by thomaspark on 6/14/21, 2:32 PM with 536 comments
by agwa on 6/14/21, 5:39 PM
That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity have API access to "captured images of the ID document, selfies, extracted data from the ID document, keyed-in information, and the verification result".
Thus, when you use Stripe Identity to verify your identity, you have to trust that:
1. The website doesn't download, retain, and later leak your selfie and identity information.
2. The website's Stripe API token isn't compromised and exploited by identity thieves to access your selfie and identity information.
Stripe appears to be leaning heavily on their claim that they don't disclose "biometric identifiers" to websites and that these "biometric identifiers" are deleted from their systems within 48 hours. This is extremely deceptive considering that biometric identifiers can be reconstructed from the selfie.
by gruez on 6/14/21, 3:36 PM
by motohagiography on 6/14/21, 4:57 PM
Some years ago I worked on a system let banks do identity assertions with proofs via SAML attributes instead of sharing customer PII. It is now a federation of banks in wide use for govt services in Canada. The use cases were really limited because the federation partners were too conservative to extend the identity services to relying party consumer applications real people actually wanted to use, and institutional sales cycles meant product feedback was glacial, so it has existed for over a decade in this relative backwater of gov-tech. I think identity companies have mostly failed to get traction because of a terminal lack of consumer sexiness, whereas Stripe has the jelly.
Other companies in the identity space have been working on protocols and platforms, but none of them had a user base to extend an identity federation services into, which means they have never been able to make a real or viable product, just interesting techs. An internet payment provider with young consumer traction getting into identity is a Very Big Deal.
It's going to position Stripe to knock out a lot of retail banks who can't offer similar services. Imo, this could make them bigger than Apple.
by elric on 6/14/21, 5:17 PM
by f38zf5vdt on 6/14/21, 3:04 PM
by tracedddd on 6/14/21, 3:27 PM
by pbowyer on 6/14/21, 3:23 PM
We'll try Stripe and see how much fraud they can detect.
by hn_throwaway_99 on 6/14/21, 2:47 PM
1. If you are at a desktop, there is an easy transition to using your phone to take a picture of your ID (or a selfie if that's the use case - it will match selfies with ID photos), and then complete verification on the desktop.
2. It does all the image analysis (i.e. is the ID in focus, etc.) in browser without the need for a native app.
by mikeiz404 on 6/14/21, 10:03 PM
by gima on 6/14/21, 4:41 PM
by troelsSteegin on 6/14/21, 3:19 PM
If my Stripe Identity can be used across vendors, it's almost like a digital passport. I'll ask, in jest, are Stripe and Estonia (https://e-resident.gov.ee/) in competition?
by superasn on 6/14/21, 4:30 PM
It wanted to scan the back of my dl but Indian dls are totally blank at the back. Then it said my webcam wasn't good enough and showed me a QR code to use for my mobile. The link never opened. Tried it 3 times and 5 minutes later I just googled the next alternative site and bought it from there.
Lesson being use this only if it is totally necessary. You may lose paying customers in your overzealousness to be super tech savvy to KISS sites using a Paypal button.
by searchableguy on 6/14/21, 2:50 PM
Edit: This seems to be an internationalization problem. I am from India. The pricing section for Indian page https://stripe.com/en-in/identity#pricing is missing so the link doesn't work.
by ngoel36 on 6/14/21, 2:42 PM
by ianhawes on 6/14/21, 3:01 PM
I did a deep-dive on KYC providers last year. The more well-known folks commanded 5 figure setup fees, wanted 1 to 2 year commitments, and sought to have you pre-pay for verifications. It reminded me of internet credit card processing pre-Stripe.
by willeh on 6/14/21, 2:46 PM
by throwaway9398 on 6/14/21, 3:16 PM
Stripe is not for those seeking to run truly international businesses. We've been patient, but we eventually realized that they simply do not care. We care about Sub-Saharan Africa and Latin America, but they do not. We do not trust them to prioritize the global availability of their offerings at this point, and as a result we no longer even bother checking out their offerings. What's the point if instead of empowering us, they restrict our business model.
by maxehmookau on 6/14/21, 3:13 PM
by sidcool on 6/14/21, 3:29 PM
by AnssiH on 6/14/21, 4:50 PM
The service then gets the user's personal identity code as a return value.
Looks like that kind of flow is not supported.
Finnish users will be very hesitant of giving scans of their ID documents to foreign companies as no domestic online services require them. And of course Finnish companies cannot practically use this for now, at least for domestic users.
by gip on 6/14/21, 8:24 PM
Are any accuracy numbers for Stripe Identity currently available? I'm working with a merchant in Europe who is struggling due to fraud. Would be cool to figure out if Stripe Identity will improve over their current solution.
by SLWW on 6/14/21, 10:55 PM
It's one of those things that you expect a more shady company to release. Then again (and it's all hearsay mind you) that they are not a good company to work with, and when talking to employees who left, they don't seem like a good company to work for.
Stick to CCs, that's intrusive enough.
by mvanga on 6/14/21, 2:45 PM
by MattIPv4 on 6/14/21, 2:47 PM
by pg_bot on 6/14/21, 3:08 PM
by apexalpha on 6/14/21, 3:30 PM
Because I've used similar services inside apps dozens of times. Sometimes to verify a drivers license to ride a car, sometimes to verify my ID to register a bank account.
Every time is was done in a few seconds so I assumed the companies used an API rather than every car-share building it themselves.
by jmuguy on 6/14/21, 3:23 PM
by endisneigh on 6/14/21, 2:50 PM
by float4 on 6/14/21, 3:15 PM
When an HN post sends me to a Dutch page, it's always Stripe. 100% of the time.
by pedalpete on 6/15/21, 12:58 AM
I had been warned that stripe just wasn't set-up for this type of environment, but I think identity could really help.
At the same time I'm VERY concerned that stripe has allowed the API to download the proof of identity. Just like I don't want to be managing customer credit cards, I don't want to manage customer identity documents either, and I don't want to upload my identity to a company that allows the documents to be downloaded.
When I'm buying something on the internet, maybe I trust the company I'm buying from, maybe not but I know if they are using stripe, they never get my credit card number, so at most, they are able to only get away with the value of my purchase.
My identity is another matter! If I trust stripe to manage my identity, that's probably ok. I don't think stripe should blanket allow their customers to download my identity. I get that perhaps some companies have this requirement, and I'd suggest that they need to be able to work with Stripe directly to enable this for them, but for every company that signs up with stripe to be able to download the identity file...it seems like a huge risk not worth taking.
by ngngngng on 6/14/21, 5:42 PM
This looks cool though, and no gimmicks.
by client4 on 6/14/21, 4:10 PM
by andymoe on 6/14/21, 3:01 PM
by orliesaurus on 6/14/21, 2:54 PM
by donjh on 6/14/21, 3:56 PM
by jmatthews on 6/14/21, 3:28 PM
by axiom92 on 6/14/21, 4:05 PM
Looks like they have been working on it for a few years now. Here's a video from 2019 where someone from Stripe is giving a demo: https://www.youtube.com/watch?v=TDocEZ4f5ow.
by xtat on 6/14/21, 9:40 PM
by rbaxt on 6/14/21, 3:25 PM
by client4 on 6/14/21, 4:06 PM
by spywaregorilla on 6/14/21, 2:44 PM
by choppaface on 6/14/21, 4:51 PM
I’m also impressed that Stripe called this “Identity” instead of something more like “Trust and Safety.” The current name makes it sound more like Okta or something but that’s not the case. At least today. Perhaps they want this to grow to overtake stuff like Experian.
by odiroot on 6/14/21, 3:11 PM
Multiple much smaller countries' IDs are supported.
by morpheuskafka on 6/14/21, 4:39 PM
by sublimefire on 6/14/21, 4:57 PM
* country code search - allow to search by a full country name or by other types of code. Was searching for Ireland and "irl", "ire" does not yield any results, only a direct match to "ie" does.
* "Provide personal information" - could default to the country where the text message went or at least could have a search instead of a <select>
Not sure if it is possible but some of the orgs will ask to limit the phone numbers to just one region, e.g. only UK. I know I need to RTFM
by traspler on 6/14/21, 4:55 PM
And do I understand "Stripe uses a combination of machine learning models, automated heuristic analysis and manual reviewers to verify the authenticity of hundreds of different document types." correctly in that I do not only upload video/images of my passport, face to stripe for automatic analysis but in some cases a human would even review it? Or is this a specific option I could choose?
by strifey on 6/14/21, 10:36 PM
Still appreciate seeing Stripe's name when taking a pic of my ID rather than just the rather small startup I was using. No offense to small startups, but I might've balked at it otherwise.
by terminator38 on 6/14/21, 4:20 PM
Why is this necessary? I thought the point was to trust Stripe with this data instead of many small companies which could abuse the data
by xyst on 6/14/21, 9:07 PM
Sounds like an epic data leak that’s waiting to happen.
by randompwd on 6/14/21, 4:14 PM
A fake ID is still a fake ID. Just because it passes a looks-similar test doesn't mean it's being verified.
verify > verb > make sure or demonstrate that (something) is true, accurate, or justified.
If it's not confirmed by issuer(in person or programmatically), it can never be 100% thus can never be verified.
by Etheryte on 6/14/21, 3:36 PM
by jsonne on 6/14/21, 5:51 PM
by ullevaal on 6/14/21, 4:08 PM
Also surprised they are not leaning more heavily into the existing identity solutions in the countries they are already operating in, like the Netherlands and the Nordics. Maybe hard to differantiate from existing competitors?
by Dowwie on 6/14/21, 7:01 PM
by mleonhard on 6/15/21, 6:51 AM
Also, how long does the VerificationSession verified_outputs field remain accessible?
by evtothedev on 6/14/21, 3:09 PM
Previously, you'd have had to use something like Jumio for this, which was (to be generous) pretty wonky.
by joshuarubin on 6/14/21, 4:07 PM
by gshakir on 6/14/21, 5:39 PM
by verytrivial on 6/14/21, 7:32 PM
by kebman on 6/14/21, 5:44 PM
by JacobiX on 6/14/21, 10:23 PM
by jollybean on 6/14/21, 6:20 PM
If we need to use our identity online for Age Vertification, then why doesn't the government step in with an anonymous service for that?
That - and - sites should have to get some kind of basic regulatory approval for asking for id.
And then liable if they leak the data.
by areichert on 6/14/21, 2:58 PM
by edwardmp on 6/14/21, 3:55 PM
by plumeria on 6/14/21, 7:46 PM
by boulos on 6/14/21, 4:16 PM
by paul_f on 6/14/21, 3:16 PM
by fenospro on 6/14/21, 10:15 PM
by snickmy on 6/14/21, 4:31 PM
by howellnick on 6/14/21, 5:32 PM
by rStar on 6/14/21, 6:01 PM
by methyl on 6/14/21, 7:51 PM
by mtnGoat on 6/14/21, 6:17 PM
by PanosJee on 6/14/21, 5:38 PM
by rognjen on 6/15/21, 1:52 AM
by tiffanyh on 6/14/21, 3:34 PM
by arthur_sav on 6/14/21, 7:52 PM
- Did you say something politically incorrect? Banned. - Stripe employees don't like you? Banned. - They just feel like it. Banned.
Yeah. No.
by pqdbr on 6/14/21, 6:09 PM
by paulcnichols on 6/14/21, 4:41 PM
by ericlewis on 6/14/21, 3:24 PM
by punnerud on 6/14/21, 5:28 PM
And how is the development process?
by Sr_developer on 6/14/21, 3:24 PM
by hmate9 on 6/14/21, 3:53 PM
by nceqs3 on 6/14/21, 2:45 PM
by grey-area on 6/14/21, 3:41 PM
by SN76477 on 6/15/21, 12:25 AM
by jokethrowaway on 6/14/21, 3:17 PM
Love it.
by toomuchredbull on 6/14/21, 4:02 PM
by rootsudo on 6/14/21, 6:31 PM
by 3np on 6/14/21, 5:12 PM
There are ways to securely address the problems Stripe Identity is solving for that don't involve a single centralized honeypot that both collect and retain all identification documents, build profiles of individuals, and handles authentication and attestation. These should be broken up.
A company like Stripe sets and maintains norms. They have the means to work towards something better, instead of bidding up on the status quo with a blackbox moated vertical integration where market capture wins over everything else. If we don't get either industry cross-collaboration on open federated standards and networks, the only option will be strong government regulation enforcing well-intended but poorly executed alternatives.
There are a lot of existing work on more open protocols, federated standards, and whatnot. All of that is being ignored, and nothing else is proposed as an alternative.
Both companies (Stripe Identity's customer base) and individuals deserve better.
---
Anecdote:
I apologize if I am more verbose than I would have been if I hadn't just spent most of the past 5h in a Kafkaesque series of phone calls with Paypal. Replace Paypal payments with Stripe Identity in the following and tell me I'm exaggerating when I say that this is a danger to society:
I was trying to do a single webshop purchase where the vendor only had Paypal integrated as an option. Something (supposedly with my IP/browser) made them require registering an account to proceed, which required phone verification in the country of my credit card. Account immediately got flagged and completely locked before the purchase was completed, everything got changed to the language of my credit card country (which I don't speak or read) and they told me to call Paypal support in that country, on a given number. I called and despite speaking great English, they were unable to help me in English, and told me I had to call the NA support instead. The robot voice on the other end asked what I wanted and after a couple of honest attempts, I tried with "live agent". At first it seemed like there was no way to get to a real person instead of the robot. It demanded me to verify the credit card associated with the number I was calling from - a Skype number that is not on any account of mine. I persisted in saying only "live agent" as an answer whatever the question as the voice persisted in its demands for information, until after 6~8 I was actually patched through.
I was after that escalated/sent around 5 different times, each agent taking a good time to repeat the same conversation from the beginning, making me repeat each line of information they had and a fresh round of either of SMS or e-mail validation. The final agent stayed with me for the last couple of hours as we went through everything in detail. They guided me through another e-mail validation, a password change, each step involving a browser taking painfully long time due to extended reCaptchas at every step. At some point it seemed like it would just not work as there was an infinite loop of reCaptcha and login form. The agent refused to proceed as apparently this was the only way to verify my e-mail address. All this as I was actually still logged into the blocked account and clicking links in e-mails. Trying from another device and network connection, that loop finally got broken. Eventually it came to that I had the option of an "appeal process", involving me uploading a photo ID. I said I was not comfortable doing that. My only option then was to close my account. Which requires providing a photo ID. At this point I was very frustrated and told the agent that as a resident of the EU, I would like to request data deletion. After arguing a bit about that, it turned out that there was another way to close the account, but it involved another appeal process. The agent told me that should take about 3-5 business days. After the call I received an e-mail saying account closure had been initiated but will take a minimum of 180 days to complete.
As for the purchase, the same agent actually stayed with me on the line as we tried from the beginning to do a "guest checkout", which is what I had been attempting to do from the beginning. It took a bit of back and forth until the conclusion was "it usually works but computer says no and I can't tell you why".
by baybal2 on 6/14/21, 3:22 PM
Few years down the line, it requested me to submit my ID data for a booking in China.
All my ID data was pre-filled.
by ape4 on 6/14/21, 3:03 PM
by kgraves on 6/14/21, 3:11 PM
by seaorg on 6/14/21, 5:18 PM