Live data from Hacker News

Stripe Identity

stripe.com

261–270 of 557 posts

Re: Stripe Identity

#261
post #201

Earlier quoted context omitted.

That's still storing the data. Nothing says that the user typically lets this sort of information stay on their phone.

Difference being you're still in full control of that data, can delete it at any time, and Airbnb the company doesn't have direct access to it.

They're not told it's there, there is no tool for them to view the data, to see what kind of data is there, or even delete data short of deleting the entire apps data. Airbnb the company can access it at approximately any time by pushing out an app update.

Legally you may have an argument, morally I don't think there's much of a difference. I would certainly not be pleased to find out an app was doing that.

Re: Stripe Identity

#262

Does Stripe intend to make a giant online database of international identity documents? Why should we trust Stripe to secure these? It could be Equifax levels of problematic if there would be a intrusion, but I also can't tell how Stripe plans to use this information.

Remember Stripes main offering - credit card data. They are already PCI compliant

Re: Stripe Identity

#263

Earlier quoted context omitted.

lol! When are we as a community going to move past treating frameworks/languages/tools as a silver bullet? Frameworks don't make teams better; good management, technical leadership, and great infrastructure does.

You are right but frameworks help with long term maintainability of code and also being able to build out features quickly which is what the comment was referring to originally. If they use Go lang of some other tech stack without framework it can help them achieve their goal but not at the same speed.

[deleted]

Re: Stripe Identity

#264

Earlier quoted context omitted.

No. 1. Stripe cares tremendously about and knows the importance of security—we’ve learned a lot from securely processing hundreds of billions of dollars in payments annually, and Identity is built from those learnings. ( https://stripe.com/docs/security/stripe ). 2. Any biometric identifiers that are created to perform the verification are never stored or retained—they are fully removed from all of our systems within…

This is only about the specific image processing Stripe does to match your selfie with your ID document. The rest of the information on the document—which is what the GP comment was asking about—is retained for 3 years. Referencing the 48 hour retention period instead of the 3 year one is very misleading in this case.

Since we are storing these IDs on behalf of businesses using Identity, we need to retain non-biometric information for a period of time to support their use cases.

For example: KYC is a core use case for identity, which requires us to retain ID information for audit purposes.

For businesses who don’t need to keep the ID for as long, we provide a deletion API that lets them automatically delete the IDs from our system.

Re: Stripe Identity

#265
It doesn't have to be this way. What Stripe (and others) are doing is a compromise, specifically compromising integrity and privacy of individuals, or as we like to call them, users.

There are ways to securely address the problems Stripe Identity is solving for that don't involve a single centralized honeypot that both collect and retain all identification documents, build profiles of individuals, and handles authentication and attestation. These should be broken up.

A company like Stripe sets and maintains norms. They have the means to work towards something better, instead of bidding up on the status quo with a blackbox moated vertical integration where market capture wins over everything else. If we don't get either industry cross-collaboration on open federated standards and networks, the only option will be strong government regulation enforcing well-intended but poorly executed alternatives.

There are a lot of existing work on more open protocols, federated standards, and whatnot. All of that is being ignored, and nothing else is proposed as an alternative.

Both companies (Stripe Identity's customer base) and individuals deserve better.

---

Anecdote:

I apologize if I am more verbose than I would have been if I hadn't just spent most of the past 5h in a Kafkaesque series of phone calls with Paypal. Replace Paypal payments with Stripe Identity in the following and tell me I'm exaggerating when I say that this is a danger to society:

I was trying to do a single webshop purchase where the vendor only had Paypal integrated as an option. Something (supposedly with my IP/browser) made them require registering an account to proceed, which required phone verification in the country of my credit card. Account immediately got flagged and completely locked before the purchase was completed, everything got changed to the language of my credit card country (which I don't speak or read) and they told me to call Paypal support in that country, on a given number. I called and despite speaking great English, they were unable to help me in English, and told me I had to call the NA support instead. The robot voice on the other end asked what I wanted and after a couple of honest attempts, I tried with "live agent". At first it seemed like there was no way to get to a real person instead of the robot. It demanded me to verify the credit card associated with the number I was calling from - a Skype number that is not on any account of mine. I persisted in saying only "live agent" as an answer whatever the question as the voice persisted in its demands for information, until after 6~8 I was actually patched through.

I was after that escalated/sent around 5 different times, each agent taking a good time to repeat the same conversation from the beginning, making me repeat each line of information they had and a fresh round of either of SMS or e-mail validation. The final agent stayed with me for the last couple of hours as we went through everything in detail. They guided me through another e-mail validation, a password change, each step involving a browser taking painfully long time due to extended reCaptchas at every step. At some point it seemed like it would just not work as there was an infinite loop of reCaptcha and login form. The agent refused to proceed as apparently this was the only way to verify my e-mail address. All this as I was actually still logged into the blocked account and clicking links in e-mails. Trying from another device and network connection, that loop finally got broken. Eventually it came to that I had the option of an "appeal process", involving me uploading a photo ID. I said I was not comfortable doing that. My only option then was to close my account. Which requires providing a photo ID. At this point I was very frustrated and told the agent that as a resident of the EU, I would like to request data deletion. After arguing a bit about that, it turned out that there was another way to close the account, but it involved another appeal process. The agent told me that should take about 3-5 business days. After the call I received an e-mail saying account closure had been initiated but will take a minimum of 180 days to complete.

As for the purchase, the same agent actually stayed with me on the line as we tried from the beginning to do a "guest checkout", which is what I had been attempting to do from the beginning. It took a bit of back and forth until the conclusion was "it usually works but computer says no and I can't tell you why".

Re: Stripe Identity

#266

Sift has a longer list of logos on their landing page, though I’d imagine even at this point that Stripe has more data. Sift got hit hard being unprepared for CCPA, I wonder what Stripe’s position would be. I’m naive but it strikes me that if Stripe were to offer a cheaper version of this product that does not transactions but for UGC, then Sift might have trouble retaining customers. I’m also impressed that Stripe c…

Identity is the step that comes after Sift (or Stripe Radar).

If Sift flags that a user may be suspicious, you may need to collect more information about them to confirm if they are legitimate or not. That’s where Identity comes in.

Oftentimes, this is handled manually via an ops team asking a user to reply with a photo. Instead they can collect this automatically by surfacing Stripe Identity.

Re: Stripe Identity

#267

Earlier quoted context omitted.

lol! When are we as a community going to move past treating frameworks/languages/tools as a silver bullet? Frameworks don't make teams better; good management, technical leadership, and great infrastructure does.

You are right but frameworks help with long term maintainability of code and also being able to build out features quickly which is what the comment was referring to originally. If they use Go lang of some other tech stack without framework it can help them achieve their goal but not at the same speed.

Stripe does not use Ruby on Rails

Re: Stripe Identity

#268
post #2

I've never seen a company release incredible products with as high velocity as Stripe has over the last few years. Truly incredible. $1.50/user may sound outrageously expensive at first, but having seen all the engineering power it takes to build something like this at Uber...it's a totally fair price.

The tech stack has something to do with it. Stripe has such high velocity because of Ruby on Rails.

I can't even find any evidence that they use Rails, and I'm pretty sure their outstanding velocity is minimally explained by their choice of tech stack.

Re: Stripe Identity

#270
There's definitely a market for this. Back when I worked in porn (in the camming sphere), we had a team of moderators whose main job was verifying the identity (especially age) of performers. With over 10k performers, this was a lot of work. And you can't just do it once. You have to do it every time a performer starts a performance. People would try all sorts of tricks, like taking a picture of themselves with an older sister's ID, all kinds of fake IDs, some better than others. Verifying an identity over webcam is no easy feat, those moderators had to be able to tell different passports apart (many, many, nationalities), tease out the fakes, and then make sure that they person in the ID is the same person presenting the ID. Problem is multiplied by the number of performers in the room. Performers who are eager to start making money instead of satisfying the moderators checklist.
Post reply on HN