Live data from Hacker News

Stripe Identity

stripe.com

331–340 of 557 posts

Re: Stripe Identity

#331
post #88

Isn't this a privacy nightmare? All that data in Stripe data centers.

I think Stripe's opinion is that their current business is already a privacy nightmare (being a payments processor) and that they've learned a bit about it through the years so they feel they have the experience to do this right. I'm neither here nor there on Stripe as a company, but having worked with PCI and PII for many years, I'd trust a company more who had been through this process before.

Re: Stripe Identity

#332
post #308

Earlier quoted context omitted.

But, also as an Enterprise Architect in Banking, if you were considering Stripe Identity wouldn't you rely on it for KYC compliance? You can't just say Oh we outsource that to a third-party called Stripe, can you?

That's not my point , here my point is very clear and straightforward. Some people at Discord now have access at the pictures of my Passport that I uploaded during the verification process because they use "Stripe Identity". The FAQ is very clear , Stripe give you full access to those documents. It should NEVER do so. Now the very smart people have Discord have access to my passport they can now take a 50K Loan using…

I know it's not your point, but it's mine.

Why would you upload a copy of your passport to Discord, via a third-party or not? The issue here is just trusting people you shouldn't be trusting with things you shouldn't be trusting them with.

The alternative isn't WhizzBangApp doesn't request you upload documents, the alternative is they roll their own WhizBang ID service, or use a Stripe Identity competitor.

I know my bank needs to verify my driving licence or whatever, and I tr.. well banks are heavily regulated anyway, so I'm happy to upload it without caring whether they use Stripe Identity or their own or whatever.

I know Discord has no business with my passport or whatever, so they're not getting it whatever they use under the hood.

Re: Stripe Identity

#333

Earlier quoted context omitted.

I honestly find it weird having all of these things suddenly want a copy of my passport in the cloud just sitting there waiting to be hacked in years to come when the security measures drop. At this point there is giant databases containing everything people need to take complete control of your identity sitting there just waiting to be hacked. I have no idea how to change it/fix it. But it seems weird to me.

The fix is for the government to make it a service. Right now, the government is punting responsibility to private actors who do not have the legal tools to operate an identity service. The government already operates an identity service via passports. The only reason they do not have an electronic identity service yet is because it is beneficial for them to be able to blame private actors when things go wrong.

This is coming, it’s just taking Government Time (Login.gov, USPS for in person proofing, etc).

Re: Stripe Identity

#335

Earlier quoted context omitted.

"We" in this context means the overall population of users on the web, including non-corporate users and individuals who are exercising their freedoms online. We can't justify every architecture decision about the web via only business costs, if that was the case we'd make adblockers illegal and deprecate HTML. You need a stronger argument if you want me as a user to care about or support your business interests. If…

Is this a discussion about the architecture of the web? Or about specific websites? If Costco wants me to login to their website to buy things, or Facebook wants me to use real identity, that does not stop me from using alternatives that do not. Am I entitled to alternatives that do not verify identity? Maybe the operating costs are too high?

Your proposal is for a government-run identity verification system.

The "we" in this context (ordinary users) also comprise the majority of voters and regulators who will ultimately decide how the system you propose is built and what restrictions it will have; and that is a group that is not solely motivated by your business interests -- so it is kind of important for you to be able to convince them that your system benefits them, and not just a few businesses.

Why should a Congressperson vote to build the system you propose instead of introducing a harsh privacy law that restricts which businesses are allowed to collect identification?

Re: Stripe Identity

#336
post #320

Earlier quoted context omitted.

Edit: Totally wrong You need to buy from apple/google if you want battery efficiency, as you want to be included in the one persistent channel the OS manages. Even without that your own servers cost money.

Apple's and Google's services are free, as far as I know; it's only if you want to send through some third-party provider that you pay per message.

Thanks for the correction

Re: Stripe Identity

#337

Earlier quoted context omitted.

Probably not the answer you expect, but the I18N team is hiring :) https://stripe.com/jobs/listing/internationalization-enginee... Otherwise, if you're a trained linguist and have demonstrable consulting experience QA'ing technical documentation then we'll be happy to arrange something. In either case, we appreciate your feedback, and my emails are open!

No trabajo de gratis para multinacionales cuiquito. Tu credencialismo barato y sobrador lo puedes archivar donde mas te convenga.No se si es la respuesta que estabas esperando.

Google translate says: "I don't work for free for small multinationals. Your cheap and spare credentials can be filed wherever it suits you. I don't know if this is the answer you were waiting for."

Re: Stripe Identity

#338

Earlier quoted context omitted.

Probably not the answer you expect, but the I18N team is hiring :) https://stripe.com/jobs/listing/internationalization-enginee... Otherwise, if you're a trained linguist and have demonstrable consulting experience QA'ing technical documentation then we'll be happy to arrange something. In either case, we appreciate your feedback, and my emails are open!

No trabajo de gratis para multinacionales cuiquito. Tu credencialismo barato y sobrador lo puedes archivar donde mas te convenga.No se si es la respuesta que estabas esperando.

Not sure what makes you evoke such a strong reply. If it's something I said, then I apologize.

Re: Stripe Identity

#339

Earlier quoted context omitted.

I honestly find it weird having all of these things suddenly want a copy of my passport in the cloud just sitting there waiting to be hacked in years to come when the security measures drop. At this point there is giant databases containing everything people need to take complete control of your identity sitting there just waiting to be hacked. I have no idea how to change it/fix it. But it seems weird to me.

You've nailed the complexity of this. On privacy, people are rightfully spooked about this for all the reasons you've mentioned. On safety, people are really happy about these initiatives as accounts backed by user identity are less likely to be used for harm. On security, leaks of these databases create issues to other sites and companies (eg: if Company X is compromised, then identity documents could be used to dis…

> people are really happy about these initiatives as accounts backed by user identity are less likely to be used for harm

Has anyone told you they are really happy about it? I haven't heard someone say that. Most users have no idea about it.

Re: Stripe Identity

#340
post #290

Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity…

Edwin from Stripe here. The two cases are actually very similar. If you want to avoid ID documents ever being stored on your servers, Identity makes it easy to do that. (Just as Elements/Stripe.js makes that easy for card numbers.) On the other hand, if you want to score card numbers or ID documents (and there are sometimes good reasons for doing this!), Stripe makes that straightforward.
Post reply on HN