Stripe Identity

Is it?

I am much less charitable than you about whether Discord's bot verification is intended purely for user safety or whether it's a combination of laziness and a way of slowly clamping down control over how users access the service, how it can be extended, and what services/clients can interop.

I disagree that 100 servers is a particularly large number for a popular bot to join, but more importantly I think the threat model you describe illustrates a deeper problem with Discord overall. If the issue is that bots can sign up to Discord and just start talking to people, that's a permissions issue. Why can bots do that? And why is it OK for bots to keep doing that as long as they're in fewer than 100 servers?

So sure, we can have an extremely invasive form of verification, but we could also just... not let bots join random servers in the first place. We're jumping straight to real-life identification in a system that doesn't even support granular control over invites. In my opinion Discord's moderation and user-vetting tools are basically non-existent, so I am at least a little bit skeptical about whether verification is a completely necessary tradeoff between security and privacy.

The linked comment is incorrect to say that Discord only requires verification for specific permissions, Discord requires verification for bots who are in more than 100 servers regardless of what permissions they use. I think it's fairly obvious that verification for Discord bots is going to gradually expand and encompass more of the service, but maybe I'm just cynical from watching other companies do the same thing with their identity verification schemes.

More importantly, I disagree that identity verification is the best way for Discord to combat abuse. I think that Discord's moderation tools and server settings are lackluster. At best, I think identity verification is a an easy way for them to avoid improving those tools, at the cost of user privacy.

I don't think your comment changes anything about what I'm saying in regards to Discord, but regardless, I also want to point out that it's not just Discord we're talking about: we are seeing a trend towards more services online requiring real-world identities. So we can fight over whether Discord in specific should be grouped in with that trend (I think it should be), but even if you disagree on that point, it still seems pretty clear to me how Stripe's service is going to be used in the future. Do you feel identity verification is also a non-issue for services like Clubhouse and Facebook?

I think the fact that Stripe is advertising both Discord and Clubhouse as early partners says a lot about the types of services they think are going to be attracted to their product.

> They may need or wish to perform additional checks on their side. Etc.

So they get all the data in the off chance that a Stripe customer might want to do something with the data aside from the basic “yeah our large global identity verification service says this person is legit.”

I’m not super clear what a company might ”wish to” do with that data that isn’t served by the basic “this person is who they say they are” function (Does Stripe need their clients to act as guinea pigs to see if the service actually works as intended? If their mysterious black box “wishes” turn up a case where this isn’t working as intended, are your customers required to share that data with you to ensure the overall reliability of the Stripe Identity service? Or do they just get to build a database of info they get from Stripe Identity?)

> While many of the businesses initially building on Identity wanted access to the raw information, it may well make sense for us to enable them to restrict themselves in the future.

Oh nevermind, asked and answered! Just turn on the data hose to whoever has a website and will pay Stripe for identity data and maybe adjust it later if you catch some flack for this practice?

It’s kinda hilarious that the whole “people trust Stripe with their data” as part of the sales pitch as if this didn’t come across to me (a layperson) as a direct violation of that particular trust.