Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stripe Identity

stripe.com

Post reply on HN
Print view View original

351–360 of 557 posts

Re: Stripe Identity

#351

Post by mLuby »

agwa wrote: post #290

Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity…

I wonder if instead Stripe could have routed calls through itself, filling in the secret info. Perhaps it was discussed?

For example, imagine Joe Biden buys a widget from WidgetsR.us and wants it shipped to his home address of 1600 Penn Ave in DC.

    WidgetsR.us -> Fedex.com/order_XYZ/ship-to/Joe Biden at 1600 Penn Ave in DC
    WidgetsR.us
Instead they could route through Stripe (where 123_joe corresponds to Joe Biden's identity docs in Stripe), which fills in the missing info.

    WidgetsR.us -> Stripe.com/identity/123_joe?redirect=Fedex.com/order_XYZ/ship-to/$NAME at $ADDRESS
    Stripe.com  -> Fedex.com/order_XYZ/ship-to/Joe Biden at 1600 Penn Ave in DC
    Stripe.com
That way WidgetsR.us never knew the $NAME or $ADDRESS of user 123_joe, but was still able to use them. (Yes, they could send that info to themselves, but then they're on the hook for protecting it.) The huge downside here is putting Stripe in your business's critical path. But if it's already there for payments, then why not for identity?

Re: Stripe Identity

#352

Post by cardine »

danShumway wrote: post #324
lotsofpulp wrote: post #285

Earlier quoted context omitted.

The fix is for the government to make it a service. Right now, the government is punting responsibility to private actors who do not have the legal tools to operate an identity service. The government already operates an identity service via passports. The only reason they do not have an electronic identity service yet is because it is beneficial for them to be able to blame private actors when things go wrong.

But at a fundamental level, why do Discord and Clubhouse need to verify my identity? I don't think the question GP is asking is whether or not Stripe is a good way to confirm someone's real-life identity, or whether it would be better for the government to do it. I think what they're asking why we're doing identity verification for chat applications. Is this a good direction overall for the Internet to be moving in?…

> But at a fundamental level, why do Discord and Clubhouse need to verify my identity?

Because of credit card fraud. I've run services where >5% of attempted transactions were done using stolen credit cards. So we used services that determine the risk of a transaction being fraudulent, and if the risk was too high, we required identity verification.

The alternative was to reject those transactions outright and permanently lose those customers, which is terrible when there is a false positive.

If credit card fraud is high, it doesn't matter whether you are a chat app or a bank app.

Re: Stripe Identity

#353

Post by Dowwie »

@pc - This should be a pass-through / ephemeral type of service where a document is verified in-transit and then purged from memory. Stripe should not save any of these documents. Let Stripe customers deal with the decision whether to save in their own systems. Otherwise, this looks like yet another great value-added service -- congrats!

Re: Stripe Identity

#354

Post by ZainRiz »

danShumway wrote: post #324
lotsofpulp wrote: post #285

Earlier quoted context omitted.

The fix is for the government to make it a service. Right now, the government is punting responsibility to private actors who do not have the legal tools to operate an identity service. The government already operates an identity service via passports. The only reason they do not have an electronic identity service yet is because it is beneficial for them to be able to blame private actors when things go wrong.

But at a fundamental level, why do Discord and Clubhouse need to verify my identity? I don't think the question GP is asking is whether or not Stripe is a good way to confirm someone's real-life identity, or whether it would be better for the government to do it. I think what they're asking why we're doing identity verification for chat applications. Is this a good direction overall for the Internet to be moving in?…

I suspect that those places need to verify your identity if they want to pay you money (e.g. you're accepting tips on clubhouse).

There are a ton of legal requirements around you having to verify a person's identify before sending them money. These laws are often put in place to avoid money laundering, etc.

I doubt they'd require every single user to go through the friction of verifying their identity.

Re: Stripe Identity

#355

Post by varispeed »

spoonjim wrote: post #214
varispeed wrote: post #203

Earlier quoted context omitted.

Sadly out of reach for small projects. For example if you had a site with 100k users, you'd barely cover server costs with Ad Sense. $150k to check all of them? Would never happen :/ Maybe if they could pay for verification themselves?

You don’t need to verify a user’s real identity to serve them AdSense.

They can post AdSense violating image and report the URL to get the page demonetised. Users of similar project done that many times.

Re: Stripe Identity

#356

Post by throwaway201606 »

motohagiography wrote: post #243

Smart. Banks haven't been allowed to monetize their KYC data, but this new non-bank class of payments companies have this opportunity. Interac has been trying to do this for many years. Some years ago I worked on a system let banks do identity assertions with proofs via SAML attributes instead of sharing customer PII. It is now a federation of banks in wide use for govt services in Canada. The use cases were really l…

Actually, it seems that this did go into production - you can now verify identity using the service. For example, you can identify yourself for Govt. of Canada services (immigration, taxes) by logging into to your banking platform that then vouches for your identity using a service called SecureKeyConcierge / Verified.Me - note that ALL of Canada's major and quite a few minor banks are signed up to the service.

See this page:

https://services.securekeyconcierge.com/cbs/saml/login?l=1&l...

The way the service works by getting permission from you, the user, to share some part of your identity with the destination and you can chose what you share. You could pick for example just to share name and not DoB.

The one reason I hate this otherwise superbly designed service and refused to use it is that is has a dark pattern where it creates a "SecureKey / Verified.Me Concierge Account" for "you" when you use it and starts proxying/pre-emptying the bank-login-as-verification process.

WHICH IS STUPID AND SCAMMY IF YOU ARE READING THIS VERIFIED.ME, THIS IS DARK PATTERN BEHAVIOR AND IT IS NOT RIGHT OR FAIR

/start rant

From my perspective, the whole point is - inhale - "I sorta trust my bank because I have to so I will log on to them so that they can vouch for me but I definitely don't trust you so why are you being a dick and making me make an account with your service that I don't trust and will never trust" - exhale

Just let the bank vouch for me each time, this is what I expect a reasonable and non-scammy service provider to do. Don't wait till you have my info then tell me, hey, I will make an verified.met / secureconcierge account for you so that before you do what you promised to do.

I get the idea that they want to consolidate a profile so that you can pick what to share without entering it each time but they way it is done right now feels really slimy.

/end rant

Re: Stripe Identity

#357

Post by danShumway »

cardine wrote: post #352
danShumway wrote: post #324

Earlier quoted context omitted.

But at a fundamental level, why do Discord and Clubhouse need to verify my identity? I don't think the question GP is asking is whether or not Stripe is a good way to confirm someone's real-life identity, or whether it would be better for the government to do it. I think what they're asking why we're doing identity verification for chat applications. Is this a good direction overall for the Internet to be moving in?…

> But at a fundamental level, why do Discord and Clubhouse need to verify my identity? Because of credit card fraud. I've run services where >5% of attempted transactions were done using stolen credit cards. So we used services that determine the risk of a transaction being fraudulent, and if the risk was too high, we required identity verification. The alternative was to reject those transactions outright and perman…

It sounds like you're asking for a payment verification system, not an identity verification system.

Does Discord need to know my identity, or does it need to know that my card hasn't been stolen? If it's the latter, then I'm unsure why Stripe is offering the business access to my passport/license, and I'm unsure why we would want to build a government ID system for Discord instead of a government payment system.

Re: Stripe Identity

#358

Post by tomc1985 »

prague60 wrote: post #345
edwinwee wrote: post #340

Earlier quoted context omitted.

Edwin from Stripe here. The two cases are actually very similar. If you want to avoid ID documents ever being stored on your servers, Identity makes it easy to do that. (Just as Elements/Stripe.js makes that easy for card numbers.) On the other hand, if you want to score card numbers or ID documents (and there are sometimes good reasons for doing this!), Stripe makes that straightforward.

Conflating credit card #'s and personal biometrics/SSNs is your first mistake. You think they are the same, they feel the same, but the risk to the customer is so much bigger. When a hotel copies my passport, they get a jpg. If they use Stripe, now I know they have my biometrics serialized to JSON. That feels way riskier and scarier to me, especially now that it's all centralized by Stripe. We hear about our personal…

It is trivially easy to key-in identity info from a JPG scan

They are both toxic, IMO. Businesses need to stop relying on this stuff.

Re: Stripe Identity

#359

Post by Nextgrid »

cardine wrote: post #352
danShumway wrote: post #324

Earlier quoted context omitted.

But at a fundamental level, why do Discord and Clubhouse need to verify my identity? I don't think the question GP is asking is whether or not Stripe is a good way to confirm someone's real-life identity, or whether it would be better for the government to do it. I think what they're asking why we're doing identity verification for chat applications. Is this a good direction overall for the Internet to be moving in?…

> But at a fundamental level, why do Discord and Clubhouse need to verify my identity? Because of credit card fraud. I've run services where >5% of attempted transactions were done using stolen credit cards. So we used services that determine the risk of a transaction being fraudulent, and if the risk was too high, we required identity verification. The alternative was to reject those transactions outright and perman…

Credit card fraud can be solved by other means though. 3D-Secure for example will offload the liability to the bank.

The proper way to do it is to either enforce 3D-Secure or offer passport as an option when 3DS is unavailable, but because ID verification is getting easier and cheaper with services such as this one, there will be no reason to spend extra engineering time to implement solutions such as this one when you can just ask for everyone's passports especially when this also allows you to use the data for marketing purposes or be able to reliably ban "undesirable" people (and "undesirable" in this case doesn't mean "bad" or "illegal", it could simply be someone who uses an ad-blocker or doesn't "engage" with dark patterns like the company wants them to).

Re: Stripe Identity

#360

Post by Nextgrid »

lotsofpulp wrote: post #330
danShumway wrote: post #329

Earlier quoted context omitted.

"We" in this context means the overall population of users on the web, including non-corporate users and individuals who are exercising their freedoms online. We can't justify every architecture decision about the web via only business costs, if that was the case we'd make adblockers illegal and deprecate HTML. You need a stronger argument if you want me as a user to care about or support your business interests. If…

Is this a discussion about the architecture of the web? Or about specific websites? If Costco wants me to login to their website to buy things, or Facebook wants me to use real identity, that does not stop me from using alternatives that do not. Am I entitled to alternatives that do not verify identity? Maybe the operating costs are too high?

> Facebook wants me to use real identity

We're already living in a world where you have to "login with Facebook" to do many things, but at the very least you can currently still create a fake account if you have no other option. If reliable identity verification starts becoming commonplace, that option goes away.

Post reply on HN