Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stripe Identity

stripe.com

Post reply on HN
Print view View original

411–420 of 557 posts

Re: Stripe Identity

#411

Post by supertrope »

cardine wrote: post #352
danShumway wrote: post #324

Earlier quoted context omitted.

But at a fundamental level, why do Discord and Clubhouse need to verify my identity? I don't think the question GP is asking is whether or not Stripe is a good way to confirm someone's real-life identity, or whether it would be better for the government to do it. I think what they're asking why we're doing identity verification for chat applications. Is this a good direction overall for the Internet to be moving in?…

> But at a fundamental level, why do Discord and Clubhouse need to verify my identity? Because of credit card fraud. I've run services where >5% of attempted transactions were done using stolen credit cards. So we used services that determine the risk of a transaction being fraudulent, and if the risk was too high, we required identity verification. The alternative was to reject those transactions outright and perman…

The bank should handle KYC. Mastercard and Visa forbid requiring ID. Handing PII opens up the customer to "identity theft" fraud which is much worse than having to cancel a credit card.

Re: Stripe Identity

#412

Post by floatingatoll »

oefrha wrote: post #188
Kiro wrote: post #118

Earlier quoted context omitted.

Regular Discord users don't need to send in anything. It's used to verify your bot (only applicable for bots that are in more than 75 servers), which seems like a reasonable use case.

Does Discord only allow bot developers from Stripe Identity's supported countries to verify? Stripe is only supported in 44 countries[1], and Stripe Identity seems to support 56 (by counting options in the select dropdown in [2]), so that leaves out a lot of countries. [1] https://stripe.com/global [2] https://stripe.com/docs/acceptable-verification-documents

Presumably they have alternate verification processes for such countries as are not supported, when they deem it relevant to their business to do so; I expect it’s handled more as a case-by-case consideration and less as a well-defined policy, but you could still ask Discord Support and report what they at back to us!

Re: Stripe Identity

#413

Post by taurath »

agwa wrote: post #392
pc wrote: post #375

Earlier quoted context omitted.

(Stripe cofounder.) > Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. A few points: - Fundamentally, Identity makes it possible to choose how much of this data traverses / is stored on…

Thanks for your reply. > Fundamentally, Identity makes it possible to choose how much of this data traverses / is stored on your servers, just as Stripe did with card numbers. There's a stark difference in how Stripe treats exports of card numbers versus exports of raw identity verification data. This makes it way easier, and more likely, for Stripe customers to choose to store raw identity verification information.…

Fully agree here - I would say that I am a bit shocked at the lack of regulation regarding access to people’s identity documents as compared to credit cards. Credit/debit cards are your money, and there’s an entire network of both regulations and intermediaries working against fraud in this space.

Your identity can create new credit cards. It can take out loans. It is inherently a higher order security risk, and therefore should by default have more restrictions. I as a consumer trust Stripe to do the right thing, but I do not trust its customers. This seems to be the most reasonable stance, but yet the policy does not reflect that. I am concerned that this wedges open a really big new avenue for cybercrime without having any sort of regulations in place a-la PCI audits.

Re: Stripe Identity

#414

Post by supertrope »

Aaargh20318 wrote: post #388
pbowyer wrote: post #66

At work we do eIDV of customers and we tested 5 companies. One was quality but too expensive and required too large commitments; two couldn't detect badly photoshopped frauds we threw together, another couldn't detect a printed or on-screen copy of a document being captured (vs the real document - difficult to do, but important). The fifth which we're using can detect printed copies of documents around half the time,…

It is absolutely impossible to validate the authenticity of an ID document from a photo. Even if you capture a high-res photo and have it inspected by a trained document expert. Fortunately, it is not necessary to do this. Modern passports and many identity cards contain NFC chips that allow you validate the data on an identity document with complete certainty (as in: you know that the data is correct and not tampere…

It's a cheap way out. Anti-counterfeiting feasures like color shifting ink, paper feel, polymers, watermarks, microprinting, UV strips cannot be checked over a webcam.

Original paper documents are an anachronism. Any serious ID verification involves phoning home. Like police searching their database, border guards scanning your passport, or calling the car insurance company. Visa has depreciated offline EMV transactions. Offline credentials can't revoked so there's only the expiration date.

Re: Stripe Identity

#415

Post by ROARosen »

echopom wrote: post #382
ROARosen wrote: post #344

Earlier quoted context omitted.

> Businesses that do not have a legitimate reason to view my sensitive document like Passport , should not be allowed to do so. I get parent comment's totally legitimate security concerns. And businesses that have no business having my identity should surely not be asking for it. But I don't honestly understand how this has anything to do with Stripe. These businesses (which for whatever reason are asking for ID veri…

> Why - in your opinion - is it worse for consumers when these-type businesses (which ask for identity), use their own-rolled id verification than using Stripe's? The point isn't so much using third party , we use a third party on prem. My point is very simple : Why on earth would you let discord view my passport ? JUST WHY ?! Those documents are very sensitive and no one should have access to them unless they have a…

I totally agree. Businesses should not legally be allowed to access more information than they need. Like why do hospitals ask for my Social Security number? I know I can refuse it, but if they really don't need it shouldn't it be illegal for them to needlessly probe my identity?

And the list goes on...

Re: Stripe Identity

#416

Post by booi »

logifail wrote: post #381
tevonsb96 wrote: post #371

Earlier quoted context omitted.

I actually disagree with this as well. The Hacker News user is not the average user. The average user has no idea what Stripe is, they assume that the business requesting a verification will have access to anything they submit. I know this because we use Stripe Identity ourselves (in beta) and user's have no idea that Stripe and us are different companies.

> user's have no idea that Stripe and us are different companies. Doesn't that imply that if there's a security breach at Stripe, that your users will blame you [too]

That seems right. Businesses aren't islands, they work with other businesses to provide their services. But you as a business have an issue with a vendor/supplier, that's still on you. If McDonalds can't get fries, I don't blame farmer X for a failed harvest, I blame McDonalds for a fragile supply chain.

Re: Stripe Identity

#417

Post by edwardmp »

edwinwee wrote: post #225
edwardmp wrote: post #133

Given their docs state that they use third-party services to offer this service, isn't Stripe just providing a wrapper API around Onfido and charging a premium? If so, how is this really a useful proposition?

Identity was built in-house over the last decade from learnings from Stripe’s experience as a payment company. We’ve invested heavily in creating an end-to-end verification product with an ergonomic API, responsive capture experience, and advanced fraud detection and verification capabilities. Scaling ID verification globally also means working with others—we supplement our homegrown system with a number of partners…

Thanks for the detailed reply, Edwin!

Re: Stripe Identity

#418

Post by xyst »

Besides banks, brokerage, my accountant, or the government. Why would I give a private entity my ID to store as a ‘global’ user?

Sounds like an epic data leak that’s waiting to happen.

Re: Stripe Identity

#419

Post by Aaargh20318 »

supertrope wrote: post #414
Aaargh20318 wrote: post #388

Earlier quoted context omitted.

It is absolutely impossible to validate the authenticity of an ID document from a photo. Even if you capture a high-res photo and have it inspected by a trained document expert. Fortunately, it is not necessary to do this. Modern passports and many identity cards contain NFC chips that allow you validate the data on an identity document with complete certainty (as in: you know that the data is correct and not tampere…

It's a cheap way out. Anti-counterfeiting feasures like color shifting ink, paper feel, polymers, watermarks, microprinting, UV strips cannot be checked over a webcam. Original paper documents are an anachronism. Any serious ID verification involves phoning home. Like police searching their database, border guards scanning your passport, or calling the car insurance company. Visa has depreciated offline EMV transacti…

You don’t need to call the issuer. The NFC chip contains data signed by the issuing country. All you need is a list of trusted country CA’s.

You can check if it’s an original by performing a challenge/response protocol. You can read a public key from the signed data, the private key is not externally accessible. You ask the chip to sign some data with it’s private key and you check against the public key.

You can do all this from a mobile phone.

Re: Stripe Identity

#420

Post by judge2020 »

oefrha wrote: post #188
Kiro wrote: post #118

Earlier quoted context omitted.

Regular Discord users don't need to send in anything. It's used to verify your bot (only applicable for bots that are in more than 75 servers), which seems like a reasonable use case.

Does Discord only allow bot developers from Stripe Identity's supported countries to verify? Stripe is only supported in 44 countries[1], and Stripe Identity seems to support 56 (by counting options in the select dropdown in [2]), so that leaves out a lot of countries. [1] https://stripe.com/global [2] https://stripe.com/docs/acceptable-verification-documents

Yes, Discord only allows bot developers to become verified (which is required for bots to be in over 75 servers) if the developer is able to verify their identity via Stripe, no alternate process is provided for developers outside of the supported country list.
Post reply on HN