Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stripe Identity

stripe.com

Post reply on HN
Print view View original

361–370 of 557 posts

Re: Stripe Identity

#361

Post by agwa »

edwinwee wrote: post #340
agwa wrote: post #290

Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity…

Edwin from Stripe here. The two cases are actually very similar. If you want to avoid ID documents ever being stored on your servers, Identity makes it easy to do that. (Just as Elements/Stripe.js makes that easy for card numbers.) On the other hand, if you want to score card numbers or ID documents (and there are sometimes good reasons for doing this!), Stripe makes that straightforward.

I do agree the cases are very similar, which makes it all the more jarring how differently Stripe treats the data.

If you want to export credit card numbers from Stripe, you can only have it transferred directly to another PCI DSS Level 1-compliant payment processor, and Stripe imposes rather strict requirements on the transfer: https://stripe.com/docs/security/data-migrations/exports#whe...

If you want to export ID documents or selfies, you can just make an API call or use the web interface. This can and will be abused.

Re: Stripe Identity

#362

Post by Nextgrid »

easrng wrote: post #221
dubcanada wrote: post #178

Earlier quoted context omitted.

I am on several discords and get 4-5 messages a day from crypto pumps and other spam. This doesn't seem like it works.

Those are usually from automated user accounts, not actual bots.

But doesn't that prove the ineffectiveness of requiring KYC in this case? Bad actors will just scrape the private API, bypass the verification and do their mischief, while good users who want to create bots now have to compromise their privacy by providing identity information.

Re: Stripe Identity

#363

Post by alexchamberlain »

agwa wrote: post #290

Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity…

I suspect most (if not all) KYC regulations require you to keep the evidence you used to verify the identity - even landlords in the UK are required to keep the evidence they saw of your right to live in the UK, let alone any institution that actually needs to prevent fraud etc. I suspect it's just a basic requirement of selling such a service to most medium-large businesses.

Re: Stripe Identity

#364

Post by ibeitia »

prague60 wrote: post #345
edwinwee wrote: post #340

Earlier quoted context omitted.

Edwin from Stripe here. The two cases are actually very similar. If you want to avoid ID documents ever being stored on your servers, Identity makes it easy to do that. (Just as Elements/Stripe.js makes that easy for card numbers.) On the other hand, if you want to score card numbers or ID documents (and there are sometimes good reasons for doing this!), Stripe makes that straightforward.

Conflating credit card #'s and personal biometrics/SSNs is your first mistake. You think they are the same, they feel the same, but the risk to the customer is so much bigger. When a hotel copies my passport, they get a jpg. If they use Stripe, now I know they have my biometrics serialized to JSON. That feels way riskier and scarier to me, especially now that it's all centralized by Stripe. We hear about our personal…

I’m an engineer on the Identity team. There are two somewhat separate questions here. (1) Whether the business should ever have access to this data. And (2) how exactly the business should access that data and the security properties around it. On (1) this data is fundamentally the user’s, and there are often important compliance reasons as to why the user needs access to the raw data because of obligations that they themselves are subject to. It’s important to remember that you should trust both Stripe and the business that’s asking you to verify your identity. They are in control of explaining to you how they are using this data and giving you an option to opt out—or lose you as a customer. On (2) we’re working on a way to restrict access via secret keys very soon.

Re: Stripe Identity

#365

Post by marzell »

ROARosen wrote: post #344
echopom wrote: post #306

Earlier quoted context omitted.

It's unfortunate , I'm an Enterprise Architect in Banking and honestly I wouldn't have let that feature go in production. Businesses that do not have a legitimate reason to view my sensitive document like Passport , should not be allowed to do so. Only authorized institutions like Licensed Payment Institution / Banks / Insurances etc... should be allowed to do so and AFTER they've been approved. It's sad because you…

> Businesses that do not have a legitimate reason to view my sensitive document like Passport , should not be allowed to do so. I get parent comment's totally legitimate security concerns. And businesses that have no business having my identity should surely not be asking for it. But I don't honestly understand how this has anything to do with Stripe. These businesses (which for whatever reason are asking for ID veri…

You seem to be contradicting yourself. Businesses are asking for Stripe to verify identity. These businesses just need verification, not copies of documents, but Stripe makes them available anyway. That's the whole contention.

As a consumer, I would expect Stripe would do the verification and give the business partner the result, but not all the data they used to get the results themselves.

Re: Stripe Identity

#367

Post by TheTrotters »

jsmith99 wrote: post #284
motohagiography wrote: post #243

Smart. Banks haven't been allowed to monetize their KYC data, but this new non-bank class of payments companies have this opportunity. Interac has been trying to do this for many years. Some years ago I worked on a system let banks do identity assertions with proofs via SAML attributes instead of sharing customer PII. It is now a federation of banks in wide use for govt services in Canada. The use cases were really l…

Do banks want to monetise their KYC data? In the UK, the government launched a similar system in 2014 called Verify, a platform for banks and other firms with existing customer relationships to offer identity verification as a service to the government, and eventually, third party sites. Users would choose a participating bank they has a relationship with and login to their account as verification. But despite paying…

In Poland I can use my bank login (a “Trusted Profile”) to sign in to government websites and access my data.

E.g. when I registered for Covid vaccine I logged in using my bank login.

There are other ways to do it too but since I already had an account in a participating bank I didn’t bother looking into them.

I don’t know if banks earn anything from it. I’d be surprised if they did.

Re: Stripe Identity

#368

Post by openthc »

tomc1985 wrote: post #358
prague60 wrote: post #345

Earlier quoted context omitted.

Conflating credit card #'s and personal biometrics/SSNs is your first mistake. You think they are the same, they feel the same, but the risk to the customer is so much bigger. When a hotel copies my passport, they get a jpg. If they use Stripe, now I know they have my biometrics serialized to JSON. That feels way riskier and scarier to me, especially now that it's all centralized by Stripe. We hear about our personal…

It is trivially easy to key-in identity info from a JPG scan They are both toxic, IMO. Businesses need to stop relying on this stuff.

Right but -- the attack vector is different. Scan/parse 10000s of JPG, and all that jazz -- to get identites. Not Trivial. Or if the hotel stored the copy as a physical photo copy -- you're not bulk scanning 10k pieces of parchment at super speed for your identity-theft ring.

But download JSON blobs? From 10k records the hotel didn't store properly (cause they are not IT experts, or don't have experts at close hand) -- if you get in to their system the JSON is loads easier to parse than the JPEG.

Methods for KYC could(should!) be improved.

Re: Stripe Identity

#369

Post by wdb »

prague60 wrote: post #345
edwinwee wrote: post #340

Earlier quoted context omitted.

Edwin from Stripe here. The two cases are actually very similar. If you want to avoid ID documents ever being stored on your servers, Identity makes it easy to do that. (Just as Elements/Stripe.js makes that easy for card numbers.) On the other hand, if you want to score card numbers or ID documents (and there are sometimes good reasons for doing this!), Stripe makes that straightforward.

Conflating credit card #'s and personal biometrics/SSNs is your first mistake. You think they are the same, they feel the same, but the risk to the customer is so much bigger. When a hotel copies my passport, they get a jpg. If they use Stripe, now I know they have my biometrics serialized to JSON. That feels way riskier and scarier to me, especially now that it's all centralized by Stripe. We hear about our personal…

Hotels don't even get a full copy of passport but a redacted version of my passport. That's my government's guidance only select entities should get unredacted copies.

If not possible, I should mark the copy to the specific user.

Re: Stripe Identity

#370

Post by xur17 »

tomc1985 wrote: post #358
prague60 wrote: post #345

Earlier quoted context omitted.

Conflating credit card #'s and personal biometrics/SSNs is your first mistake. You think they are the same, they feel the same, but the risk to the customer is so much bigger. When a hotel copies my passport, they get a jpg. If they use Stripe, now I know they have my biometrics serialized to JSON. That feels way riskier and scarier to me, especially now that it's all centralized by Stripe. We hear about our personal…

It is trivially easy to key-in identity info from a JPG scan They are both toxic, IMO. Businesses need to stop relying on this stuff.

Isn't the problem that businesses are required to store this type of information (kyc verification information)? At what point are we going to have a logical system for verifying identity that doesn't require transferring the same list of data that every other 3rd party you've verified with also has?
Post reply on HN