses aren’t going to do it voluntarily unless the law requires. This should probably be overseen by the CFPB, even though identity is a bit of a walk from finance (while Stripe is still primarily a financial services provider).
More data concentration makes for a more worthwhile target, thus wiping out at least some of the potential upside. The net effect may very well be negative.
Given the regular stream of extremely large data leaks even from providers who should have size, motivation and competency to protect that data, I find it incredibly hard to believe anyone who tries to assure me, that they won't be breached.
> Considering that Stripe's original selling point was that it let websites accept credit card payments without seeing your credit card number
This is true, but it's also kind of a misleading statement; the original selling point was that you could accept credit cards without having to deal with the requirements of PCI compliance and merchant accounts, which is done (partially) by you not ever seeing the card data.
If there was similar compliance regulation around document storage, I would assume that Stripe would use "Identity-Document-Standards" compliancy as a selling point. As far as I know, there are no such requirements.
I do think your #2 point though is exceptionally valid, and would hope that the majority of Stripe keys are scoped to not even provide access to this data/endpoints.
Edwin from Stripe here. The two cases are actually very similar. If you want to avoid ID documents ever being stored on your servers, Identity makes it easy to do that. (Just as Elements/Stripe.js makes that easy for card numbers.) On the other hand, if you want to score card numbers or ID documents (and there are sometimes good reasons for doing this!), Stripe makes that straightforward.
I do agree the cases are very similar, which makes it all the more jarring how differently Stripe treats the data.
If you want to export credit card numbers from Stripe, you can only have it transferred directly to another PCI DSS Level 1-compliant payment processor, and Stripe imposes rather strict requirements on the transfer: https://stripe.com/docs/security/data-migrations/exports#whe...
If you want to export ID documents or selfies, you can just make an API call or use the web interface. This can and will be abused.
Conflating credit card #'s and personal biometrics/SSNs is your first mistake. You think they are the same, they feel the same, but the risk to the customer is so much bigger.
When a hotel copies my passport, they get a jpg. If they use Stripe, now I know they have my biometrics serialized to JSON. That feels way riskier and scarier to me, especially now that it's all centralized by Stripe.
We hear about our personal data getting leaked and hacked every day, and here is Stripe making themselves an enormous target and serializing all the data for malicious actors.
This feels like a really tone deaf misstep by the company.
Hotels don't even get a full copy of passport but a redacted version of my passport. That's my government's guidance only select entities should get unredacted copies.
If not possible, I should mark the copy to the specific user.
I’m an engineer on the Identity team. There are two somewhat separate questions here. (1) Whether the business should ever have access to this data. And (2) how exactly the business should access that data and the security properties around it.
On (1) this data is fundamentally the user’s, and there are often important compliance reasons as to why the user needs access to the raw data because of obligations that they themselves are subject to. It’s important to remember that you should trust both Stripe and the business that’s asking you to verify your identity. They are in control of explaining to you how they are using this data and giving you an option to opt out—or lose you as a customer.
On (2) we’re working on a way to restrict access via secret keys very soon.
How large percentage of Stripe
Identity customers do you foresee actually are required by legal regulation to retain all this information, as opposed to verifying certain aspects of an individual, as opposed to wanting it and likely handling it in ways violating GDPR and similar regulation?
I’d argue that before Stripe sends any PII other than validation results to a customer, it needs to verify that the business indeed is under regulatory requirements to gather this data, and only sell the required part.
Alternatively, you could invert the process, allowing integrating businesses to send documents to Stripe, who replies if they’re legit or not.
Finally, if there is a need for sharing data with customers for e.g. KYC, shouldn’t this be priced significantly higher than verification/validation, so that Discords and Clubhouses can’t justify it from a business perspective?
What is the reasoning for doing neither of the above?
Right but -- the attack vector is different. Scan/parse 10000s of JPG, and all that jazz -- to get identites. Not Trivial. Or if the hotel stored the copy as a physical photo copy -- you're not bulk scanning 10k pieces of parchment at super speed for your identity-theft ring.
But download JSON blobs? From 10k records the hotel didn't store properly (cause they are not IT experts, or don't have experts at close hand) -- if you get in to their system the JSON is loads easier to parse than the JPEG.
But like one of the Identity team folks said, the hotel would only have the OPTION to download and store those blobs. They aren't required to, and I'm assuming they would not. They'd be happy with the verification result and letting Stripe handle storing the PII.
Speaking from experience as we use Stripe Identity, and love not having to store the PII.
Isn't the problem that businesses are required to store this type of information (kyc verification information)? At what point are we going to have a logical system for verifying identity that doesn't require transferring the same list of data that every other 3rd party you've verified with also has?
I suspect most (if not all) KYC regulations require you to keep the evidence you used to verify the identity - even landlords in the UK are required to keep the evidence they saw of your right to live in the UK, let alone any institution that actually needs to prevent fraud etc. I suspect it's just a basic requirement of selling such a service to most medium-large businesses.
You're probably right about KYC, but KYC is just one of the four use cases presented by Stripe, and their customer logos include Clubhouse and Discord, which I highly doubt have KYC requirements or any need to access the underlying evidence.
Stripe could do this differently:
1. Allow the customer to choose whether or not they need access to the evidence.
2. If customer has chosen to receive access to the evidence, the Stripe Identity UI should clearly disclose this. (And they shouldn't try to deceive users by talking about deleting biometric identifiers.)
Stripe could have been a leader in setting high standards on how this type of information is handled. Instead they've opted to go the easy route and maximize profits while the rest of us pay the negative externalities from identity theft.
>Considering that Stripe's original selling point was that it let websites accept credit card payments without seeing your credit card number
I thought that Stripe's original selling point was that you could easily accept payments online without having to integrate with complicated bank and payment processor tech.
As I understood it at the time, alternatives required PCI compliance, which Stripe allowed you to sidestep thanks to tokenization, so I do believe that was a selling point. But this is besides the point I'm making, so I've edited my comment.
I wonder if instead Stripe could have routed calls through itself, filling in the secret info. Perhaps it was discussed?
For example, imagine Joe Biden buys a widget from WidgetsR.us and wants it shipped to his home address of 1600 Penn Ave in DC.
WidgetsR.us -> Fedex.com/order_XYZ/ship-to/Joe Biden at 1600 Penn Ave in DC
WidgetsR.us <- Fedex.com "201 CREATED"
Instead they could route through Stripe (where 123_joe corresponds to Joe Biden's identity docs in Stripe), which fills in the missing info.
WidgetsR.us -> Stripe.com/identity/123_joe?redirect=Fedex.com/order_XYZ/ship-to/$NAME at $ADDRESS
Stripe.com -> Fedex.com/order_XYZ/ship-to/Joe Biden at 1600 Penn Ave in DC
Stripe.com <- Fedex.com "201 CREATED"
WidgetsR.us <- Stripe.com '"201 CREATED"'
That way WidgetsR.us never knew the $NAME or $ADDRESS of user 123_joe, but was still able to use them. (Yes, they could send that info to themselves, but then they're on the hook for protecting it.) The huge downside here is putting Stripe in your business's critical path. But if it's already there for payments, then why not for identity?
Just an update on this—we've some changes in flight. Accessing sensitive verification results like date of birth, extracted document numbers, or collected images will soon require the use of restricted API keys. (More at https://stripe.com/docs/identity/verification-sessions#resul....) Thanks again for your feedback. I'll shoot you an email to chat more too.
The landing page contains logos for clubhouse, discord, and shippo, which are presumably companies use the service. Does anyone find those usages to be unnecessarily intrusive? Maybe it's just me, but a chat app or shipping site asking me for a drivers license scan + selfie would make me never want to use the service again. It's appalling how this sort of stuff is getting normalized, eg. google asking for id scans for age verification.
I honestly find it weird having all of these things suddenly want a copy of my passport in the cloud just sitting there waiting to be hacked in years to come when the security measures drop.
At this point there is giant databases containing everything people need to take complete control of your identity sitting there just waiting to be hacked.
I have no idea how to change it/fix it. But it seems weird to me.
The fix is for the government to make it a service. Right now, the government is punting responsibility to private actors who do not have the legal tools to operate an identity service.
The government already operates an identity service via passports. The only reason they do not have an electronic identity service yet is because it is beneficial for them to be able to blame private actors when things go wrong.
But at a fundamental level, why do Discord and Clubhouse need to verify my identity?
I don't think the question GP is asking is whether or not Stripe is a good way to confirm someone's real-life identity, or whether it would be better for the government to do it. I think what they're asking why we're doing identity verification for chat applications. Is this a good direction overall for the Internet to be moving in?
I don't like the idea that I should have one real-life identity that every service I sign up for online knows, even trivial services like social networks. I would argue a world like that is abridging on people's Right to Hide (https://anewdigitalmanifesto.com/#right-to-hide)
> Discord and Clubhouse need to verify my identity?
Discord are doing it for verifying bot ownership, because bots can do a lot of damage if they're just free to sign up to Discord and start "talking" to people. A good way of omitting bad bots from the network is by verifying and tying the bot to the (verified) identity of a real person.
I run a server with 1,200 people on it - I've never needed to verify my identity. You don't need to verify your identity for using Discord.
> A good way of omitting bad bots from the network is by verifying and tying the bot to the (verified) identity of a real person.
Is it?
I am much less charitable than you about whether Discord's bot verification is intended purely for user safety or whether it's a combination of laziness and a way of slowly clamping down control over how users access the service, how it can be extended, and what services/clients can interop.
I disagree that 100 servers is a particularly large number for a popular bot to join, but more importantly I think the threat model you describe illustrates a deeper problem with Discord overall. If the issue is that bots can sign up to Discord and just start talking to people, that's a permissions issue. Why can bots do that? And why is it OK for bots to keep doing that as long as they're in fewer than 100 servers?
So sure, we can have an extremely invasive form of verification, but we could also just... not let bots join random servers in the first place. We're jumping straight to real-life identification in a system that doesn't even support granular control over invites. In my opinion Discord's moderation and user-vetting tools are basically non-existent, so I am at least a little bit skeptical about whether verification is a completely necessary tradeoff between security and privacy.
I agree with your sentiment, but I don't even understand what the rationale for singling out bots is. A user of the service is either causing problems for others or not. Whether that user happens to be a bot doesn't seem relevant to me.
HN does quite well without requiring anything other than an IP address. So does Mastodon. And mailing lists generally have no way of knowing even that!
Do please enlighten me. I've never provided more to HN than a user name and password. There's no third party JS (I just double checked). I suppose the first party JS could be performing aggressive fingerprinting but I doubt it.
(Of course they also have my entire post, view, and vote histories. Those are arguably far more sensitive than any PII I could possibly provide, but I seem to have developed a habit of repeatedly forcing that information on them so I guess that's on me.)
You've provided them with a username, under which you post, comment and view content. This is enough to identify you as an entity in the system and what it is you're doing. If what you're doing, based on heuristics and what you publish is having a bad effect on "the network", you can be blocked/stopped/warned.
I'm saying HN do anything of this, but I doubt they only look at your IP when you're interacting with the service.
If you reread the comment chain the original context had to do with collection of PII. HN has only my IP address (no email, phone number, credit card, or ID). I am well aware that data regarding user interactions can be highly sensitive but it's not what was being discussed.
> ... slowly clamping down control over how users access the service, how it can be extended, and what services/clients can interop
So what? It's a private network and a private service. They can have it function however they like. That's why free market economies work - people will go find something else, or demand something else, should what's available not fit their needs or they feel too restrictive.
Something like Discord can be replicated easily enough by someone with enough money and a decent engineering team. And it's not like there aren't other options already.
> I disagree that 100 servers is a particularly large number for a popular bot to join
I'm not sure what you mean by "100 servers". I guess that's the maximum amount of servers a bot can join?
There are some pretty big servers out there. If a bot can join 100 servers, and they have an average of 10,000 users, then that's literally 100,000 people that can attached with malware, scams, and more.
Are you saying that's not a problem?
> If the issue is that bots can sign up to Discord and just start talking to people, that's a permissions issue. Why can bots do that?
I don't believe they can. I believe the verification process prevents this? I could be wrong.
> So sure, we can have an extremely invasive form of verification, but we could also just... not let bots join random servers in the first place
I don't believe they can.
> ... we can have an extremely invasive form of verification ...
Is it that invasive? Is requiring people to validate their identity before introducing something that has the potential to directly address millions of people all at once really that invasive?
Should my credentials (and character, intention, etc.) by validated before I'm allowed to talk on a radio station listened to by millions of people, or is the (privately owned) radio station being, "extremely invasive" by asking me to validate who I am before they let me use their network?
> Discord's moderation and user-vetting tools are basically non-existent
There are five levels of verification you can select from, ranging from none to highest. The former requires a validated phone be added to their account.
Their moderation tools are pretty powerful. You can create roles that are flexible enough to allow you to create some pretty interesting setups.
What is it about these tools that you feel could be better?
> So what? It's a private network and a private service. They can have it function however they like. That's why free market economies work
You're commenting under a thread that proposes creating a government service to reduce the implementation costs of identity verification. When we start talking about essentially subsidizing a business practice, then this isn't really about the free market anymore.
But even if it was, criticism is a fundamental part of how the free market works. People are free to advocate against a company's policy, to publicly criticize them, to encourage people not to use them, to argue for an industry to move in a certain direction... the free market has never been a shield against the kind of criticism happening on this thread. The invisible hand of the free market isn't actually invisible, when you see people complaining about companies and making arguments about the overall direction of the market, that is the free market at work.
> Is requiring people to validate their identity before introducing something that has the potential to directly address millions of people all at once really that invasive?
In this context, yes. In a different context, maybe not. But the Internet has different social norms surrounding anonymity, and most people online aren't thrown off by the fact that they might not know the physical identity of someone who makes a website or runs a Twitter account or releases a piece of code/bot.
I think that Discord's policy runs counter to how people expect to consume content online, and I think it's reasonable to describe their request as invasive in the context of Internet norms. You're on HN right now. Does it bother you that the site hasn't asked you for your drivers license yet?
And just as a quick side note on this point, Facebook has been around for long enough that I feel like we should drop the argument that tying accounts to real-world identities inherently prevents abuse or curbs misinformation. Heck, talk radio and cable news has been around long enough that we should probably drop the argument that vetting guests in traditional settings inherently means we'll have less misinformation.
> If a bot can join 100 servers, and they have an average of 10,000 users, then that's literally 100,000[1,000,000] people that can attached with malware, scams, and more. Are you saying that's not a problem?
I think the much more interesting question in your scenario is why Discord thinks it's OK for a malicious bot to target 990,000 people. I don't think 100 servers is a particularly high limit for a popular bot or a meaningful line for when abuse becomes a problem. I don't see how identity verification solves the abuse problem overall when hackers/spammers can just create multiple bots that can target smaller numbers of servers. I think it's really weird to act like this becomes a problem at 100 servers.
> What is it about these tools that you feel could be better?
The ability to create private invites that can only be used by a single person, the ability to require users to be approved before they join your server. The ability to ban words, the ability to block links (or better, the ability to only allow links to certain domains), the ability to block bots outright from joining (what seems to be the entire reason this verification process exists), the ability to easily share blocklists between servers, the ability to hold comments from new accounts in limbo until they're approved.
Some of this can be replicated by setting up your own bots and figuring out some kind of custom role where new users jump through hoops; and that's basically what a lot of servers I run into on Discord have to do. But it's really awful and it's a bad experience and it makes moderation unnecessarily complicated for non-technical users. As a result, most servers don't really set anything up because it's time consuming, so we end up with bad defaults on most servers. And that situation doesn't have to exist. Why do I need to find a bot to ban certain words on a server? That's something that belongs in the settings in a text input. Why do I have to go through this weird song-and-dance with invite codes, why can't I add people by their account ID? Why is there no one-click setting to just block new bots from joining my server unless I specifically grant them permission?
I've joined Discord servers that have these complicated house-of-cards setups where you're entering passwords into dedicated rooms to get granted access to other rooms by moderator bots. It's really bad, moderators shouldn't have to spend hours building custom rube goldberg machine to handle new users. This is stuff that should be configurable within 30 seconds from the settings page.
You mention that you "don't believe they can" block bots from abusing servers this way. But I just do not understand what the technical problem is. If the problem is that bots are joining random servers, and if bots can join my server without my permission, give me a single checkbox somewhere in settings to turn that off.
> But at a fundamental level, why do Discord and Clubhouse need to verify my identity?
For the same reason that Facebook required proof that you were a college student. A platform with a barrier to entry and a degree of exclusivity (but not too exclusive), will tend to have higher quality content and interactions than an anonymous forum that anybody (and anybot) can join.
Whether it's a good direction for the internet to be moving in, I have no idea. But it's certainly good business, which naturally makes me suspect it's the wrong trajectory.
> But at a fundamental level, why do Discord and Clubhouse need to verify my identity?
Maybe not those two, but your bank does, your insurance company does, your employer does, your business partner does.
There's a lot of places where there's trust placed in a specific citizen and their identity. The "root of trust" of being a citizen is the government, it'd be nothing new really to provide that digitally.
The proof of it being doable are the governments providing electronic ID's for decade or two now. Solving those really hairy problems hundreds of millions of Americans are struggling or encumbered by daily.
> But at a fundamental level, why do Discord and Clubhouse need to verify my identity?
Because of credit card fraud. I've run services where >5% of attempted transactions were done using stolen credit cards. So we used services that determine the risk of a transaction being fraudulent, and if the risk was too high, we required identity verification.
The alternative was to reject those transactions outright and permanently lose those customers, which is terrible when there is a false positive.
If credit card fraud is high, it doesn't matter whether you are a chat app or a bank app.
It sounds like you're asking for a payment verification system, not an identity verification system.
Does Discord need to know my identity, or does it need to know that my card hasn't been stolen? If it's the latter, then I'm unsure why Stripe is offering the business access to my passport/license, and I'm unsure why we would want to build a government ID system for Discord instead of a government payment system.
Credit card fraud can be solved by other means though. 3D-Secure for example will offload the liability to the bank.
The proper way to do it is to either enforce 3D-Secure or offer passport as an option when 3DS is unavailable, but because ID verification is getting easier and cheaper with services such as this one, there will be no reason to spend extra engineering time to implement solutions such as this one when you can just ask for everyone's passports especially when this also allows you to use the data for marketing purposes or be able to reliably ban "undesirable" people (and "undesirable" in this case doesn't mean "bad" or "illegal", it could simply be someone who uses an ad-blocker or doesn't "engage" with dark patterns like the company wants them to).
The bank should handle KYC. Mastercard and Visa forbid requiring ID. Handing PII opens up the customer to "identity theft" fraud which is much worse than having to cancel a credit card.
Who is “we”? Maybe the people operating the chat app have determined that it is in their businesses’ best interest to verify identity. I can certainly see it reducing costs for the business.
I am not suggesting all businesses be required to do it. But I do not see why businesses should be prohibited from doing it. If you do not want an identity linked service, then buy a website name, and start a business and do not require people to identify.
"We" in this context means the overall population of users on the web, including non-corporate users and individuals who are exercising their freedoms online.
We can't justify every architecture decision about the web via only business costs, if that was the case we'd make adblockers illegal and deprecate HTML. You need a stronger argument if you want me as a user to care about or support your business interests. If you want my support you have to show how this benefits the web overall, not just your company.
You keep arguing about a non-issue. Normal users do not need to verify with Discord. It's only for bot owners of popular bots to prevent the widespread abuse Discord saw.
I disagree that bot developers should be placed in a separate category from normal users, and I disagree that 100 servers is a meaningful place to draw the line that Discord is drawing.
The linked comment is incorrect to say that Discord only requires verification for specific permissions, Discord requires verification for bots who are in more than 100 servers regardless of what permissions they use. I think it's fairly obvious that verification for Discord bots is going to gradually expand and encompass more of the service, but maybe I'm just cynical from watching other companies do the same thing with their identity verification schemes.
More importantly, I disagree that identity verification is the best way for Discord to combat abuse. I think that Discord's moderation tools and server settings are lackluster. At best, I think identity verification is a an easy way for them to avoid improving those tools, at the cost of user privacy.
I don't think your comment changes anything about what I'm saying in regards to Discord, but regardless, I also want to point out that it's not just Discord we're talking about: we are seeing a trend towards more services online requiring real-world identities. So we can fight over whether Discord in specific should be grouped in with that trend (I think it should be), but even if you disagree on that point, it still seems pretty clear to me how Stripe's service is going to be used in the future. Do you feel identity verification is also a non-issue for services like Clubhouse and Facebook?
I think the fact that Stripe is advertising both Discord and Clubhouse as early partners says a lot about the types of services they think are going to be attracted to their product.
I think you're being too dogmatic about this. For me it's a perfectly valid use case for identity verification. It prevents a big problem and only affects an extremely tiny subset of users.
Is this a discussion about the architecture of the web? Or about specific websites? If Costco wants me to login to their website to buy things, or Facebook wants me to use real identity, that does not stop me from using alternatives that do not.
Am I entitled to alternatives that do not verify identity? Maybe the operating costs are too high?
Your proposal is for a government-run identity verification system.
The "we" in this context (ordinary users) also comprise the majority of voters and regulators who will ultimately decide how the system you propose is built and what restrictions it will have; and that is a group that is not solely motivated by your business interests -- so it is kind of important for you to be able to convince them that your system benefits them, and not just a few businesses.
Why should a Congressperson vote to build the system you propose instead of introducing a harsh privacy law that restricts which businesses are allowed to collect identification?
I think we can do both. Or at least restrict what a business can do with identification information that is mandatory, such as not being able to use it for marketing purposes or sold, and have it be temporary.
We're already living in a world where you have to "login with Facebook" to do many things, but at the very least you can currently still create a fake account if you have no other option. If reliable identity verification starts becoming commonplace, that option goes away.
This is one of those suggestions where I can immediately see some downsides, and am struggling to think of upsides, though I'm sure they exist.
1. I don't trust my government to have better security than anybody else.
2. I'm worried that I would lose the ability to opt out of a government-provided IaaS. Unlike Stripe, and I can't avoid using the government even if I try really hard. They already have my identity, so my privacy is dependent upon whatever their current policy happens to be. I do not trust unknown future administrations not to sell my data to the highest bidder.
3. The U.S. government has an... uneven track record delivering services and software, especially when there is no competition.
Those are my anxieties: what are the advantages to this approach that I'm not seeing?
The advantage is the government is the one liable for it working. Right now, I’m at the mercy of ATT/Verizon/T-Mobile keeping my phone number working for identification purposes. And they have no legal mandate to continue doing that, and I have no recourse if they stop doing that for whatever reason.
It is all the same reasons the government does not outsource issuing of passports. It needs to be from an official source with legal protections.
They do not have a right to your identity. But I do not see why people have an absolute right to use a business without providing identity either. If both parties agree, then they can exchange info.
The government is using 2FA SMS as your identity (for government services themselves), effectively offloading their liability into the mobile operators. But not really, because the mobile operators are not liable either. So as a little person, you are screwed all around.
If the government were to make an electronic identity, which it needs to for its own services, it might as well be accessible for all so you do not have to trust private businesses with it.
I suppose it depends on how much you want ~all of your online activity to be attributed to your real identity, in such a way that could be easily examined by the government.
You are the only one who mentioned speech, "online activity" is what was referred to. You specifically suggested linking profiles to government identification. "Linking" wouldn't seem to leave much room for anonymity regardless of activity.
You've nailed the complexity of this. On privacy, people are rightfully spooked about this for all the reasons you've mentioned. On safety, people are really happy about these initiatives as accounts backed by user identity are less likely to be used for harm. On security, leaks of these databases create issues to other sites and companies (eg: if Company X is compromised, then identity documents could be used to disable/bypass 2FA for Bank Y).
To make it even more complicated, regulators often hold contradictory views. They want to see increased safety, but in the same breath will announce actions against companies for violating privacy. This is a super-difficult balance to strike.
Specifically for Stripe, I trust them. So if I see that a new start-up is using them rather than rolling their own solution, that increases my trust. But it means there is now a big giant server in the cloud with millions (billions?) of identity documents that is worth a lot of money for hackers.
> Specifically for Stripe, I trust them. So if I see that a new start-up is using them rather than rolling their own solution, that increases my trust
Note that Stripe allows their customers access to the "captured images of the ID document, selfies, extracted data from the ID document, keyed-in information"[1]. So you still have to trust any company using Stripe not to download, store, and later leak your personal information, and you also have to trust them not to let their Stripe API token be compromised and exploited by identity thieves.
The problem with this is that the user isn't trusting Stripe today, they are trusting Stripe today, and all future Stripe managers and owners until the user dies and no longer cares. That's a big bet! Bad CEOs and sales happen.
Regular Discord users don't need to send in anything. It's used to verify your bot (only applicable for bots that are in more than 75 servers), which seems like a reasonable use case.
Does Discord only allow bot developers from Stripe Identity's supported countries to verify? Stripe is only supported in 44 countries[1], and Stripe Identity seems to support 56 (by counting options in the select dropdown in [2]), so that leaves out a lot of countries.
Yes, Discord only allows bot developers to become verified (which is required for bots to be in over 75 servers) if the developer is able to verify their identity via Stripe, no alternate process is provided for developers outside of the supported country list.
Presumably they have alternate verification processes for such countries as are not supported, when they deem it relevant to their business to do so; I expect it’s handled more as a case-by-case consideration and less as a well-defined policy, but you could still ask Discord Support and report what they at back to us!
Probably, and that's a good thing. The amount of fraud and bad actors outside of those supported countries represents a significant threat to Discord's user base. They might accidentally block a couple good developers making bots to help people along the way, but in doing so, protect the greater good.
More a requirement at this point. Discord had to crack down on malicious bot developers after some decided to log essentially every bit of information ever sent to them to be put on the internet, including information from private channels. Some scopes require this verification outright now.
> decided to log essentially every bit of information ever sent to them
Kind of like IRC? Which is basically what Discord is. Why would you assume anything you put on the internet isn't part of the permanent public record? (Wait until you find out about mailing lists, Reddit mirrors, the Internet Archive, ...)
(Aside: The only halfway sane solution to this is having separate disconnected identities for each service you use and cycling them semi-regularly so you don't need to worry too much about small identifying details being aggregated.)
Are you seriously Internet Archiving me right now. Okay, where do I start…
One, Discord is still primarily used by underage people.
Two, most Discord guilds are not public, this was a case of malicious bots. If you install an app on your phone, is your expectation automatically that it will skirt all App Store rules and dump the contents of your phone on the internet? I hate people that obsessively archive everything, but even I can see the case for IRC being expected to be public. Especially without SSL enforcement on a channel. Discord does not work like that at all. You are advocating for a treasure trove for the likes of Kiwifarms. (Which is exactly how dis.cool ended up being used, as a stalking tool)
Three, the people who say “every litte piece of info on the internet becomes part of the public record, be careful” are also the ones doing the archiving. Nobody else cares enough. Stop doing it. Not everything is worth preserving only because you are a data hoarder. I’m happy you think you’re building the library of alexandria, just make sure it’s not built out of piles of shit and PII.
If it was technically feasible to permanently record every public place outside the internet and make the recordings available to everyone, would you be in favor of that too? Just because the internet makes that technically feasible doesn't mean it's a good idea.
Many of them, perhaps. Certainly not all of them. That's irrelevant because there are a great many more who aren't necessarily saying much of anything but are logging everything. There are clear business and governmental (ie surveillance) use cases for such data so it's more or less guaranteed to happen en masse.
> most Discord guilds are not public, this was a case of malicious bots
Apologies, I don't actually use Discord and (based on this and a few other comments here) have realized that the term "bot" is being used in a very nonstandard manner. It seems that Discord "bots" are server side apps that can be launched (ie used) by other people. Using such bots to scrape private channels that the author doesn't otherwise have access to is indeed highly malicious and not to be expected or tolerated. (Of course one could wonder why such bots were permitted unrestricted communication with the outside world in the first place. Does Discord lack even a basic permission system?!)
Still, if you choose to run unverified code provided by an unknown party you should fully expect to be exploited to the maximum extent possible. It's really no different than installing arbitrary browser extensions or running arbitrary binaries that you found on the internet.
> have realized that the term "bot" is being used in a very nonstandard manner.
For some additional context, Discord bots aren't that far off from IRC bots.
You invite a bot to your server, you give the permissions and channel access you want it to have, and it receives various events over the web gateway such as "Message Received" of which the bot developer can use to build elaborate command systems and various other features.
Prior to the must-be-verified limit of 100 guilds, Discord had a serious issue with scam bots that would mass-message users promising free bitcoin or "insert free thing here", and usually one the "steps" was adding the bot to an additional guild. This resulted in the bot quickly cascading past 100 guilds within a matter of hours before Discord support had even noticed the problem.
Once joined to the additional guild, it would scrape as much of the server content as it could and usually dump it on some sort of "discord user tracker" platform.
On top of preventing joins past 100 guilds, verification is also required for some sensitive capabilities such as querying the entire member list.
Discord is a product, not a protocol, so it should be in their best interest to communicate the extent to which a third party application might misuse their data. This is the case with the new scopes that require ID verification now, backed by the promise that Discord will sue you if you break their conditions of using the data provided to you.
This has some other unfortunate side effects (user tokens can't be used for bots, third party clients are a risk), but unfortunately the only way to really curtail this behavior. Privacy is not something easily understood, especially for people outside tech that just want to be around their friends during the pandemic, do not be blind for this. Technology can't be the sole component of solving this issue, so I'm glad Discord is committed to legally perusing those that misuse their API.
That's a pretty weak solution in my opinion. Mobile OSes and browsers use a model based on permissions. There's zero reason for a Discord "bot" to be able to send information to arbitrary endpoints without informing the user about them up front. Collecting ID and threatening to sue is a half assed response. Or more cynically ...
> (user tokens can't be used for bots, third party clients are a risk)
... how convenient. So sorry, but we need to restrict what you can do for your own protection. Where have I heard that one before?
> Privacy is not something easily understood
"Privacy" isn't what needs to be understood here. "Don't run arbitrary code" is what applies; it applies everywhere whether you like it or not.
Discord uses it to verify the identity of bot makers - my understanding is that bots have been abused for a long time for data collection (think logging when users come online, go offline, change status, etc).
I don't get it. They're concerned about people abusing the system, and their solution is... requiring KYC? How does that solve the issue? It sounds like bot makes can still passively collect the info, it's just that when it gets discovered they can point to a real person to blame. Moreover, why do bots even need to know the online/offline status of users? Why not add a permission system so users can opt in/out of providing this sort of information to bots? I'm not a discord bot maker, but there's plenty of hobby/side projects I'm willing to provide to users for free, but not willing to attach my real life identity to.
> Why not add a permission system so users can opt in/out of providing this sort of information to bots?
The bots provide a function for the "server" and the server operator. That's like saying "Why not just provide a system for users to opt out of ChanServ/NickServ".
You don't say. Go to a random Discord server and you will see how bots are used. Your solution makes no sense and would kill most of the current use cases.
Clubhouse lets you collect payments to join some channels. Isn’t KYC reasonable in that case?
Re: Age Verifications on Google & YouTube: this has been covered well elsewhere. Google is required to do so by EU law. Blame regulators not the companies.
> Clubhouse lets you collect payments to join some channels. Isn’t KYC reasonable in that case?
If it's limited to only people receiving payments, then it's far more reasonable than what I thought was happening (eg. people getting randomly asked for ID scans to use their service).
Others have said it's limited to people who have a bot joined to more than 75 servers, or use certain sensitive scopes. So it's not quite that restrictive (only payments).
But I can say that I'm in... about 10 servers as a user and have a couple of bots I hacked together for various things operating in 3 of them and have never been asked for anything but my email. And across all the people I know using Discord, I was totally unaware that they even did that sort of identity verification because it seems like no one I know's ever run into it.
They’re required to verify that users are above a certain age. There are no requirements to solicit and keep information or documents beyond that. Just because the easiest shortcut to age verification is requiring a copy of a government ID, this doesn’t mean that that’s a good idea.
Chat apps use Identity to verify bots and prevent bad bots from spamming real users. And shipping services use Identity when a user is suspected as a fraudster—to double check before creating fraudulent shipping labels.
> Chat apps use Identity to verify bots and prevent bad bots from spamming real users.
Is bot spam rampant on discord or something? Are less invasive forms of verification (eg. SMS, credit card, or requiring a deposit) not enough? Can it not be solved via technical means? eg. requiring users to opt-in before receiving messages from a bot?
> And shipping services use Identity when a user is suspected as a fraudster—to double check before creating fraudulent shipping labels.
Yet I can buy hundreds of dollars of goods off amazon (or any other e-commerce site) without uploading my ID and giving them a live video feed of my face.
For both of these use cases, I don't doubt that ID verification provides benefit, I just find the privacy tradeoff to be unacceptable. As an analogy, a store can probably cut down on shoplifting if they performed ID checks at the entrance and kept a visitors log, but I think most people would find that unnecessarily intrusive and would refuse to patronize that store.
But doesn't that prove the ineffectiveness of requiring KYC in this case? Bad actors will just scrape the private API, bypass the verification and do their mischief, while good users who want to create bots now have to compromise their privacy by providing identity information.
Bots are officially sanctioned as such and have an application ID in the developer console as well as a label in the client.
Alternatively, nothing's stopping someone from taking a user account's authentication token and making the same calls, but that's against TOS (Discord calls them selfbots). The KYC they use won't protect against this kind of abuse.
Discord only uses identity verification for a small subset of developer accounts—when your bot application fetches the full member list or timestamped "online/away" data, AND is in more than 100 servers. Normal Discord users (and most bot developers!) don't interact with the identity verification process.
What's the difference between filling out your address in text versus scanning? Is your face not on the internet yet? Just curious what specifically would make you never want to use it?
Scanning lets you audit for photoshopping and sets a vastly higher bar for counterfeiting. (For example, Blizzard’s name change process requires you to cover irrelevant areas of your ID with actual paper, because no digital editing permitted.)
If you enter an address in as text you're in control of the data you're supplying. If you have to upload/scan a document then there might be other information they extract/store. I'm not someone concerned with such things but it's easy to see how they're different.
Smart. Banks haven't been allowed to monetize their KYC data, but this new non-bank class of payments companies have this opportunity. Interac has been trying to do this for many years.
Some years ago I worked on a system let banks do identity assertions with proofs via SAML attributes instead of sharing customer PII. It is now a federation of banks in wide use for govt services in Canada. The use cases were really limited because the federation partners were too conservative to extend the identity services to relying party consumer applications real people actually wanted to use, and institutional sales cycles meant product feedback was glacial, so it has existed for over a decade in this relative backwater of gov-tech. I think identity companies have mostly failed to get traction because of a terminal lack of consumer sexiness, whereas Stripe has the jelly.
Other companies in the identity space have been working on protocols and platforms, but none of them had a user base to extend an identity federation services into, which means they have never been able to make a real or viable product, just interesting techs. An internet payment provider with young consumer traction getting into identity is a Very Big Deal.
It's going to position Stripe to knock out a lot of retail banks who can't offer similar services. Imo, this could make them bigger than Apple.
Do banks want to monetise their KYC data? In the UK, the government launched a similar system in 2014 called Verify, a platform for banks and other firms with existing customer relationships to offer identity verification as a service to the government, and eventually, third party sites. Users would choose a participating bank they has a relationship with and login to their account as verification.
But despite paying over £20 a user for each verification they only got one or two banks to join, and the scheme was a disaster.
"Banks haven't been allowed to monetize their KYC data"?
I work for a major US Bank and they are most definitely monetizing KYC data, in fact we have made several billion dollar acquisitions just to scoop peoples data.
The convention in Canada was there were limits on how much customer PII banks and the payment networks could collect, use, and share or sell, and how. "Monetize," in my comment means "sell to others like a social platform / ad-tech company," whereas I would agree it could be monetized in other ways.
What I see is that Stripe doing IAM for platforms and services that people use daily sets them up to dominate retail and small business banking services if they wanted to go there.
Actually, it seems that this did go into production - you can now verify identity using the service. For example, you can identify yourself for Govt. of Canada services (immigration, taxes) by logging into to your banking platform that then vouches for your identity using a service called SecureKeyConcierge / Verified.Me - note that ALL of Canada's major and quite a few minor banks are signed up to the service.
The way the service works by getting permission from you, the user, to share some part of your identity with the destination and you can chose what you share. You could pick for example just to share name and not DoB.
The one reason I hate this otherwise superbly designed service and refused to use it is that is has a dark pattern where it creates a "SecureKey / Verified.Me Concierge Account" for "you" when you use it and starts proxying/pre-emptying the bank-login-as-verification process.
WHICH IS STUPID
AND SCAMMY
IF YOU ARE READING THIS VERIFIED.ME, THIS IS DARK PATTERN BEHAVIOR AND IT IS NOT RIGHT OR FAIR
/start rant
From my perspective, the whole point is - inhale - "I sorta trust my bank because I have to so I will log on to them so that they can vouch for me but I definitely don't trust you so why are you being a dick and making me make an account with your service that I don't trust and will never trust" - exhale
Just let the bank vouch for me each time, this is what I expect a reasonable and non-scammy service provider to do. Don't wait till you have my info then tell me, hey, I will make an verified.met / secureconcierge account for you so that <insert your preferred monetization rationale here> before you do what you promised to do.
I get the idea that they want to consolidate a profile so that you can pick what to share without entering it each time but they way it is done right now feels really slimy.
I wrote an identity verification process with Verified.Me. I understand your concern regarding SecureKey's creation of a user account for its service built around identity verification sources such as the chartered banks. Your Verified.Me account is tied to your mobile device, and that it doesn't have any extra PII. You can delete your Verified.Me account from the app at any time. If you move to a new device and want to use Verified.Me, it will tell you that your account is already on another device and needs to be deleted from it before proceeding. The PII that is shared from the banks to the Verified.Me consumer is name, email, and phone number. At all times SecureKey said that it's the conduit and doesn't see that data.
Similar to Stripe, SecureKey currently offers an analysis service for photo ID that looks for anomalies and calls them out. The next version of the service integrates with provincial records to concretely confirm validity.
There's definitely a market for this. Back when I worked in porn (in the camming sphere), we had a team of moderators whose main job was verifying the identity (especially age) of performers. With over 10k performers, this was a lot of work. And you can't just do it once. You have to do it every time a performer starts a performance. People would try all sorts of tricks, like taking a picture of themselves with an older sister's ID, all kinds of fake IDs, some better than others. Verifying an identity over webcam is no easy feat, those moderators had to be able to tell different passports apart (many, many, nationalities), tease out the fakes, and then make sure that they person in the ID is the same person presenting the ID. Problem is multiplied by the number of performers in the room. Performers who are eager to start making money instead of satisfying the moderators checklist.
Agreed, there is a big market here. I worked on a real estate rental platform where we required ID verification for all listings and applications. At the time we used Berbix (YC company), which is practically the same as Stripe Identity. I would probably just use this Stripe feature today, since we were already using Connect for payments.
Oh I'm not saying Stripe has a magic way of solving this. I'm merely stating that this is a hard and annoying problem, that many businesses would gladly let someone else handle.
Does Stripe intend to make a giant online database of international identity documents? Why should we trust Stripe to secure these? It could be Equifax levels of problematic if there would be a intrusion, but I also can't tell how Stripe plans to use this information.
These databases already exist. For example, all driver's licenses issued in a state are part of the public record, and many companies already maintain databases of them. For example, you can sign up for an account with the NY DMV that allows you to search all DMV records, as long as your use falls within one of a dozen permissible use-cases (including "To verify the accuracy of information submitted by the individual to the business"). Identity documents are designed to be verifiable, which in this case generally precludes them from being secret
No. 1. Stripe cares tremendously about and knows the importance of security—we’ve learned a lot from securely processing hundreds of billions of dollars in payments annually, and Identity is built from those learnings. (https://stripe.com/docs/security/stripe).
2. Any biometric identifiers that are created to perform the verification are never stored or retained—they are fully removed from all of our systems within 48 hours (usually within minutes).
> We will typically store the rest of your submitted identity information for 3 years. This includes all images captured, extracted data from your ID document including name, date of birth, and ID number, and any information submitted via forms such as name, date of birth, SSN, email, and phone number, and the verification response.
That doesn't make me feel a lot better. :( The images are enough to generate biometric data such as facial recognition profiles.
It's simply not legal to "not keep records" if you are running payments.
If you ran a payment to "O Bin Laden" but you have a driver's license picture showing that it is Oscar Bin Laden, from CA, DoB 2001, you'd better keep all that information for your records in case you get audited for potential OFAC violations.
We are very specific about collecting consent before doing anything with your data.
We ask for permissions before beginning the verification process, and if you consent, we will only use your biometric identifiers for the verification itself. (And again, those identifiers—which contain the most sensitive info—aren't stored.)
Specifically, we ask for an additional level of permissions before conducting any additional biometric analysis.
https://support.stripe.com/questions/common-questions-about-...
I think you might be missing the point. I'm sure gp does not doubt that you collect consent before collecting and using data. However, when presented with the choice of not giving up personal data and not using $awesome_service (or maybe even $essential_service), I’d imagine all but a very tiny percentage of people would reluctantly give up personal data. The data is then stored for three years, and if there's ever a leak, it would be hugely damaging given the scope:
> all images captured, extracted data from your ID document including name, date of birth, and ID number, and any information submitted via forms such as name, date of birth, SSN, email, and phone number, and the verification response.
> We are very specific about collecting consent before doing anything with your data.
How do you foresee that consent working if your product is used in account recovery flows?
For example, imagine if Steam adopted Stripe Identity as their only way to allow people with $$$$ worth of games to recover hacked accounts. If the user's only choice is to "consent" or lose their valuable account, that makes the "consent" something of a joke.
I'd be interested to hear how you plan to square that circle!
I have an account with a lot of content in it on an online service. When I signed up, they didn't require any personal information. Now they want some significant info or I can't get back into my account.
Well, I don't believe what Stripe (or anyone) says; I believe what you do.
Does Stripe have a legal contract with users that says something to the effect of "if it does 1 and 2 above (by mistake or by choice doesn't matter) - that they will be liable for it". If not, all the support documents and technical security documentation is moot. I want to see "skin in the game" by Stripe. If you're so sure about "security" sign a legal contract.
This is only about the specific image processing Stripe does to match your selfie with your ID document. The rest of the information on the document—which is what the GP comment was asking about—is retained for 3 years. Referencing the 48 hour retention period instead of the 3 year one is very misleading in this case.
Since we are storing these IDs on behalf of businesses using Identity, we need to retain non-biometric information for a period of time to support their use cases.
For example: KYC is a core use case for identity, which requires us to retain ID information for audit purposes.
For businesses who don’t need to keep the ID for as long, we provide a deletion API that lets them automatically delete the IDs from our system.
Yes, I agree that Stripe's policy makes sense here. But your original comment was misleading, in that it implied the information contained on your ID card was deleted after 48 hours. (It looks like you may have since edited it to clarify that you were talking about biometric signals? Maybe you haven't edited it, but it was definitely unclear enough that I, like the other responders, was confused.)
I never wanted Equifax to have any of my data, and yet here we are. After the breach, I wouldn’t ever be a paying customer to them if I had a choice. (Indirectly, I am still a “customer” in the sense that they probably still have my data and get new data about me—but apart from canceling all my cards, not sure what choice I have). In comparison, Stripe seems to charge for each product it offers. I think that’s a more fair and transparent model.
If the company you're interacting with uses Stripe ID verification and you are forced to use it to pay them, I'm not sure it's much better than going to a bank and opening an account and then Equifax getting the information immediately.
Edit (sorry, I don't think I can edit my own comment at this point): I think I was missing the point. Storing user data for 3 years after verification seems unnecessary for the user. So yes, it does sound like some data-mongering f*ckery is going to happen/is happening.
You are not a credit bureau's customer - the stores, public utilities, cell phone companies, banks, and so forth, are. They share that information to minimize their risk in extending credit (even something like billing you at the end of the month for services rendered is a form of credit) to you.
And frankly, if Stripe is offering any form of credit, it's likely working with the credit unions too.
Vote for representatives that pass laws similar to the GDPR but for USA? If Equifax or you were EU-liable, you could ask them to show, modify or remove any and all of your data.
These databases already exist. Typically the way it works is after you claim an identity, they will look up past addresses, phone numbers or employers then present multiple choice questions asking which one is part of your past. The companies I've seen that do these are not hosting (or claim to not host) any of the data, but rather have hooks to fetch it from financial institutions. I think it's mostly credit bureaus, but could also be banks.
The only way i would trust such a thing is if i have complete control over my data and how it's used (that's probably never gonna happen from a for-profit imo)
> It could be Equifax levels of problematic if there would be a intrusion
I'm sure they're not as lax as Equifax. I would hope that Stripe compartment all these documents so that a compromise of one database is not a compromise of the whole database. That's basic data storage hygiene in the information age. `Don't put all your eggs in one basket` as the saying goes.
I think the Estonian e-Card scheme is the right one despite hiccups in its implementation and ID verification should be the domain and responsibility of governments. Each ID card has an embedded private key-public key pair and you can sign to reveal your identity without having to resort to giving away anything else about yourself. There is already a zero-risk way for customers to verify themselves, so giant ID databases are a step backwards.
The electronic identity cards of Austria, Belgium, Estonia, Finland, Germany, Italy, Liechtenstein, Lithuania, Portugal and Spain all have a digital signature application which, upon activation, enables the bearer to authenticate the card using their confidential PIN. Consequently they can, at least theoretically, authenticate documents to satisfy any third party that the document's not been altered after being digitally signed. This application uses a registered certificate in conjunction with public/private key pairs so these enhanced cards do not necessarily have to participate in online transactions.
Germany has an electronic ID card that can be used to certify identity, or only age, or only uniqueness, for a few pennies per auth. There's an app that lets you use your Android phone as a scanner, paired over wifi.
Yet I've never seen any company use it. Everyone uses slower, more expensive private services that don't ask any questions about what you're going to do with the data they collect.
I am too, but that's not an endorsement. And more pertinently, that is nowhere nearly enough.
Every database of value tends towards uncontrollable sharing over time. The more available and more valuable it is, the harder it is to fight that trend.
The best thing for humanity is to stop making high-value data hordes like this. Unfortunately, the interests of smaller groupings are the reverse.
Stripe hires elite Stanford grads unlike Equifax is the simplest answer they probably wouldn’t say publicly. But the pedigree and engineering talent is miles better.
In what sense? Looking at incoming classes it’s apparent you people are objectively superior to people like me before college than I am several years after. It’s almost definitely innate too, all the more depressing for strivers-turned-failures/underachievers like myself.
The Stanford thing was really the basis for Palantirs competitive advantage in the consulting space over companies like Booz Allen Hamilton etc.
I really despise this trend of uploading your ID and a selfie for verification. I know it makes sense in some legal frameworks, but beyond that I find it invasive and risky (and rude.)
I recently had, twice, to do stuff WAY more intrusive. Video/conf call, need to hold my passport, need to have my phone on hand... People on the other side would call me on my phone to verify it's my number and they'd also send me a SMS with a code to verify on that phone.
After that they have: my face, copy of my passport, my voice, my phone number, my IP (unless I'm really going out of my way to obfuscate it), my email, etc.
Once I did this, then the series of documents to sign using Docusign came in.
That was the most serious KYC/AML I've ever seen.
I don't like it much but I gotta say: I can definitely see how it raises the bar for would be scammers/impersonators.
You said it happened twice. I haven't yet had to face this level of intrusiveness, but I fear that it's coming for all of us. May I ask what companies these were? If you don't want to name the exact companies, could you say the general purpose (opening a bank account, buying or selling real estate, incorporating a business, etc.)? Also, which country (I'm assuming the U.S.)?
It also outright disincentivizes usage for some people. The biggest group is probably people without a proper ID (a very US-only issue), but I personally avoided showing or sending my ID anywhere before I was able to change my legal name to one that didn't make me want to rip my eyes out.
MasterCard and their "True Name" program did a good thing there.
It’s not really a “trend”—if you think about it, ID verification is already required when checking into hotels, buying alcohol, or when visiting a bank teller.
As more commerce moves online, Stripe Identity was built to significantly reduce the number of organizations and humans that would touch your ID—in a faster, secure way that’s hosted by Stripe (https://support.stripe.com/questions/common-questions-about-...).
In very few of those use-cases does the entity 1) _retain_ any of that data, 2) posses an internet-scale database of identities.
And as we've all come to know the distinction between "able to surveil" and "collect it all" crosses a threshold to make it of a different kind.
If one's mindset is that in general, tech companies, unlike those other entities store it all, then there actually is a recent "trend" to migrate a normal behavior into an abnormally socially adjusted space.
It is already illegal to retain copies of ID cards or even some of the data in many countries. Just requesting a copy without redactions is wandering into a gray area in Germany.
It is very much a trend and that is very much what you are describing. The problem with identity verification is
a) Business that have no business requesting them do so. Linkedin, Google, Facebook does this when they suspect you are a bot. But if you have been a long time user, they hold your account with your personal data as hostage. You cannot delete your account if you object to providing your official documents.
b) There is very little legal protection if companies (not saying Stripe will) use your official documents to build an extremely detail online profile of you. Its all based on trusting what these companies say.
Just last month I had a DJ company ask for an ID and selfie for a $200 software purchase.
Maybe these things are designed for KYC’ing crypto and buying alcohol but it’s definitely a trend to apply this process broadly. All for the fear of generally preventing everyday fraud, piracy, and maybe just collecting data for some nebulous future use. Of course they rarely do the actual basics and apply any thought to not treating your real customers like criminals.
I don’t doubt Stripe can make the process better and do it in a good way, but can Stripe minimize what this process is even applied to in the first place and avoid manufactured consent.
One of the nice things about the internet is/was that it requires less bullshit and red tape than many real-life interactions. The internet becoming as bureaucratic and oppressive as, say, international travel, is absolutely a trend - and a very harmful one.
It's not a good trend though. I actually prioritize doing business with vendors that don't do this (I only shop at stores that don't generally card for alcohol for instance)
At work we do eIDV of customers and we tested 5 companies. One was quality but too expensive and required too large commitments; two couldn't detect badly photoshopped frauds we threw together, another couldn't detect a printed or on-screen copy of a document being captured (vs the real document - difficult to do, but important). The fifth which we're using can detect printed copies of documents around half the time, but their OCR is shockingly poor when it comes to recognising DoBs so we have to manually check and update the age.
We'll try Stripe and see how much fraud they can detect.
It is absolutely impossible to validate the authenticity of an ID document from a photo. Even if you capture a high-res photo and have it inspected by a trained document expert.
Fortunately, it is not necessary to do this. Modern passports and many identity cards contain NFC chips that allow you validate the data on an identity document with complete certainty (as in: you know that the data is correct and not tampered with). In the majority of cases (depending on the document supporting the necessary protocols) it is also possible to prove that the chip is authentic and not a clone.
Since the chip also contains a good quality color photo of the document holder, it is then possible to match this with the person holding the phone and do liveness detection.
Remote optical verification of documents is impossible, and anyone who claims they can do it isn't being honest.
It's a cheap way out. Anti-counterfeiting feasures like color shifting ink, paper feel, polymers, watermarks, microprinting, UV strips cannot be checked over a webcam.
Original paper documents are an anachronism. Any serious ID verification involves phoning home. Like police searching their database, border guards scanning your passport, or calling the car insurance company. Visa has depreciated offline EMV transactions. Offline credentials can't revoked so there's only the expiration date.
You don’t need to call the issuer. The NFC chip contains data signed by the issuing country. All you need is a list of trusted country CA’s.
You can check if it’s an original by performing a challenge/response protocol. You can read a public key from the signed data, the private key is not externally accessible. You ask the chip to sign some data with it’s private key and you check against the public key.
A bunch of verification systems use a video feed instead of a static photo. This helps a lot to weed out photoshops, and you can also check for reflections (the ones I had to go through ask you to move your camera under different angles)
While there is no infallible system, I think we currently have decently efficient solution (with sizable trade-offs of course, as you rely on the user having a smartphone that is supported, with a decent camera, decent lighting etc.)
> A bunch of verification systems use a video feed instead of a static photo. This helps a lot to weed out photoshops, and you can also check for reflections (the ones I had to go through ask you to move your camera under different angles)
Doesn’t help. You can photoshop and then print. You can use a card printer if needed to make it look like a real ID card.
To make a proper assessment you need to hold the document, and you need some tools (magnifying glass, UV light).
I don't know for US Ids, most modern official documents (e.g. passports, resident cards etc.) have coatings that look different depending on the angle.
You can sure still fake it somehow, but it goes beyond just printing a card.
Very curious to hear your results. In the past we used Onfido but eventually switched to Jumio. This was mostly due to Jumio performing better with Passport and VISA documents. We may in future move to Persona as we use them for SSN verifications and their customer support / account management team is fantastic.
The Stripe Identity product is fantastic. Some of the most impressive things:
1. If you are at a desktop, there is an easy transition to using your phone to take a picture of your ID (or a selfie if that's the use case - it will match selfies with ID photos), and then complete verification on the desktop.
2. It does all the image analysis (i.e. is the ID in focus, etc.) in browser without the need for a native app.
This almost proves that webapps are a competitive substitute to AppStores - making the consumer detriment very hard to prove in the current anti-trust framework.
Said it in another thread -- SMS's are a tangibly better user experience. You get to say stop in the moment, instead of searching through opaque settings... you can set DND to certain numbers for certain times...
The whole ecosystem is there and very few are playing with it.
SMS are a horrible user experience for notifications!
For push notifications, I can set them to silent by application, they take me to the right place in the app when clicking them, very often they offer quick responses directly from the notification itself...
Finally, it's bad enough to require a phone number for 2FA (or worse, as the primary user identifier). Why should I have to give my phone number to a service?
Any iOS notification permits you to "say stop in the moment" - you just swipe on the notification and select "Manage". The options are pretty well thought-out.
That's actually a whole different user flow -- you leave the notification to enter a separate system of controls with esoteric commands, over just typing what you want to happen..
"Stop" - forever until I want you back
"Stop this week" - self-explanatory
"Not during work hours" - also ^
"Consolidate weekly" - get a digest
"I don't care" - make better suggestions
So many contextual pieces to make better notifications are right there... and though a toggle button appears to be 'easier' the cognitive dissonance is less the conversational environment of SMS.
> I've never seen any SMS system that would correctly interpret and adjust to things like "not during work hours" or "consolidate weekly" responses.
I know!! I built a stupid simple bot for myself that just reminds me of things I want in SMS form... I text it things like 'For tomorrow - x, y, z' and then 9am the next day it messages with what's behind '-'...
There's a bit of configuration the first time you text the bot, for timezones and things like what does tomorrow afternoon mean to me? 2pm or 3pm? If multiple 'tomorrow afternoons come' do you want that as a digest or just individually, or w/e.
But for me, I love it because I forget things so quickly, so as I quickly as I can send a text, I can get reminded at an appropriate time. (and yes, I hate reminder apps.)
I'm still struggling how to keep it 'safe' - because Twilio keeps all the message data in plain text (more a byproduct of SMS) and holds a record of it, so while I can encrypt the db entries, I'm not sure how to make it 'secure' for other folks yet.
The fact that Apple has refused to deliver that only proves the point. If they did, many apps wouldn’t be forced to be in the App Store. It’s certainly possible, as iirc, it works on Android for years now.
Incredibly annoying that apple does not support this, while also trying to crack down on apps that is considered to just be a wrapped web-application. (In which case they want you to make a proper web app instead). Even using notifications is not considered enough of a reason to get an app they feel is just a wrapper approved.
The problem with having those APIs in the browser is that it increases the attacker surface area, which makes the browser less secure for everyone, including those who do not use PWAs.
The only saving grace is that you have to accept the permission box (I hope so at least...), which, for the average user, may not be much protection.
Simply existing in the world increases your attack surface; everything is a trade off between usability and security. Given the pressures browsers are under, they have incentives built into their business model to provide very good security which is a departure from most other software where security is just a nuisance at best and totally ignored at worst.
> If you are at a desktop, there is an easy transition to using your phone to take a picture of your ID (or a selfie if that's the use case - it will match selfies with ID photos), and then complete verification on the desktop.
Meaning they can identify my laptop and phone as belonging to the same person. I prefer they don't.
Just be aware that, no matter how seamless it is, you still getting crazy bounce rates for it. You would need a really good reason to use it (basically, be a bank and need KYC or something).
Of course, a common use case for this would be to only show the Stripe Identity UI when a user has a higher chance (based on IP, time of day, other on-site behavior, etc.) of being fraudulent in the first place, in which case a higher bounce rate is a feature, not a bug.
This seems like a really useful service but I am concerned this is going to normalize requiring identity info for sites which do not legally need it. I imagine the pretext for most will be fraud prevention, and while this might be true, I cannot see how this wouldn’t eventually be used for ad targeting and other “consumer is the product” funding models without regulation restricting it.
Depends on the degree of certainty I suppose. If it's close to 1 then probably not much though it does potentially provide more data to cross reference against when linking activity across services.
Techniques such as using different email addresses and other first party data would no longer be effective for limiting cross linking of user data (fingerprinting is an issue as well) if a legal ID is required and that data is shared with the service.
I’m on the fence about a service only using ID verification even from a fully trustworthy third party and not gaining any additional info (save for maybe a random unlinkable ID to prevent multiple accounts or perhaps just a flag indicating whether the ID is eligible for an account on that service). Even that bothers me. I would have to think about it some more. But I kind of do get it and see how that could enable better online communities. I’d like to think there is a better way though.
Wow, I would like to know about this has been engineered and QA'd. Owning this system on the product side would keep me awake nights. One question is tolerance on false negatives (you don't look enough like your govt id) - maybe they collect additional information, and use third party service for corroboration.
If my Stripe Identity can be used across vendors, it's almost like a digital passport. I'll ask, in jest, are Stripe and Estonia (https://e-resident.gov.ee/) in competition?
They've been doing it for years internally, I'm sure it's not much more stressful from a, "Oh did we let a bad guy through?" perspective, at least.
Definitely more stressful from a, "Did we let a customer of a new product down?" perspective though, for sure.
Also, not for nothing but has Estonia kept their system up to date? I've not been impressed with how it had aged last time I looked into it (a few years back).
Had to do this on a site recently and it didn't work for me at all.
It wanted to scan the back of my dl but Indian dls are totally blank at the back. Then it said my webcam wasn't good enough and showed me a QR code to use for my mobile. The link never opened. Tried it 3 times and 5 minutes later I just googled the next alternative site and bought it from there.
Lesson being use this only if it is totally necessary. You may lose paying customers in your overzealousness to be super tech savvy to KISS sites using a Paypal button.
Another commenter on this post said that this service isn't available in India, so it seems like the real flaw is that this shouldn't have been presented to a user in India by whatever site you were using.
Yes I'm talking from a customer point-of-view. Was trying to buy a vps and they for some reason wanted to scan my driver's lic using this before I could pay through Paypal. Yes I was trying to buy via PayPal but this was step 1 for some reason.
So I have only seen this work from the customer's point-of-view and it was not a good experience for me. I am a very patient person as i scanned my dl 4 times on desktop using a webcam capable of recording 1080p. Then i tried with a mobile and that didn't work either. A less patient man would have quit much sooner. I tried my best then just bought from the next site because they connected the Pay button directly to Paypal.
I think they mean 'was it stripe identity' (there is stripe branding during verification) or was the company using some other solution. The experiences I've heard from bot developers using Discord and thus their Stripe Identity verification haven't had any issues.
Yes it was stripe identity 100% not a custom solution. I think my experience was bad because it wanted to scan the back of my card which is just empty. Hopefully their tech will improve with time but my original point still stands. Don't do it Unless absolutely necessary. I was gonna pay with Paypal and chances of fraud with PP are very less anyway. They did lose a recurring customer that day since I couldn't pass this verification.
The pricing link on the top doesn't refer to any pricing section on the page. Is it missing?
Edit: This seems to be an internationalization problem. I am from India. The pricing section for Indian page https://stripe.com/en-in/identity#pricing is missing so the link doesn't work.
For anyone looking for the answer, in the US it's $1.50 / ID verification and $0.50 for Social Security Number lookup (an American tax number that is officially not for identity purposes but used that way all the time).
I've never seen a company release incredible products with as high velocity as Stripe has over the last few years. Truly incredible. $1.50/user may sound outrageously expensive at first, but having seen all the engineering power it takes to build something like this at Uber...it's a totally fair price.
This is on the less expensive side of alternatives and doesn't require a minimum annual spend quota. They nailed this for startups, which I imagine is a combination response to / anticipation of regulatory requirements in Web3 apps.
I thought that too - until I tried to use Twillo for the first time in a couple of years. Holy crap they overcomplicated the interface! There's 3 or 4 levels of menu all shown at the same time in different directions. The docs are also way worse. The product is still great, but the interface is a complete mess!
I have been thinking the same thing for some time now. Unfortunately, I wouldn't hold my breath. If they are able to stay private, they probably will. It's easier to build a business when you don't have to deal with the hassle and interference of public markets.
I'm not familiar with Stripe's situation, but there are non-public markets available for this kind of stock sale. You just can't buy from them unless you're already rich. I'd guess that long-term employees do have an amount of flexibility in that regard.
Unfortunately many companies have clauses in their options grants that prohibit employees from selling shares to any investor not approved by the company board (e.g. EquityZen).
This is already a thing, large investors like Fidelity do exactly this.
e.g. Fidelity has a significant investment in SpaceX through a handful of their mutual funds, which you can then purchase and basically invest in SpaceX indirectly.
Publicly traded organizations can have any kind of private investment. I wonder, though, if there is regulation around how much of the public org’s capital can be put in private stock purchases…
"In March, Stripe, which describes itself as “payments infrastructure for the internet,” became the most valuable private company in Silicon Valley, raising $600 million at a valuation of $95 billion. The Journal reported Stripe is considering going public later this year or early next year."
While that sounds like a great ... in all likelihood by the time it hits the public market most if not all the value will be extracted by the investors. With a branded company like this and equity markets as frothy as they are. I doubt there will be much value left for retail. Hopefully Im wrong though.
I always hear this line of thinking, but there aren’t ever supporting examples presented. Stripe reminds me of Cloudflare. Cloudflare is over 5x what it was at IPO (as of 6/14/21). Maybe what you describe is the case “on average” for most IPOs, but it seems to not be the case for extraordinary companies like Cloudflare (and maybe Stripe). Obviously just an n of 1 but I’m sure others could chime in with similar examples.
There are numerous examples on both sides for sure. I would add that performance also does well for companies operating in a bull market.
In the case of cloudflare (And many tech stocks) they had a black swan event of a large portion of the global economy going online during the pandemic which has juiced their returns.
Not saying it doesn't happen but rather that it isn't how people typically price their IPOs to generate value to the retail investor.
Yep, makes sense. A little nitpick: I wouldn’t call it a Black Swan because multiple people called out the potential for such a global event to happen (Gates, Taleb, etc.), but to your point it certainly further accelerated the move to online commerce, mainstream remote work, etc. Cloudflare and Stripe are/were both well positioned for that type of world.
The idea of going public is to raise another round of financing for the company while being able to get liquidity for private shareholders. It is not necessarily to create value going forward.
The best option is for the company to raise a good deal from the public markets (high valuation on limited equity) and then execute successfully without needing to raise again. If they do need to raise again they have hopefully not done a poor job on their original public IPO so that they can go back to the public markets. That said it isn't that important a factor.
> The idea of going public is to raise another round of financing for the company while being able to get liquidity for private shareholders. It is not necessarily to create value going forward.
Perhaps the company doesn't necessarily intend to create value going forward, but they must at least pretend to have that intention. What I meant was that the idea of the people buying public stock in a company is that the company will create value going forward.
> It is not necessarily to create value going forward
Not sure where you are going with that thought. A business that isn't creating value is going out of business or selling to someone who has an idea of how to use its assets to create value.
Actually not all companies create value. Monopolies create profits through pricing distortions but not necessarily value. My point is that creating value is not a key component of a company going public.
In this current moment I would wager that if you are suggesting that you will create value in the market going forward you will get a great return on your investor dollars but you may not actually execute that value creation. (relevant news: lordstown motors)
Perhaps my original wording should have been "delivering value" rather than "creating value." Of course it's true that some things that companies do are at best shifting value around and at worst extracting or even stealing value from elsewhere. But my point was that people who buy public stock from a company almost certainly expect that company to somehow be more valuable in the future.
I'm sure OP was implying "for retail investors" in his wish. Carta is just another way for rich people to access things that are only available to rich people.
I've been eyeing Scottish Mortgage which despite the name is actually a high-tech fund packaged as a stock publicly traded in the London Stock Exchange. They hold Stripe among many other interesting investments.
> $1.50/user may sound outrageously expensive at first, but having seen all the engineering power it takes to build something like this at Uber...it's a totally fair price.
I observed other teams struggle to build and have tackled challenges posed by identity, 1.5$/user is terrific price. Handling PII data in itself is a rabbit hole of engineering, product, and regulatory challenges. Let alone creating unique identities, matching, and what not.
Sadly out of reach for small projects. For example if you had a site with 100k users, you'd barely cover server costs with Ad Sense. $150k to check all of them? Would never happen :/ Maybe if they could pay for verification themselves?
In many cases you don’t need to verify the identity of every user. You can use some signal to determine when you need ID, or require it for accessing certain products/features.
Instagram may be verifying identity now (I didn't know... letting FB scan my id would be one of the last things I would want), but I'm pretty sure they reached a massive scale without such a measure.
When are we as a community going to move past treating frameworks/languages/tools as a silver bullet? Frameworks don't make teams better; good management, technical leadership, and great infrastructure does.
You are right but frameworks help with long term maintainability of code and also being able to build out features quickly which is what the comment was referring to originally. If they use Go lang of some other tech stack without framework it can help them achieve their goal but not at the same speed.
I can't even find any evidence that they use Rails, and I'm pretty sure their outstanding velocity is minimally explained by their choice of tech stack.
This is a refreshingly affordable and beneficial offering.
I did a deep-dive on KYC providers last year. The more well-known folks commanded 5 figure setup fees, wanted 1 to 2 year commitments, and sought to have you pre-pay for verifications. It reminded me of internet credit card processing pre-Stripe.
Absolute game changer, other actors in this market have big bulky sales processes with difficult pricing models and high commitment. If Stripe is competitive on pricing they will definitely win this market.
I gave up on Stripe because they clearly are a US-focused company, and do not have a global outlook. I find it disappointing that after so many years of being in business, their payment processing services are still only available to a few dozen countries. This for example makes it impossible to rely on them to build a global marketplace with Stripe Connect accepting merchants from all over the world.
Stripe is not for those seeking to run truly international businesses. We've been patient, but we eventually realized that they simply do not care. We care about Sub-Saharan Africa and Latin America, but they do not. We do not trust them to prioritize the global availability of their offerings at this point, and as a result we no longer even bother checking out their offerings. What's the point if instead of empowering us, they restrict our business model.
I haven't given up on them, but LATAM is definitely not their focus and we've moved 95% of our payment volume to a local payment processor, even tough we were one of the first private beta testers back in 2015 (wow, it's been 6 years already).
My angle is in Brazil. Even after all these years, they still don't support monthly installments, which is literally a single line API param that, honestly, I don't know any other payment gateway in Brazil that doesn't support it. Monthly installments is a huge deal in Brazil.
They also only now started the private beta of Boletos, which is unfortunate since Boletos are being phased out in Brazil due to the new PIX, which allow for instant payments 24/7. So they are basically releasing just now a feature that nobody really wants anymore.
Stripe connect also isn't available (AFAIK only the "standard" account is available, which mandates for Stripe onboarding and can't accommodate any white label marketplace integration).
The lack of focus is noticeable even from their marketing pages. Notice how in https://stripe.com/br/connect the explanation for "Cobranças diretas" and "Cobranças de destino" are exactly the same (the text "Os compradores fazem transações diretamente com os vendedores, mas quase nunca notam a existência da plataforma, que pode cobrar tarifas de transação" appears in both), making it impossible to understand the difference, while if you visit https://stripe.com/us/connect you see two different texts for each option.
Their support team has always responded quickly and politely, but we've had an impossible time trying to understand how they could allow us collect payments from abroad as a marketplace operating in Brazil, and that's even pointing out we didn't rule out opening a US-based company via Stripe Atlas if that was necessary. Lots of contradictory information and when we pressed on, they always end with them noticing that Brazil is still in preview and they still can't operate properly with Connect in Brazil.
Which is weird, considering it's LATAM's biggest market. This release of Stripe Identity missing out Brazil on launch, even tough it's a country that badly needs antifraud solutions, is only one more evidence of this.
They are building a platform where other companies are clearly just selling a product.
Identity verification is definitely something that gets better with more data as more people use it. Pricing low to gain market-share is the obvious move for companies which don't have pressure to show immediate returns.
Maybe it shows a more general difference in ambition between companies in the UK to those across the pond.
I think Stripe's opinion is that their current business is already a privacy nightmare (being a payments processor) and that they've learned a bit about it through the years so they feel they have the experience to do this right. I'm neither here nor there on Stripe as a company, but having worked with PCI and PII for many years, I'd trust a company more who had been through this process before.
1. Stripe has strict access controls—only those working on Identity/verifications can access the data.
2. Biometric data is not stored! It’s gone from our systems within 48 hours (usually in just minutes).
3. We think this’ll actually make the state of global privacy better—rather than having individuals collect, and verify your ID, Stripe will securely handle verification.
> 1. Stripe has strict access controls—only those working on Identity/verifications can access the data.
> rather than having individuals collect and verify your ID, Stripe will securely handle verification.
The above statements are materially false. You allow customers of Stripe Identity the ability to access and retain "captured images of the ID document, selfies, extracted data from the ID document, keyed-in information, and the verification result". [https://support.stripe.com/questions/managing-your-id-verifi...]
>3. We think this’ll actually make the state of global privacy better
I'm sorry but this is grade A bullshit. If your api provides access to data (extracted or raw), you are not improving anything. Quite the opposite actually, because now I not only have to trust the company that I choose to do business with but I also have to trust stripe, an american company.
The way domestic services (both public and private) in Finland verify user's identity is via bank credentials (Finnish Trust Network), via Mobile ID (Mobiilivarmenne), or via government FINeID. All these involve multi-factor authentication.
The service then gets the user's personal identity code as a return value.
Looks like that kind of flow is not supported.
Finnish users will be very hesitant of giving scans of their ID documents to foreign companies as no domestic online services require them. And of course Finnish companies cannot practically use this for now, at least for domestic users.
I've worked in risk & fraud for some time now. As online platforms become mainstreams and are easier to build I think Trust and Safety is going to become the key differientiator. Stripe Indentity will no doubt play a big role and benefit the whole internet.
Are any accuracy numbers for Stripe Identity currently available? I'm working with a merchant in Europe who is struggling due to fraud. Would be cool to figure out if Stripe Identity will improve over their current solution.
It really makes you wonder what kind of optics they are looking through when coming up with these things. Literally no one (at least not the majority of individuals) wants this.
It's one of those things that you expect a more shady company to release. Then again (and it's all hearsay mind you) that they are not a good company to work with, and when talking to employees who left, they don't seem like a good company to work for.
Amazing how Stripe consistently executes fantastic solutions for all the very real and difficult pain points of building commercial products on the web. Fantastic work!
Having experienced the end-user flow for Identity when doing bot verification on Discord, this was an incredibly seamless product back then, when it was presumably in beta. Can only imagine its even cleaner and faster now its officially released.
Because I've used similar services inside apps dozens of times. Sometimes to verify a drivers license to ride a car, sometimes to verify my ID to register a bank account.
Every time is was done in a few seconds so I assumed the companies used an API rather than every car-share building it themselves.
We’ve been using this to verify short term rental guests (non-Airbnb) for the past year and it’s been extremely positive. Given that our guests have trouble even following a link for check-in the identity product has some great UX, they rarely get stuck on it.
Some things don't change, like the dimensions between features like eyes, nose, ears, etc. Coinbase had an interesting presentation on this a few years back about how they verified IDs from pictures and dealt with all kinds of fraud.
Worst case, if the appearance is really drastic then it would just fail and require a manual intervention.
That is assuming the translation is of high quality and sadly that is not always the case. I am a native Spanish speaker and for the life of me I cannot understand most of the "Spanish Version" technical pages I read.
I work at Stripe, though not on the L10N/I18N or identity teams. It would be tremendously helpful if you could send me some feedback so that we can improve, jlh at stripe dot com.
I'm a native Spanish speaker too, and nothing in this announcement strikes me as unintelligible, but that might be my own biases at play given the familiarity with Stripe's lingo.
Otherwise, if you're a trained linguist and have demonstrable consulting experience QA'ing technical documentation then we'll be happy to arrange something.
In either case, we appreciate your feedback, and my emails are open!
What a quality answer! I get very poor quality support from Stripe's live chat, but the professionalism and helpfulness on HN from Stripe people like you and Edwin is beyond reproach, that's for sure.
That is an interesting data point. In my case the support I got from Stripe over the years (email, chat, IRC, ...) has been consistently stellar. Are you in the US?
I'm not in the US. Typically I use live chat during European evening hours, and I often get agents with upper-intermediate English skills, who miss the crux of my question or who are completely unfamiliar with Stripe's own dashboard or services. Not even on an API-level. Simply on a "here's a thing that Stripe has and here's something it can do" level.
No trabajo de gratis para multinacionales cuiquito. Tu credencialismo barato y sobrador lo puedes archivar donde mas te convenga.No se si es la respuesta que estabas esperando.
Google translate says: "I don't work for free for small multinationals. Your cheap and spare credentials can be filed wherever it suits you. I don't know if this is the answer you were waiting for."
I think we'd be a perfect customer for this product, as we're in the consumer HaaS space, and one of the issues I've been made aware of by other HaaS companies is that they were getting subscriptions which would get the hardware, and then just disappear, resulting in a loss due to theft.
I had been warned that stripe just wasn't set-up for this type of environment, but I think identity could really help.
At the same time I'm VERY concerned that stripe has allowed the API to download the proof of identity. Just like I don't want to be managing customer credit cards, I don't want to manage customer identity documents either, and I don't want to upload my identity to a company that allows the documents to be downloaded.
When I'm buying something on the internet, maybe I trust the company I'm buying from, maybe not but I know if they are using stripe, they never get my credit card number, so at most, they are able to only get away with the value of my purchase.
My identity is another matter! If I trust stripe to manage my identity, that's probably ok. I don't think stripe should blanket allow their customers to download my identity. I get that perhaps some companies have this requirement, and I'd suggest that they need to be able to work with Stripe directly to enable this for them, but for every company that signs up with stripe to be able to download the identity file...it seems like a huge risk not worth taking.
This is funny timing. My neighbor is the CTO at a company managing identity and building out frameworks and products to help other companies do it themselves. He was trying to pitch me on joining. Sounded neat until I found out how much they focus on the blockchain. It's far too likely it's a gimmick tacked on for no reason but getting hype and investment. Blockchain just attracts all the wrong people in my experience.
It looks like it's missing the user side of the equation. As in a user can validate they-are-who-they-say-they-are *once*, but Stripe is missing an opportunity to allow users to: validate themselves to a website regularly (OTP tied to identity), allow individuals to update their information (address change), allow individuals to revoke authentication, etc. It is a great foundation and there's huge opportunity for growth in this product.
Cross posting this from Twitter but please consider marketing to states. They are using a company called IDMe to verify eligibility for benefits in the US and a family member (and thousands of others) have wasted days on the phone with them trying to get them to do verifications because their automatic verification tech does not work. (There are class actions against this co they are so bad)
If this even reduces 20% of having to call up a human to verify my account because 'our systems have detected that you have accessed your account from an unknown location' then, yes please and thank you!
Also interested to see what form of IDs it will accept!
Only negative: Expensive...but I guess it's fair for it doing all the heavy lifting.
Not to take away from the accomplishment, but hopefully the "selfie auth" isn't considered the penultimate verification. With no social engineering, just finding a public photo of someone, one could composite a short video that would be very hard to distinguish from reality.
Looks like they have been working on it for a few years now. Here's a video from 2019 where someone from Stripe is giving a demo: https://www.youtube.com/watch?v=TDocEZ4f5ow.
I've been waiting for a service like this. I suspect we're on the precipice of a new Internet split, where one can be accessed with identity and the other is anonymous as we know it now. In some arenas, like comment sections, I welcome removing anonymity [1]. In other arenas I wonder if it will be used to divide populations online in some futuristic dystopian manner. For instance, only citizens of the United States with Good Credit and Good Social Score are allowed to read the Financial Times.
Those are 4 great bullets btw. They helped me understand the service a lot more than the landing page for identity. Might want to consider a view like this.
This is amazing. Did you build all of the scanning logic yourselves?
We’re exploring different options for scanning IDs like Anyline and BlinkID right now, but this looks incredibly well suited for what we’re building and would save us a tremendous amount of time if it works.
Yes, we’ve spent a lot of time on the scanning logic—especially to help guide users through photo-taking, since that’s half the battle for a successful verification.
> Document checks verify the authenticity of government-issued identity documents. Stripe uses a combination of machine learning models, automated heuristic analysis and manual reviewers to verify the authenticity of hundreds of different document types.
> Selfie checks look for distinguishing biological traits, such as face geometry, from a photo ID and a picture of your user’s face. Stripe then uses advanced machine learning algorithms to ensure the face pictures belong to the same person.
> ID Number checks provide a way to verify a user’s name, date of birth, and national ID number. Stripe uses a combination of third-party data sources such as credit agencies or bureaus, utility or government-issued databases and others to verify the provided ID number.
This sort of thing is definitely usable in Europe; if you’re thinking of GDPR the legitimate interest and legal obligation rules are likely to apply to users of this product. Eg at least one of my banks uses something like this for account identity validation (I see KYC is high on their list of use cases). Things like car rentals would find this really useful too.
Sift has a longer list of logos on their landing page, though I’d imagine even at this point that Stripe has more data. Sift got hit hard being unprepared for CCPA, I wonder what Stripe’s position would be. I’m naive but it strikes me that if Stripe were to offer a cheaper version of this product that does not transactions but for UGC, then Sift might have trouble retaining customers.
I’m also impressed that Stripe called this “Identity” instead of something more like “Trust and Safety.” The current name makes it sound more like Okta or something but that’s not the case. At least today. Perhaps they want this to grow to overtake stuff like Experian.
Identity is the step that comes after Sift (or Stripe Radar).
If Sift flags that a user may be suspicious, you may need to collect more information about them to confirm if they are legitimate or not. That’s where Identity comes in.
Oftentimes, this is handled manually via an ops team asking a user to reply with a photo. Instead they can collect this automatically by surfacing Stripe Identity.
I'm really surprised they don't support Polish IDs. We've had them in the same format for ages and I've done automatic verification with some other companies (e.g. Revolut).
Multiple much smaller countries' IDs are supported.
Maybe Stripe is not that much popular in Poland compared to other countries? I would not be surprised that they put priority on the countries where they already have a significant user base.
Worth noting that if you need the SSN verification for a marketplace type app for tax compliance purposes, the IRS has a free taxpayer ID validation service you can use. The SSA also has one that employers can use.
* country code search - allow to search by a full country name or by other types of code. Was searching for Ireland and "irl", "ire" does not yield any results, only a direct match to "ie" does.
* "Provide personal information" - could default to the country where the text message went or at least could have a search instead of a <select>
Not sure if it is possible but some of the orgs will ask to limit the phone numbers to just one region, e.g. only UK. I know I need to RTFM
Does anyone know if it does liveness checks for the "selfie verification"? The docs are a bit vague on that.
And do I understand "Stripe uses a combination of machine learning models, automated heuristic analysis and manual reviewers to verify the authenticity of hundreds of different document types." correctly in that I do not only upload video/images of my passport, face to stripe for automatic analysis but in some cases a human would even review it? Or is this a specific option I could choose?
I used this for an online car rental service recently. My only main complaint was that it didn't work with FF for Android. Once I switched to Chrome, everything was great, but I'm disappointed in how often sites expect to be ran in a Chromium-based browser these days.
Still appreciate seeing Stripe's name when taking a pic of my ID rather than just the rather small startup I was using. No offense to small startups, but I might've balked at it otherwise.
Looks like the page was freshly edited to remove the pricing information (?), but it's telling they're targeting a very similar price range as Veriff [0], a startup that's been working in the same space for quite a while.
This is a small localization bug that we’re fixing now (the pricing section doesn’t properly show for countries where Identity isn’t available in yet), but you can see pricing for the US at https://stripe.com/en-us/identity#pricing.
Can't tell you what a lifesaver this is and we're so excited to give it a shot. One of the challenges of adtech is there's a lot of bad actors trying to defraud ad platforms and a non insignificant amount of our time is thinking about how to minimize (can't eliminate) fraud. Having this baked into Stripe is a small miracle for us.
I'm surprised that they are not providing PAdES signatures here at the same time, do you think this is a direction they will be moving in?
Also surprised they are not leaning more heavily into the existing identity solutions in the countries they are already operating in, like the Netherlands and the Nordics. Maybe hard to differantiate from existing competitors?
Yeah, it would be easier and more private to validate your identity through an official digital signature, rather than providing biometrics (pictures).
@pc - This should be a pass-through / ephemeral type of service where a document is verified in-transit and then purged from memory. Stripe should not save any of these documents. Let Stripe customers deal with the decision whether to save in their own systems. Otherwise, this looks like yet another great value-added service -- congrats!
I'm making a dating app. After sending a potentially-fraudulent user to a Stripe VerificationSession, I would like to send Stripe their other photos and find out how well they match the ID. Does Stripe have any plan to support that?
Also, how long does the VerificationSession verified_outputs field remain accessible?
Unfortunately for this demo, they will successfully verify everyone. I was hoping for a real demo, in the past I had some interesting problems with selfie KYC checks because the photo in my passeport and my actual look are quite different …
Oh man, really excited about this. I'm curious how far Stripe wants to go down the path of KYC-related products... it feels like a huge market with a lot of pain points where having Stripe-quality APIs would be amazing.
Given their docs state that they use third-party services to offer this service, isn't Stripe just providing a wrapper API around Onfido and charging a premium? If so, how is this really a useful proposition?
Identity was built in-house over the last decade from learnings from Stripe’s experience as a payment company.
We’ve invested heavily in creating an end-to-end verification product with an ergonomic API, responsive capture experience, and advanced fraud detection and verification capabilities.
Scaling ID verification globally also means working with others—we supplement our homegrown system with a number of partners for the best experience for the user. (e.g. Analogous to Stripe credit card payments, we also work with banking institutions.)
Curiously, they support validating identities from Costa Rica but so far they don't support processing payments there. I wonder if the payments service is in-the-works for this country.
Off-topic bug report: Montoya is the last name, not the first name. (Also, in the book / movie the spelling is Inigo not Iñigo nor Íñigo, but people use all the variants)
Ooh, we could use this. Curious, can anybody point me to other similar products out there? I'd be interested in comparing. BTW, my uses case is USA only.
this seems to be the opposite of what all the regular people getting into crypto are wanting. i will only adopt systems that give me more privacy, on balance, not less. make that decision a few times, even in modern life, and your privacy increases substantially from your naive neighbors.
looks like a cool solution. having researched these tools very recently, i will say, the pricing is very high. there are other offerings on the market for $0.50 per look up and only bill you if its a positive lookup.
There's a tendency to conflate identification with endorsement. Twitter muddied the two together instead of keeping it as anti-spoofing measure. Users are trained to see HTTPS as a sign a website is legitimate or secure and not just a way to confirm the public key. Democrats want to use the unconstitutional no fly list to ban individuals from buying guns. After the Boston Marathon bomb attack some senators wanted to require KYC on all cellphones and encourage the police to not read suspects their defendant rights. The reflexive opposition to COVID-19 vaccine verification is because people don't trust the government.
Verifications typically happen in 2 minutes, oftentimes 30 seconds (for common IDs like state driver’s licenses). And we’re working on making this faster!
I wish Stripe would go public so I could invest a good chunk. Who wouldnt want to invest in the backbone (or soon to be) of the entire internet payment infrastructure.
In their TOS and Privacy Policy it’s made clear they are also data controllers. Unless you contribute to the breach it would almost certainly fall on them.
As USA is no longer Safe Harbor compliant, transferring PII outside EU's jurisdiction requires a legitimate interest. Does Stripe do the assessment on behalf of its customers, or does it rely on the customer being truthful and risk exporting data without consent?
Stripe supports the legal processing and transfer of data by our users — and EU requirements are top of mind. (Feel free to me at edwin@stripe.com if you have more questions.)
To be clear, this isn't entirely true for all situations (sorry). Stripe verifies identities as a service provider (or processor) for the business that's using Identity. Stripe may be either a controller or a processor of data depending on the purpose of data processing (https://support.stripe.com/questions/managing-your-id-verifi...).
Out of curiosity, given that this is among the most sensitive PII that can be stored, where is this data located for Stripe? I think this looks like an excellent product and can absolutely see the utility for so many businesses, but as a European I would never want such data to be stored outside of the EU. If there could be flexibility in the location the data is stored I think many European customers would appreciate that. Thanks.
It doesn't have to be this way. What Stripe (and others) are doing is a compromise, specifically compromising integrity and privacy of individuals, or as we like to call them, users.
There are ways to securely address the problems Stripe Identity is solving for that don't involve a single centralized honeypot that both collect and retain all identification documents, build profiles of individuals, and handles authentication and attestation. These should be broken up.
A company like Stripe sets and maintains norms. They have the means to work towards something better, instead of bidding up on the status quo with a blackbox moated vertical integration where market capture wins over everything else. If we don't get either industry cross-collaboration on open federated standards and networks, the only option will be strong government regulation enforcing well-intended but poorly executed alternatives.
There are a lot of existing work on more open protocols, federated standards, and whatnot. All of that is being ignored, and nothing else is proposed as an alternative.
Both companies (Stripe Identity's customer base) and individuals deserve better.
---
Anecdote:
I apologize if I am more verbose than I would have been if I hadn't just spent most of the past 5h in a Kafkaesque series of phone calls with Paypal. Replace Paypal payments with Stripe Identity in the following and tell me I'm exaggerating when I say that this is a danger to society:
I was trying to do a single webshop purchase where the vendor only had Paypal integrated as an option. Something (supposedly with my IP/browser) made them require registering an account to proceed, which required phone verification in the country of my credit card. Account immediately got flagged and completely locked before the purchase was completed, everything got changed to the language of my credit card country (which I don't speak or read) and they told me to call Paypal support in that country, on a given number. I called and despite speaking great English, they were unable to help me in English, and told me I had to call the NA support instead. The robot voice on the other end asked what I wanted and after a couple of honest attempts, I tried with "live agent". At first it seemed like there was no way to get to a real person instead of the robot. It demanded me to verify the credit card associated with the number I was calling from - a Skype number that is not on any account of mine. I persisted in saying only "live agent" as an answer whatever the question as the voice persisted in its demands for information, until after 6~8 I was actually patched through.
I was after that escalated/sent around 5 different times, each agent taking a good time to repeat the same conversation from the beginning, making me repeat each line of information they had and a fresh round of either of SMS or e-mail validation. The final agent stayed with me for the last couple of hours as we went through everything in detail. They guided me through another e-mail validation, a password change, each step involving a browser taking painfully long time due to extended reCaptchas at every step. At some point it seemed like it would just not work as there was an infinite loop of reCaptcha and login form. The agent refused to proceed as apparently this was the only way to verify my e-mail address. All this as I was actually still logged into the blocked account and clicking links in e-mails. Trying from another device and network connection, that loop finally got broken. Eventually it came to that I had the option of an "appeal process", involving me uploading a photo ID. I said I was not comfortable doing that. My only option then was to close my account. Which requires providing a photo ID. At this point I was very frustrated and told the agent that as a resident of the EU, I would like to request data deletion. After arguing a bit about that, it turned out that there was another way to close the account, but it involved another appeal process. The agent told me that should take about 3-5 business days. After the call I received an e-mail saying account closure had been initiated but will take a minimum of 180 days to complete.
As for the purchase, the same agent actually stayed with me on the line as we tried from the beginning to do a "guest checkout", which is what I had been attempting to do from the beginning. It took a bit of back and forth until the conclusion was "it usually works but computer says no and I can't tell you why".
They're not told it's there, there is no tool for them to view the data, to see what kind of data is there, or even delete data short of deleting the entire apps data. Airbnb the company can access it at approximately any time by pushing out an app update.
Legally you may have an argument, morally I don't think there's much of a difference. I would certainly not be pleased to find out an app was doing that.
A host asking you to do something is not Airbnb asking you to do something.
I know in China, the host have to submit a copy of your passport to the government for regulatory reasons. I don't like and I don't want to travel to China for similar reasons (Government is constantly spying on you). But it is not fair to say Airbnb is asking you for your ID.
Even though I have zero confidence in similar claims by big and small players, in this case I would give them the benefit of the doubt and blame your browser instead, because exposing themselves in this way would be extremely stupid.
Please don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data.
I think many developers have used Stripe for payments after dealing with legacy payment APIs like Authorize.Net and have seen how Stripe does it right and makes the process so much less painful, I'd assume their other products like this are as equally well built due to their reputation in the payments industry.
Stripe is a YC company and will always have cheerleaders on HN -- it is also arguably the most successful YC company. One of the few companies who simply wouldn't need to astro turf on HN.
I don't think it's fair to assume that this is astroturfing in any way. Stripe just has a large following of people who like anything they release. Stripe has "fans" just like Apple does.
I’ve been saying for years that identity services will be a huge deal. In a world where captcha is less and less reliable and where fake posts are cheaper, faster and more convincing (GTP), there are almost no websites that can function without using an identity service. I’ve been screaming from the rooftops and nobody listened.
That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity have API access to "captured images of the ID document, selfies, extracted data from the ID document, keyed-in information, and the verification result".
Thus, when you use Stripe Identity to verify your identity, you have to trust that:
1. The website doesn't download, retain, and later leak your selfie and identity information.
2. The website's Stripe API token isn't compromised and exploited by identity thieves to access your selfie and identity information.
Stripe appears to be leaning heavily on their claim that they don't disclose "biometric identifiers" to websites and that these "biometric identifiers" are deleted from their systems within 48 hours. This is extremely deceptive considering that biometric identifiers can be reconstructed from the selfie.