Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stripe Identity

stripe.com

Post reply on HN
Print view View original

301–310 of 557 posts

Re: Stripe Identity

#301

Post by nrmitchi »

agwa wrote: post #290

Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity…

> Considering that Stripe's original selling point was that it let websites accept credit card payments without seeing your credit card number

This is true, but it's also kind of a misleading statement; the original selling point was that you could accept credit cards without having to deal with the requirements of PCI compliance and merchant accounts, which is done (partially) by you not ever seeing the card data.

If there was similar compliance regulation around document storage, I would assume that Stripe would use "Identity-Document-Standards" compliancy as a selling point. As far as I know, there are no such requirements.

I do think your #2 point though is exceptionally valid, and would hope that the majority of Stripe keys are scoped to not even provide access to this data/endpoints.

Edit: grammar

Re: Stripe Identity

#302

Post by agwa »

poorman wrote: post #299
agwa wrote: post #290

Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity…

>Considering that Stripe's original selling point was that it let websites accept credit card payments without seeing your credit card number I thought that Stripe's original selling point was that you could easily accept payments online without having to integrate with complicated bank and payment processor tech.

As I understood it at the time, alternatives required PCI compliance, which Stripe allowed you to sidestep thanks to tokenization, so I do believe that was a selling point. But this is besides the point I'm making, so I've edited my comment.

Re: Stripe Identity

#303

Post by cam-perry »

elric wrote: post #270

There's definitely a market for this. Back when I worked in porn (in the camming sphere), we had a team of moderators whose main job was verifying the identity (especially age) of performers. With over 10k performers, this was a lot of work. And you can't just do it once. You have to do it every time a performer starts a performance. People would try all sorts of tricks, like taking a picture of themselves with an ol…

Agreed, there is a big market here. I worked on a real estate rental platform where we required ID verification for all listings and applications. At the time we used Berbix (YC company), which is practically the same as Stripe Identity. I would probably just use this Stripe feature today, since we were already using Connect for payments.

Re: Stripe Identity

#304

Post by jsonne »

Can't tell you what a lifesaver this is and we're so excited to give it a shot. One of the challenges of adtech is there's a lot of bad actors trying to defraud ad platforms and a non insignificant amount of our time is thinking about how to minimize (can't eliminate) fraud. Having this baked into Stripe is a small miracle for us.

Re: Stripe Identity

#305

Post by manigandham »

jlhonora wrote: post #281
Sr_developer wrote: post #208

Earlier quoted context omitted.

Are you going to pay me? If not, good luck!

Probably not the answer you expect, but the I18N team is hiring :) https://stripe.com/jobs/listing/internationalization-enginee... Otherwise, if you're a trained linguist and have demonstrable consulting experience QA'ing technical documentation then we'll be happy to arrange something. In either case, we appreciate your feedback, and my emails are open!

Not only unexpected but that's about the best reply possible. Nicely done.

Re: Stripe Identity

#306

Post by echopom »

agwa wrote: post #290

Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity…

It's unfortunate , I'm an Enterprise Architect in Banking and honestly I wouldn't have let that feature go in production.

Businesses that do not have a legitimate reason to view my sensitive document like Passport , should not be allowed to do so.

Only authorized institutions like Licensed Payment Institution / Banks / Insurances etc... should be allowed to do so and AFTER they've been approved.

It's sad because you can tell right away that this will we be abused by Stripe's customers inadvertently. Just like Uber "God View" thats you view any customer ride...

Pretty sure the amount of "Identity Theft" or "Privacy" Scandal is going to explode with such technology available for everyone.

I don't know how a product manager at stripe could tell himself that "Yes , it make sense to give access to sensitive documents" in an age where people are seeking more privacy.

Re: Stripe Identity

#307

Post by theptip »

f38zf5vdt wrote: post #84
edwinwee wrote: post #74

Earlier quoted context omitted.

No. 1. Stripe cares tremendously about and knows the importance of security—we’ve learned a lot from securely processing hundreds of billions of dollars in payments annually, and Identity is built from those learnings. ( https://stripe.com/docs/security/stripe ). 2. Any biometric identifiers that are created to perform the verification are never stored or retained—they are fully removed from all of our systems within…

> We will typically store the rest of your submitted identity information for 3 years. This includes all images captured, extracted data from your ID document including name, date of birth, and ID number, and any information submitted via forms such as name, date of birth, SSN, email, and phone number, and the verification response. That doesn't make me feel a lot better. :( The images are enough to generate biometri…

Any Money Services Business / payments processor needs to adhere to strict government regulations. In the US this would be (among other things) the Banking Secrecy Act: https://www.occ.treas.gov/topics/supervision-and-examination....

It's simply not legal to "not keep records" if you are running payments.

If you ran a payment to "O Bin Laden" but you have a driver's license picture showing that it is Oscar Bin Laden, from CA, DoB 2001, you'd better keep all that information for your records in case you get audited for potential OFAC violations.

Re: Stripe Identity

#308

Post by OJFord »

echopom wrote: post #306
agwa wrote: post #290

Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity…

It's unfortunate , I'm an Enterprise Architect in Banking and honestly I wouldn't have let that feature go in production. Businesses that do not have a legitimate reason to view my sensitive document like Passport , should not be allowed to do so. Only authorized institutions like Licensed Payment Institution / Banks / Insurances etc... should be allowed to do so and AFTER they've been approved. It's sad because you…

But, also as an Enterprise Architect in Banking, if you were considering Stripe Identity wouldn't you rely on it for KYC compliance? You can't just say Oh we outsource that to a third-party called Stripe, can you?

Re: Stripe Identity

#309

Post by nightpool »

gruez wrote: post #99

The landing page contains logos for clubhouse, discord, and shippo, which are presumably companies use the service. Does anyone find those usages to be unnecessarily intrusive? Maybe it's just me, but a chat app or shipping site asking me for a drivers license scan + selfie would make me never want to use the service again. It's appalling how this sort of stuff is getting normalized, eg. google asking for id scans fo…

Discord only uses identity verification for a small subset of developer accounts—when your bot application fetches the full member list or timestamped "online/away" data, AND is in more than 100 servers. Normal Discord users (and most bot developers!) don't interact with the identity verification process.

Re: Stripe Identity

#310

Post by rStar »

this seems to be the opposite of what all the regular people getting into crypto are wanting. i will only adopt systems that give me more privacy, on balance, not less. make that decision a few times, even in modern life, and your privacy increases substantially from your naive neighbors.
Post reply on HN