Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stripe Identity

stripe.com

Post reply on HN
Print view View original

451–460 of 557 posts

Re: Stripe Identity

#451

Post by hn_throwaway_99 »

pc wrote: post #375
agwa wrote: post #290

Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity…

(Stripe cofounder.) > Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. A few points: - Fundamentally, Identity makes it possible to choose how much of this data traverses / is stored on…

Very glad to see that 4th bullet point there. I really like the option of, as a business, being able to say "No, I want to know whether the ID matches their Name/Address, but I don't want to be able to access the image data".

Re: Stripe Identity

#452

Post by SLWW »

It really makes you wonder what kind of optics they are looking through when coming up with these things. Literally no one (at least not the majority of individuals) wants this.

It's one of those things that you expect a more shady company to release. Then again (and it's all hearsay mind you) that they are not a good company to work with, and when talking to employees who left, they don't seem like a good company to work for.

Stick to CCs, that's intrusive enough.

Re: Stripe Identity

#453

Post by plumeria »

ullevaal wrote: post #165

I'm surprised that they are not providing PAdES signatures here at the same time, do you think this is a direction they will be moving in? Also surprised they are not leaning more heavily into the existing identity solutions in the countries they are already operating in, like the Netherlands and the Nordics. Maybe hard to differantiate from existing competitors?

Yeah, it would be easier and more private to validate your identity through an official digital signature, rather than providing biometrics (pictures).

Re: Stripe Identity

#454

Post by mikeiz404 »

foota wrote: post #444
mikeiz404 wrote: post #440

This seems like a really useful service but I am concerned this is going to normalize requiring identity info for sites which do not legally need it. I imagine the pretext for most will be fraud prevention, and while this might be true, I cannot see how this wouldn’t eventually be used for ad targeting and other “consumer is the product” funding models without regulation restricting it.

Is knowing who the customer is with more certainty really useful though for targeting beyond just having their info they provide on sign up?

Depends on the degree of certainty I suppose. If it's close to 1 then probably not much though it does potentially provide more data to cross reference against when linking activity across services.

Techniques such as using different email addresses and other first party data would no longer be effective for limiting cross linking of user data (fingerprinting is an issue as well) if a legal ID is required and that data is shared with the service.

I’m on the fence about a service only using ID verification even from a fully trustworthy third party and not gaining any additional info (save for maybe a random unlinkable ID to prevent multiple accounts or perhaps just a flag indicating whether the ID is eligible for an account on that service). Even that bothers me. I would have to think about it some more. But I kind of do get it and see how that could enable better online communities. I’d like to think there is a better way though.

Re: Stripe Identity

#455

Post by hn_throwaway_99 »

tomjen3 wrote: post #206
hn_throwaway_99 wrote: post #10

The Stripe Identity product is fantastic. Some of the most impressive things: 1. If you are at a desktop, there is an easy transition to using your phone to take a picture of your ID (or a selfie if that's the use case - it will match selfies with ID photos), and then complete verification on the desktop. 2. It does all the image analysis (i.e. is the ID in focus, etc.) in browser without the need for a native app.

Just be aware that, no matter how seamless it is, you still getting crazy bounce rates for it. You would need a really good reason to use it (basically, be a bank and need KYC or something).

Of course, a common use case for this would be to only show the Stripe Identity UI when a user has a higher chance (based on IP, time of day, other on-site behavior, etc.) of being fraudulent in the first place, in which case a higher bounce rate is a feature, not a bug.

Re: Stripe Identity

#456

Post by lotsofpulp »

duped wrote: post #441
lotsofpulp wrote: post #285

Earlier quoted context omitted.

The fix is for the government to make it a service. Right now, the government is punting responsibility to private actors who do not have the legal tools to operate an identity service. The government already operates an identity service via passports. The only reason they do not have an electronic identity service yet is because it is beneficial for them to be able to blame private actors when things go wrong.

This isn't a problem to fix. Internet businesses don't have an absolute right to your identity. The government (in the US at least) does offer some form of identity services like everify for employment.

They do not have a right to your identity. But I do not see why people have an absolute right to use a business without providing identity either. If both parties agree, then they can exchange info.

The government is using 2FA SMS as your identity (for government services themselves), effectively offloading their liability into the mobile operators. But not really, because the mobile operators are not liable either. So as a little person, you are screwed all around.

If the government were to make an electronic identity, which it needs to for its own services, it might as well be accessible for all so you do not have to trust private businesses with it.

Re: Stripe Identity

#457

Post by wolverine876 »

michaelt wrote: post #273
edwinwee wrote: post #150

Earlier quoted context omitted.

We are very specific about collecting consent before doing anything with your data. We ask for permissions before beginning the verification process, and if you consent, we will only use your biometric identifiers for the verification itself. (And again, those identifiers—which contain the most sensitive info—aren't stored.) Specifically, we ask for an additional level of permissions before conducting any additional…

> We are very specific about collecting consent before doing anything with your data. How do you foresee that consent working if your product is used in account recovery flows? For example, imagine if Steam adopted Stripe Identity as their only way to allow people with $$$$ worth of games to recover hacked accounts. If the user's only choice is to "consent" or lose their valuable account, that makes the "consent" som…

I have an account with a lot of content in it on an online service. When I signed up, they didn't require any personal information. Now they want some significant info or I can't get back into my account.

Re: Stripe Identity

#458

Post by wolverine876 »

objclxt wrote: post #317
rejectedandsad wrote: post #106

Earlier quoted context omitted.

Stripe hires elite Stanford grads unlike Equifax is the simplest answer they probably wouldn’t say publicly. But the pedigree and engineering talent is miles better.

There isn’t a correlation between graduating from Stanford and being able to write secure code. If there was, all black-hats would be coming from Ivy League schools. They’re not.

> There isn’t a correlation between graduating from Stanford and being able to write secure code.

Nor is there a correlation between Stanford degrees and wanting to write secure code.

Re: Stripe Identity

#459

Post by wolverine876 »

hn_throwaway_99 wrote: post #10

The Stripe Identity product is fantastic. Some of the most impressive things: 1. If you are at a desktop, there is an easy transition to using your phone to take a picture of your ID (or a selfie if that's the use case - it will match selfies with ID photos), and then complete verification on the desktop. 2. It does all the image analysis (i.e. is the ID in focus, etc.) in browser without the need for a native app.

> If you are at a desktop, there is an easy transition to using your phone to take a picture of your ID (or a selfie if that's the use case - it will match selfies with ID photos), and then complete verification on the desktop.

Meaning they can identify my laptop and phone as belonging to the same person. I prefer they don't.

Re: Stripe Identity

#460

Post by jiux »

pc wrote: post #375
agwa wrote: post #290

Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity…

(Stripe cofounder.) > Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. A few points: - Fundamentally, Identity makes it possible to choose how much of this data traverses / is stored on…

Any plans to add developing countries, in particular the Philippines?
Post reply on HN