33 ms·
Stripe Identity
- ngoel36 5y agoI've never seen a company release incredible products with as high velocity as Stripe has over the last few years. Truly incredible. $1.50/user may sound outrageously expensive at first, but having seen all the engineering power it takes to build something like this at Uber...it's a totally fair price.
- recursive4 5y agoThis is on the less expensive side of alternatives and doesn't require a minimum annual spend quota. They nailed this for startups, which I imagine is a combination response to / anticipation of regulatory requirements in Web3 apps.
- jonplackett 5y agoJust what I was thinking. Can Stripe hurry up and go public so I can buy some shares?
- marvin 5y agoI have been thinking the same thing for some time now. Unfortunately, I wouldn't hold my breath. If they are able to stay private, they probably will. It's easier to build a business when you don't have to deal with the hassle and interference of public markets.
- thisiscorrect 5y agoWhat would that do to all the Stripes holding illiquid shares in a private company?
- marvin 5y agoI'm not familiar with Stripe's situation, but there are non-public markets available for this kind of stock sale. You just can't buy from them unless you're already rich. I'd guess that long-term employees do have an amount of flexibility in that regard.
- IgorPartola 5y agoCan you form a mutual fund/ETF that invests into those kind of companies via the non-public markets and then sell shares publicly for the fund?
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- jagged-chisel 5y agoPublicly traded organizations can have any kind of private investment. I wonder, though, if there is regulation around how much of the public org’s capital can be put in private stock purchases…
- hartator 5y agoI think some VCs are already also offering shares via mutual funds.
- reportingsjr 5y agoThis is already a thing, large investors like Fidelity do exactly this. e.g. Fidelity has a significant investment in SpaceX through a handful of their mutual funds, which you can then purchase and basically invest in SpaceX indirectly.
- snowwolf 5y agoScottish Mortgage (SMT) in the UK does this and has a stake in Stripe (https://citywire.co.uk/investment-trust-insider/news/boost-for-scottish-mortgage-as-stripe-soars-to-95bn/a1480918 https://citywire.co.uk/investment-trust-insider/news/boost-f...)
- sudhirj 5y agoI’ve seen companies doing buy backs to give people liquidity. In India, anyway. Check out Zerodha.
- boringg 5y ago"In March, Stripe, which describes itself as “payments infrastructure for the internet,” became the most valuable private company in Silicon Valley, raising $600 million at a valuation of $95 billion. The Journal reported Stripe is considering going public later this year or early next year."
- andy_ppp 5y agoIf only Stripe would start a pre-ipo stock market. I guess only incumbent regulation prevents this, it’s not a technology problem.
- jabo 5y agoI believe Carta already does this: https://cartax.com/ https://cartax.com/
- andy_ppp 5y agoI think Stripe pre-ipo-ing on their own platform would show great cojones, but I think they are more careful than I’d be about such things.
- edoceo 5y agoCarTax.com? Good jerb marketing team!
- jaywalk 5y agoI'm sure OP was implying "for retail investors" in his wish. Carta is just another way for rich people to access things that are only available to rich people.
- boringg 5y agoWhile that sounds like a great ... in all likelihood by the time it hits the public market most if not all the value will be extracted by the investors. With a branded company like this and equity markets as frothy as they are. I doubt there will be much value left for retail. Hopefully Im wrong though.
- tshaddox 5y agoWouldn’t the idea be that the company would continue to create value after going public?
- boringg 5y agoThe idea of going public is to raise another round of financing for the company while being able to get liquidity for private shareholders. It is not necessarily to create value going forward. The best option is for the company to raise a good deal from the public markets (high valuation on limited equity) and then execute successfully without needing to raise again. If they do need to raise again they have hopefully not done a poor job on their original public IPO so that they can go back to the public markets. That said it isn't that important a factor.
- gwright 5y ago> It is not necessarily to create value going forward Not sure where you are going with that thought. A business that isn't creating value is going out of business or selling to someone who has an idea of how to use its assets to create value.
- boringg 5y agoActually not all companies create value. Monopolies create profits through pricing distortions but not necessarily value. My point is that creating value is not a key component of a company going public. In this current moment I would wager that if you are suggesting that you will create value in the market going forward you will get a great return on your investor dollars but you may not actually execute that value creation. (relevant news: lordstown motors)
- arcturus17 5y agoYou can buy it by proxy through funds or similar. I've been eyeing Scottish Mortgage which despite the name is actually a high-tech fund packaged as a stock publicly traded in the London Stock Exchange. They hold Stripe among many other interesting investments.
- petters 5y agoStripe is 0.9% of their holdings so they are of limited value of you sell exposure to Stripe specifically.
- boringg 5y agoIf you want exposure to them - go get Shopify stock - they just disclosed being in on the round of Stripe. https://betakit.com/shopify-reportedly-invests-in-stripe-bringing-total-stake-to-over-350-million/ https://betakit.com/shopify-reportedly-invests-in-stripe-bri...
- andy_ppp 5y agoI know that KYC checks for Onfido we had no volume but we’re being charged around $10. Is the $1.50 for KYC or some lesser verification?
- vishnugupta 5y ago> $1.50/user may sound outrageously expensive at first, but having seen all the engineering power it takes to build something like this at Uber...it's a totally fair price. I observed other teams struggle to build and have tackled challenges posed by identity, 1.5$/user is terrific price. Handling PII data in itself is a rabbit hole of engineering, product, and regulatory challenges. Let alone creating unique identities, matching, and what not.
- grouseway 5y agoI'd put Twilio and Cloudflare in the same category for vision (expanding product offering) and execution.
- benburleson 5y agoYep, these are all examples of top engineering organizations.
- jonplackett 5y agoI thought that too - until I tried to use Twillo for the first time in a couple of years. Holy crap they overcomplicated the interface! There's 3 or 4 levels of menu all shown at the same time in different directions. The docs are also way worse. The product is still great, but the interface is a complete mess!
- varispeed 5y agoSadly out of reach for small projects. For example if you had a site with 100k users, you'd barely cover server costs with Ad Sense. $150k to check all of them? Would never happen :/ Maybe if they could pay for verification themselves?
- jhugo 5y agoIn many cases you don’t need to verify the identity of every user. You can use some signal to determine when you need ID, or require it for accessing certain products/features.
- spoonjim 5y agoYou don’t need to verify a user’s real identity to serve them AdSense.
- varispeed 5y agoThey can post AdSense violating image and report the URL to get the page demonetised. Users of similar project done that many times.
- whimsicalism 5y agoIf you're not offering a service for $, why do you need to verify identity? What is the usecase? This strikes me as classic HN bikeshedding.
- varispeed 5y agoSpam and other malicious behaviour. It's time consuming for mods to block spammers. Instagram also don't charge users and yet they verify identity.
- arcturus17 5y agoInstagram may be verifying identity now (I didn't know... letting FB scan my id would be one of the last things I would want), but I'm pretty sure they reached a massive scale without such a measure.
- ankurpatel 5y agoThe tech stack has something to do with it. Stripe has such high velocity because of Ruby on Rails.
- 0xFACEFEED 5y agolol! When are we as a community going to move past treating frameworks/languages/tools as a silver bullet? Frameworks don't make teams better; good management, technical leadership, and great infrastructure does.
- ankurpatel 5y agoYou are right but frameworks help with long term maintainability of code and also being able to build out features quickly which is what the comment was referring to originally. If they use Go lang of some other tech stack without framework it can help them achieve their goal but not at the same speed.
- arcturus17 5y agoI can't even find any evidence that they use Rails, and I'm pretty sure their outstanding velocity is minimally explained by their choice of tech stack.
- tyingq 5y agoThat it's flat, and not a percentage, is a welcome surprise.
- privatdozent 5y agoAny news on IPO plans?
- spywaregorilla 5y agoHow does this work?
- ceejayoz 5y ago> Detect fake IDs and spoofed photos with machine learning > Match the ID photo with selfies of the document holder > Validate SSN and addresses against global databases Seems fairly clear.
- Muromec 5y agoSo you just need to print physical (fake) id and claim to be in Europe to get around all three.
- andylynch 5y agoThis sort of thing is definitely usable in Europe; if you’re thinking of GDPR the legitimate interest and legal obligation rules are likely to apply to users of this product. Eg at least one of my banks uses something like this for account identity validation (I see KYC is high on their list of use cases). Things like car rentals would find this really useful too.
- c7DJTLrn 5y agoAwesome, can't wait to be irreversibly put on a blacklist because a black box algorithm has decided something doesn't look right.
- pc 5y agoIt's actually pretty cool (IMO; I'm biased). Drop-in browser-based user authentication that: * Uses various sophisticated heuristics to detect real vs fake IDs. * Matches the ID to the human face. * Detects whether the human face is live or not. * Dynamically requests more or less information depending on the confidence level. It also gets better over time based on the attacks and fraud attempts that Stripe itself sees.
- 5y ago
- nceqs3 5y agoIf Stripe were to get hacked who would pay the GDPR fine?
- ceejayoz 5y agoTheir insurer? (I'd also expect the ID photos etc. aren't stored long-term.)
- ForHackernews 5y agoThis sounds hopeless naive. Do companies even bother carrying insurance for data breaches?
- ceejayoz 5y agoYes?
- deleted 5y ago[deleted]
- andylynch 5y agoIn their TOS and Privacy Policy it’s made clear they are also data controllers. Unless you contribute to the breach it would almost certainly fall on them.
- deleted 5y ago[deleted]
- edwinwee 5y agoYep, Stripe would be the data controller in this situation (and we comply with GDPR). https://support.stripe.com/questions/managing-your-id-verification-information#processor-controller https://support.stripe.com/questions/managing-your-id-verifi...
- motives 5y ago
- mvanga 5y agoAmazing how Stripe consistently executes fantastic solutions for all the very real and difficult pain points of building commercial products on the web. Fantastic work!
- willeh 5y agoAbsolute game changer, other actors in this market have big bulky sales processes with difficult pricing models and high commitment. If Stripe is competitive on pricing they will definitely win this market.
- MattIPv4 5y agoHaving experienced the end-user flow for Identity when doing bot verification on Discord, this was an incredibly seamless product back then, when it was presumably in beta. Can only imagine its even cleaner and faster now its officially released.
- ericlewis 5y agoCurious, do you recall if it was slow? like, great than 2 seconds or?
- hn_throwaway_99 5y agoThe Stripe Identity product is fantastic. Some of the most impressive things: 1. If you are at a desktop, there is an easy transition to using your phone to take a picture of your ID (or a selfie if that's the use case - it will match selfies with ID photos), and then complete verification on the desktop. 2. It does all the image analysis (i.e. is the ID in focus, etc.) in browser without the need for a native app.
- anonymouse008 5y agoThis almost proves that webapps are a competitive substitute to AppStores - making the consumer detriment very hard to prove in the current anti-trust framework.
- patrickmcnamara 5y agoProves it for this one use case maybe. I don't even think you can get webapp notifications on iOS.
- jtbayly 5y agoThe fact that Apple has refused to deliver that only proves the point. If they did, many apps wouldn’t be forced to be in the App Store. It’s certainly possible, as iirc, it works on Android for years now.
- jsmith45 5y agoIncredibly annoying that apple does not support this, while also trying to crack down on apps that is considered to just be a wrapped web-application. (In which case they want you to make a proper web app instead). Even using notifications is not considered enough of a reason to get an app they feel is just a wrapper approved.
- Me1000 5y agoThey have supported it on desktop Safari for years, so it really is just a political decision for them at this point.
- searchableguy 5y agoThe pricing link on the top doesn't refer to any pricing section on the page. Is it missing? Edit: This seems to be an internationalization problem. I am from India. The pricing section for Indian page https://stripe.com/en-in/identity#pricing https://stripe.com/en-in/identity#pricing is missing so the link doesn't work.
- edwinwee 5y agoIdentity isn't available in India today, but that anchor link is indeed broken (we'll fix this now—thank you!).
- NelsonMinar 5y agoFor anyone looking for the answer, in the US it's $1.50 / ID verification and $0.50 for Social Security Number lookup (an American tax number that is officially not for identity purposes but used that way all the time).
- SloopJon 5y agoI'll give my SSN to a healthcare provider, and maybe a bank. Random vendor using Stripe? Probably not. Edit: to be a little less flippant, what is an example of a Stripe user to whom you would be comfortable giving your SSN?
- voiper1 5y agoIt mentions KYC, so for example Etsy might use it to verify a vendor that it sends earnings along with a 1099.
- burntwater 5y agoAn employment related service could legitimately require a valid SSN.
- judge2020 5y agoYes - most U.S. post-degree jobs require background checks which will almost certainly require giving your SSN to the employer.
- endisneigh 5y agoIt’s not clear to me how you can detect a fake ID with machine learning. A persons appearance can change drastically - seems intractable
- manigandham 5y agoSome things don't change, like the dimensions between features like eyes, nose, ears, etc. Coinbase had an interesting presentation on this a few years back about how they verified IDs from pictures and dealt with all kinds of fraud. Worst case, if the appearance is really drastic then it would just fail and require a manual intervention.
- orliesaurus 5y agoIf this even reduces 20% of having to call up a human to verify my account because 'our systems have detected that you have accessed your account from an unknown location' then, yes please and thank you! Also interested to see what form of IDs it will accept! Only negative: Expensive...but I guess it's fair for it doing all the heavy lifting.
- areichert 5y agoOh man, really excited about this. I'm curious how far Stripe wants to go down the path of KYC-related products... it feels like a huge market with a lot of pain points where having Stripe-quality APIs would be amazing.
- deleted 5y ago[deleted]
- andymoe 5y agoCross posting this from Twitter but please consider marketing to states. They are using a company called IDMe to verify eligibility for benefits in the US and a family member (and thousands of others) have wasted days on the phone with them trying to get them to do verifications because their automatic verification tech does not work. (There are class actions against this co they are so bad)
- ianhawes 5y agoThis is a refreshingly affordable and beneficial offering. I did a deep-dive on KYC providers last year. The more well-known folks commanded 5 figure setup fees, wanted 1 to 2 year commitments, and sought to have you pre-pay for verifications. It reminded me of internet credit card processing pre-Stripe.
- ape4 5y agoI wonder... It can pull up a user's drivers license - so what about their covid vaccination record (maybe in the future).
- jokethrowaway 5y agoI'm pretty sure it can't. They can't know for sure whether an ID is real or fake (they're not the government).
- f38zf5vdt 5y agoDoes Stripe intend to make a giant online database of international identity documents? Why should we trust Stripe to secure these? It could be Equifax levels of problematic if there would be a intrusion, but I also can't tell how Stripe plans to use this information.
- rokobobo 5y agoI never wanted Equifax to have any of my data, and yet here we are. After the breach, I wouldn’t ever be a paying customer to them if I had a choice. (Indirectly, I am still a “customer” in the sense that they probably still have my data and get new data about me—but apart from canceling all my cards, not sure what choice I have). In comparison, Stripe seems to charge for each product it offers. I think that’s a more fair and transparent model.
- f38zf5vdt 5y agoIf the company you're interacting with uses Stripe ID verification and you are forced to use it to pay them, I'm not sure it's much better than going to a bank and opening an account and then Equifax getting the information immediately.
- tchalla 5y ago> In comparison, Stripe seems to charge for each product it offers. I think that’s a more fair and transparent model. They could be charging you AND creating an international ID database.
- NegativeLatency 5y agoFor equifax you’re the product, not the customer
- falcolas 5y agoYou are not a credit bureau's customer - the stores, public utilities, cell phone companies, banks, and so forth, are. They share that information to minimize their risk in extending credit (even something like billing you at the end of the month for services rendered is a form of credit) to you. And frankly, if Stripe is offering any form of credit, it's likely working with the credit unions too.
- pg_bot 5y agoAny folks at Stripe want to chat about a HIPAA compliant version of this? I know some folks who may be interested...
- myko 5y agoSign me up for that discussion as well
- evtothedev 5y agoI am so excited to see this! Previously, you'd have had to use something like Jumio for this, which was (to be generous) pretty wonky.
- kgraves 5y agoHow does this compare to Onfido?
- odiroot 5y agoI'm really surprised they don't support Polish IDs. We've had them in the same format for ages and I've done automatic verification with some other companies (e.g. Revolut). Multiple much smaller countries' IDs are supported.
- maxehmookau 5y agoThis just won in terms of simplicity, ease of use and cost. Especially in the UK. There are no other competitors at this price point right now.
- benjaminjosephw 5y agoThey are building a platform where other companies are clearly just selling a product. Identity verification is definitely something that gets better with more data as more people use it. Pricing low to gain market-share is the obvious move for companies which don't have pressure to show immediate returns. Maybe it shows a more general difference in ambition between companies in the UK to those across the pond.
- float4 5y agoShout out to Stripe for translating all their web pages! When an HN post sends me to a Dutch page, it's always Stripe. 100% of the time.
- Sr_developer 5y agoThat is assuming the translation is of high quality and sadly that is not always the case. I am a native Spanish speaker and for the life of me I cannot understand most of the "Spanish Version" technical pages I read.
- jlhonora 5y agoI work at Stripe, though not on the L10N/I18N or identity teams. It would be tremendously helpful if you could send me some feedback so that we can improve, jlh at stripe dot com. I'm a native Spanish speaker too, and nothing in this announcement strikes me as unintelligible, but that might be my own biases at play given the familiarity with Stripe's lingo.
- Sr_developer 5y agoAre you going to pay me? If not, good luck!
- jlhonora 5y agoProbably not the answer you expect, but the I18N team is hiring :) https://stripe.com/jobs/listing/internationalization-engineer/3033127 https://stripe.com/jobs/listing/internationalization-enginee... Otherwise, if you're a trained linguist and have demonstrable consulting experience QA'ing technical documentation then we'll be happy to arrange something. In either case, we appreciate your feedback, and my emails are open!
- manigandham 5y agoNot only unexpected but that's about the best reply possible. Nicely done.
- throwaway9398 5y agoI gave up on Stripe because they clearly are a US-focused company, and do not have a global outlook. I find it disappointing that after so many years of being in business, their payment processing services are still only available to a few dozen countries. This for example makes it impossible to rely on them to build a global marketplace with Stripe Connect accepting merchants from all over the world. Stripe is not for those seeking to run truly international businesses. We've been patient, but we eventually realized that they simply do not care. We care about Sub-Saharan Africa and Latin America, but they do not. We do not trust them to prioritize the global availability of their offerings at this point, and as a result we no longer even bother checking out their offerings. What's the point if instead of empowering us, they restrict our business model.
- pqdbr 5y agoI haven't given up on them, but LATAM is definitely not their focus and we've moved 95% of our payment volume to a local payment processor, even tough we were one of the first private beta testers back in 2015 (wow, it's been 6 years already). My angle is in Brazil. Even after all these years, they still don't support monthly installments, which is literally a single line API param that, honestly, I don't know any other payment gateway in Brazil that doesn't support it. Monthly installments is a huge deal in Brazil. They also only now started the private beta of Boletos, which is unfortunate since Boletos are being phased out in Brazil due to the new PIX, which allow for instant payments 24/7. So they are basically releasing just now a feature that nobody really wants anymore. Stripe connect also isn't available (AFAIK only the "standard" account is available, which mandates for Stripe onboarding and can't accommodate any white label marketplace integration). The lack of focus is noticeable even from their marketing pages. Notice how in https://stripe.com/br/connect https://stripe.com/br/connect the explanation for "Cobranças diretas" and "Cobranças de destino" are exactly the same (the text "Os compradores fazem transações diretamente com os vendedores, mas quase nunca notam a existência da plataforma, que pode cobrar tarifas de transação" appears in both), making it impossible to understand the difference, while if you visit https://stripe.com/us/connect https://stripe.com/us/connect you see two different texts for each option. Their support team has always responded quickly and politely, but we've had an impossible time trying to understand how they could allow us collect payments from abroad as a marketplace operating in Brazil, and that's even pointing out we didn't rule out opening a US-based company via Stripe Atlas if that was necessary. Lots of contradictory information and when we pressed on, they always end with them noticing that Brazil is still in preview and they still can't operate properly with Connect in Brazil. Which is weird, considering it's LATAM's biggest market. This release of Stripe Identity missing out Brazil on launch, even tough it's a country that badly needs antifraud solutions, is only one more evidence of this.
- paul_f 5y agoOoh, we could use this. Curious, can anybody point me to other similar products out there? I'd be interested in comparing. BTW, my uses case is USA only.
- jokethrowaway 5y agoOnFido with a clear pricing. Love it.
- troelsSteegin 5y agoWow, I would like to know about this has been engineered and QA'd. Owning this system on the product side would keep me awake nights. One question is tolerance on false negatives (you don't look enough like your govt id) - maybe they collect additional information, and use third party service for corroboration. If my Stripe Identity can be used across vendors, it's almost like a digital passport. I'll ask, in jest, are Stripe and Estonia (https://e-resident.gov.ee/ https://e-resident.gov.ee/) in competition?
- TameAntelope 5y agoThey've been doing it for years internally, I'm sure it's not much more stressful from a, "Oh did we let a bad guy through?" perspective, at least. Definitely more stressful from a, "Did we let a customer of a new product down?" perspective though, for sure. Also, not for nothing but has Estonia kept their system up to date? I've not been impressed with how it had aged last time I looked into it (a few years back).
- baybal2 5y agoI was once enticed by AirBnB's promise of "we don't store your ID data after validation" Few years down the line, it requested me to submit my ID data for a booking in China. All my ID data was pre-filled.
- dean177 5y agoWas this your browser filling for you?
- baybal2 5y agoTheir app
- floatingatoll 5y agoWas the data cached locally in your app?
- gpm 5y agoThat's still storing the data. Nothing says that the user typically lets this sort of information stay on their phone.
- scrollaway 5y agoDifference being you're still in full control of that data, can delete it at any time, and Airbnb the company doesn't have direct access to it.
- gpm 5y agoThey're not told it's there, there is no tool for them to view the data, to see what kind of data is there, or even delete data short of deleting the entire apps data. Airbnb the company can access it at approximately any time by pushing out an app update. Legally you may have an argument, morally I don't think there's much of a difference. I would certainly not be pleased to find out an app was doing that.
- jmuguy 5y agoWe’ve been using this to verify short term rental guests (non-Airbnb) for the past year and it’s been extremely positive. Given that our guests have trouble even following a link for check-in the identity product has some great UX, they rarely get stuck on it.
- pbowyer 5y agoAt work we do eIDV of customers and we tested 5 companies. One was quality but too expensive and required too large commitments; two couldn't detect badly photoshopped frauds we threw together, another couldn't detect a printed or on-screen copy of a document being captured (vs the real document - difficult to do, but important). The fifth which we're using can detect printed copies of documents around half the time, but their OCR is shockingly poor when it comes to recognising DoBs so we have to manually check and update the age. We'll try Stripe and see how much fraud they can detect.
- maxpert 5y agoWill you update this thread? I am highly interested in results.
- pbowyer 5y agoYes - but it won't be for a few weeks as I'm on holiday and snatching 5 minutes unobserved on the laptop!
- orf 5y agoWhy hide the names of the companies you tested?
- Ensorceled 5y agoNDAs?
- mousetree 5y agoVery curious to hear your results. In the past we used Onfido but eventually switched to Jumio. This was mostly due to Jumio performing better with Passport and VISA documents. We may in future move to Persona as we use them for SSN verifications and their customer support / account management team is fantastic.
- Aaargh20318 5y agoIt is absolutely impossible to validate the authenticity of an ID document from a photo. Even if you capture a high-res photo and have it inspected by a trained document expert. Fortunately, it is not necessary to do this. Modern passports and many identity cards contain NFC chips that allow you validate the data on an identity document with complete certainty (as in: you know that the data is correct and not tampered with). In the majority of cases (depending on the document supporting the necessary protocols) it is also possible to prove that the chip is authentic and not a clone. Since the chip also contains a good quality color photo of the document holder, it is then possible to match this with the person holding the phone and do liveness detection. Remote optical verification of documents is impossible, and anyone who claims they can do it isn't being honest.
- ericlewis 5y agoHas anyone used this? If so, how fast does it seem?
- edwinwee 5y agoVerifications typically happen in 2 minutes, oftentimes 30 seconds (for common IDs like state driver’s licenses). And we’re working on making this faster!
- Sr_developer 5y agoThis is a little Big_Brother-esque for my taste.
- rbaxt 5y agoOne of the creepiest products of the last decade. Let's wait for the inevitable data breach.
- tracedddd 5y agoI really despise this trend of uploading your ID and a selfie for verification. I know it makes sense in some legal frameworks, but beyond that I find it invasive and risky (and rude.)
- edwinwee 5y agoIt’s not really a “trend”—if you think about it, ID verification is already required when checking into hotels, buying alcohol, or when visiting a bank teller. As more commerce moves online, Stripe Identity was built to significantly reduce the number of organizations and humans that would touch your ID—in a faster, secure way that’s hosted by Stripe (https://support.stripe.com/questions/common-questions-about-stripe-identity#why-id-verification https://support.stripe.com/questions/common-questions-about-...). We are also very direct about collecting consent: https://support.stripe.com/questions/common-questions-about-stripe-identity#verification-consent https://support.stripe.com/questions/common-questions-about-....
- toufka 5y agoIn very few of those use-cases does the entity 1) _retain_ any of that data, 2) posses an internet-scale database of identities. And as we've all come to know the distinction between "able to surveil" and "collect it all" crosses a threshold to make it of a different kind. If one's mindset is that in general, tech companies, unlike those other entities store it all, then there actually is a recent "trend" to migrate a normal behavior into an abnormally socially adjusted space.
- sascha_sl 5y agoIt is already illegal to retain copies of ID cards or even some of the data in many countries. Just requesting a copy without redactions is wandering into a gray area in Germany.
- deleted 5y ago[deleted]
- butt__hugger 5y ago
- jmatthews 5y agoNot to take away from the accomplishment, but hopefully the "selfie auth" isn't considered the penultimate verification. With no social engineering, just finding a public photo of someone, one could composite a short video that would be very hard to distinguish from reality.
- sidcool 5y agoIsn't this a privacy nightmare? All that data in Stripe data centers.
- edwinwee 5y ago1. Stripe has strict access controls—only those working on Identity/verifications can access the data. 2. Biometric data is not stored! It’s gone from our systems within 48 hours (usually in just minutes). 3. We think this’ll actually make the state of global privacy better—rather than having individuals collect, and verify your ID, Stripe will securely handle verification.
- agwa 5y ago> 1. Stripe has strict access controls—only those working on Identity/verifications can access the data. > rather than having individuals collect and verify your ID, Stripe will securely handle verification. The above statements are materially false. You allow customers of Stripe Identity the ability to access and retain "captured images of the ID document, selfies, extracted data from the ID document, keyed-in information, and the verification result". [https://support.stripe.com/questions/managing-your-id-verification-information#data-access https://support.stripe.com/questions/managing-your-id-verifi...]
- no_time 5y ago>3. We think this’ll actually make the state of global privacy better I'm sorry but this is grade A bullshit. If your api provides access to data (extracted or raw), you are not improving anything. Quite the opposite actually, because now I not only have to trust the company that I choose to do business with but I also have to trust stripe, an american company.
- wussboy 5y agoI think Stripe's opinion is that their current business is already a privacy nightmare (being a payments processor) and that they've learned a bit about it through the years so they feel they have the experience to do this right. I'm neither here nor there on Stripe as a company, but having worked with PCI and PII for many years, I'd trust a company more who had been through this process before.
- apexalpha 5y agoIs this new? (to the USA?) Because I've used similar services inside apps dozens of times. Sometimes to verify a drivers license to ride a car, sometimes to verify my ID to register a bank account. Every time is was done in a few seconds so I assumed the companies used an API rather than every car-share building it themselves.
- travellingprog 5y agothere are existing startups that specialize in ID verification. E.g. in my current freelancing gig, my client uses Passbase.
- tiffanyh 5y agoSo is this simply a straight up competitor to Jumio? Or is it more.
- Etheryte 5y agoLooks like the page was freshly edited to remove the pricing information (?), but it's telling they're targeting a very similar price range as Veriff [0], a startup that's been working in the same space for quite a while. [0] https://www.veriff.com/pricing#starter-plans https://www.veriff.com/pricing#starter-plans
- edwinwee 5y agoThis is a small localization bug that we’re fixing now (the pricing section doesn’t properly show for countries where Identity isn’t available in yet), but you can see pricing for the US at https://stripe.com/en-us/identity#pricing https://stripe.com/en-us/identity#pricing.
- tomytosian 5y agoAfter reading the HN below comments. It seems a sizeable portion of those comments are "incredible products from stripe" "amazing news" with very little backing content. Did they pay bots to post on HN???
- gurubavan 5y agoPlease don't post insinuations about astroturfing, shilling, brigading, foreign agents and the like. It degrades discussion and is usually mistaken. If you're worried about abuse, email hn@ycombinator.com and we'll look at the data. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- s_dev 5y agoStripe is a YC company and will always have cheerleaders on HN -- it is also arguably the most successful YC company. One of the few companies who simply wouldn't need to astro turf on HN.
- cyral 5y agoI think many developers have used Stripe for payments after dealing with legacy payment APIs like Authorize.Net and have seen how Stripe does it right and makes the process so much less painful, I'd assume their other products like this are as equally well built due to their reputation in the payments industry.
- nrmitchi 5y agoI don't think it's fair to assume that this is astroturfing in any way. Stripe just has a large following of people who like anything they release. Stripe has "fans" just like Apple does.
- gruez 5y agoThe landing page contains logos for clubhouse, discord, and shippo, which are presumably companies use the service. Does anyone find those usages to be unnecessarily intrusive? Maybe it's just me, but a chat app or shipping site asking me for a drivers license scan + selfie would make me never want to use the service again. It's appalling how this sort of stuff is getting normalized, eg. google asking for id scans for age verification.
- 4b11b4 5y agoWhat's the difference between filling out your address in text versus scanning? Is your face not on the internet yet? Just curious what specifically would make you never want to use it?
- oauea 5y agoWhy would these companies need to gather enough data to steal my identity?
- wyager 5y agoI can easily provide a fake address to protect my privacy. Harder and legally risky to provide a fake ID to protect privacy.
- DharmaPolice 5y agoIf you enter an address in as text you're in control of the data you're supplying. If you have to upload/scan a document then there might be other information they extract/store. I'm not someone concerned with such things but it's easy to see how they're different.
- floatingatoll 5y agoScanning lets you audit for photoshopping and sets a vastly higher bar for counterfeiting. (For example, Blizzard’s name change process requires you to cover irrelevant areas of your ID with actual paper, because no digital editing permitted.) See also: https://news.ycombinator.com/item?id=27503674 https://news.ycombinator.com/item?id=27503674
- 5y ago
- grey-area 5y agoThis is the problem I wish cryptocurrencies had focussed on - verified identity is the central problem in payments.
- deleted 5y ago[deleted]
- hmate9 5y agoI wish Stripe would go public so I could invest a good chunk. Who wouldnt want to invest in the backbone (or soon to be) of the entire internet payment infrastructure.
- edwardmp 5y agoGiven their docs state that they use third-party services to offer this service, isn't Stripe just providing a wrapper API around Onfido and charging a premium? If so, how is this really a useful proposition?
- edwinwee 5y agoIdentity was built in-house over the last decade from learnings from Stripe’s experience as a payment company. We’ve invested heavily in creating an end-to-end verification product with an ergonomic API, responsive capture experience, and advanced fraud detection and verification capabilities. Scaling ID verification globally also means working with others—we supplement our homegrown system with a number of partners for the best experience for the user. (e.g. Analogous to Stripe credit card payments, we also work with banking institutions.)
- edwardmp 5y agoThanks for the detailed reply, Edwin!
- donjh 5y agoThis marketing page is really delightful. The ID scan is a nice touch.
- deleted 5y ago[deleted]
- toomuchredbull 5y agoSeems handy for building crypto companies
- axiom92 5y agoThis is very cool! Looks like they have been working on it for a few years now. Here's a video from 2019 where someone from Stripe is giving a demo: https://www.youtube.com/watch?v=TDocEZ4f5ow https://www.youtube.com/watch?v=TDocEZ4f5ow.
- client4 5y agoI've been waiting for a service like this. I suspect we're on the precipice of a new Internet split, where one can be accessed with identity and the other is anonymous as we know it now. In some arenas, like comment sections, I welcome removing anonymity [1]. In other arenas I wonder if it will be used to divide populations online in some futuristic dystopian manner. For instance, only citizens of the United States with Good Credit and Good Social Score are allowed to read the Financial Times. [1] https://www.penny-arcade.com/comic/2004/03/19 https://www.penny-arcade.com/comic/2004/03/19
- joshuarubin 5y agoThose are some seriously amazing photos on the example IDs. I'd kill to have anything half as good on mine.
- flixic 5y agoThey don't look like photos. My guess is that Stripe's designer re-drawn passport designs.
- ullevaal 5y agoI'm surprised that they are not providing PAdES signatures here at the same time, do you think this is a direction they will be moving in? Also surprised they are not leaning more heavily into the existing identity solutions in the countries they are already operating in, like the Netherlands and the Nordics. Maybe hard to differantiate from existing competitors?
- plumeria 5y agoYeah, it would be easier and more private to validate your identity through an official digital signature, rather than providing biometrics (pictures).
- client4 5y agoIt looks like it's missing the user side of the equation. As in a user can validate they-are-who-they-say-they-are *once*, but Stripe is missing an opportunity to allow users to: validate themselves to a website regularly (OTP tied to identity), allow individuals to update their information (address change), allow individuals to revoke authentication, etc. It is a great foundation and there's huge opportunity for growth in this product.
- edwinwee 5y agoNeat idea and something we’ll think about.
- randompwd 5y agoThe only way to verify an identity is to call out to the identity issuer and confirm the details and pics on the id. A fake ID is still a fake ID. Just because it passes a looks-similar test doesn't mean it's being verified. verify > verb > make sure or demonstrate that (something) is true, accurate, or justified. If it's not confirmed by issuer(in person or programmatically), it can never be 100% thus can never be verified.
- boulos 5y agoOff-topic bug report: Montoya is the last name, not the first name. (Also, in the book / movie the spelling is Inigo not Iñigo nor Íñigo, but people use all the variants)
- terminator38 5y ago> Access captured images of ID documents and selfies Why is this necessary? I thought the point was to trust Stripe with this data instead of many small companies which could abuse the data
- rStar 5y agoit’s a data black hole. just wait a few years.
- superasn 5y agoHad to do this on a site recently and it didn't work for me at all. It wanted to scan the back of my dl but Indian dls are totally blank at the back. Then it said my webcam wasn't good enough and showed me a QR code to use for my mobile. The link never opened. Tried it 3 times and 5 minutes later I just googled the next alternative site and bought it from there. Lesson being use this only if it is totally necessary. You may lose paying customers in your overzealousness to be super tech savvy to KISS sites using a Paypal button.
- wantsanagent 5y agoWhen you say "this" do you mean "Stripe Identity?"
- superasn 5y agoYes I'm talking from a customer point-of-view. Was trying to buy a vps and they for some reason wanted to scan my driver's lic using this before I could pay through Paypal. Yes I was trying to buy via PayPal but this was step 1 for some reason. So I have only seen this work from the customer's point-of-view and it was not a good experience for me. I am a very patient person as i scanned my dl 4 times on desktop using a webcam capable of recording 1080p. Then i tried with a mobile and that didn't work either. A less patient man would have quit much sooner. I tried my best then just bought from the next site because they connected the Pay button directly to Paypal.
- judge2020 5y agoI think they mean 'was it stripe identity' (there is stripe branding during verification) or was the company using some other solution. The experiences I've heard from bot developers using Discord and thus their Stripe Identity verification haven't had any issues.
- superasn 5y agoYes it was stripe identity 100% not a custom solution. I think my experience was bad because it wanted to scan the back of my card which is just empty. Hopefully their tech will improve with time but my original point still stands. Don't do it Unless absolutely necessary. I was gonna pay with Paypal and chances of fraud with PP are very less anyway. They did lose a recurring customer that day since I couldn't pass this verification.
- snickmy 5y agoIf I was an AWS, GCLOUD or AZURE I'd acquire stripe right now and go super vertical on 'Everything for your business'
- nceqs3 5y agoIf only the FTC/DOJ would say yes...
- morpheuskafka 5y agoWorth noting that if you need the SSN verification for a marketplace type app for tax compliance purposes, the IRS has a free taxpayer ID validation service you can use. The SSA also has one that employers can use.
- paulcnichols 5y agoWas this product from an acquisition or home grown?
- gima 5y agoEU is apparently about to design and roll out Europe-wide digital ID service: https://ec.europa.eu/commission/presscorner/detail/en/IP_21_2663 https://ec.europa.eu/commission/presscorner/detail/en/IP_21_...
- AnssiH 5y agoThe way domestic services (both public and private) in Finland verify user's identity is via bank credentials (Finnish Trust Network), via Mobile ID (Mobiilivarmenne), or via government FINeID. All these involve multi-factor authentication. The service then gets the user's personal identity code as a return value. Looks like that kind of flow is not supported. Finnish users will be very hesitant of giving scans of their ID documents to foreign companies as no domestic online services require them. And of course Finnish companies cannot practically use this for now, at least for domestic users.
- choppaface 5y agoSift has a longer list of logos on their landing page, though I’d imagine even at this point that Stripe has more data. Sift got hit hard being unprepared for CCPA, I wonder what Stripe’s position would be. I’m naive but it strikes me that if Stripe were to offer a cheaper version of this product that does not transactions but for UGC, then Sift might have trouble retaining customers. I’m also impressed that Stripe called this “Identity” instead of something more like “Trust and Safety.” The current name makes it sound more like Okta or something but that’s not the case. At least today. Perhaps they want this to grow to overtake stuff like Experian.
- edwinwee 5y agoIdentity is the step that comes after Sift (or Stripe Radar). If Sift flags that a user may be suspicious, you may need to collect more information about them to confirm if they are legitimate or not. That’s where Identity comes in. Oftentimes, this is handled manually via an ops team asking a user to reply with a photo. Instead they can collect this automatically by surfacing Stripe Identity.
- traspler 5y agoDoes anyone know if it does liveness checks for the "selfie verification"? The docs are a bit vague on that. And do I understand "Stripe uses a combination of machine learning models, automated heuristic analysis and manual reviewers to verify the authenticity of hundreds of different document types." correctly in that I do not only upload video/images of my passport, face to stripe for automatic analysis but in some cases a human would even review it? Or is this a specific option I could choose?
- edwinwee 5y agoLiveness check is coming soon! At the moment we take live photos of the individual to help confirm that there’s a real person behind the camera.
- motohagiography 5y agoSmart. Banks haven't been allowed to monetize their KYC data, but this new non-bank class of payments companies have this opportunity. Interac has been trying to do this for many years. Some years ago I worked on a system let banks do identity assertions with proofs via SAML attributes instead of sharing customer PII. It is now a federation of banks in wide use for govt services in Canada. The use cases were really limited because the federation partners were too conservative to extend the identity services to relying party consumer applications real people actually wanted to use, and institutional sales cycles meant product feedback was glacial, so it has existed for over a decade in this relative backwater of gov-tech. I think identity companies have mostly failed to get traction because of a terminal lack of consumer sexiness, whereas Stripe has the jelly. Other companies in the identity space have been working on protocols and platforms, but none of them had a user base to extend an identity federation services into, which means they have never been able to make a real or viable product, just interesting techs. An internet payment provider with young consumer traction getting into identity is a Very Big Deal. It's going to position Stripe to knock out a lot of retail banks who can't offer similar services. Imo, this could make them bigger than Apple.
- cycop 5y ago"Banks haven't been allowed to monetize their KYC data"? I work for a major US Bank and they are most definitely monetizing KYC data, in fact we have made several billion dollar acquisitions just to scoop peoples data.
- motohagiography 5y agoThe convention in Canada was there were limits on how much customer PII banks and the payment networks could collect, use, and share or sell, and how. "Monetize," in my comment means "sell to others like a social platform / ad-tech company," whereas I would agree it could be monetized in other ways. What I see is that Stripe doing IAM for platforms and services that people use daily sets them up to dominate retail and small business banking services if they wanted to go there.
- jsmith99 5y ago
- sublimefire 5y agoThere is still some room for improvement: * country code search - allow to search by a full country name or by other types of code. Was searching for Ireland and "irl", "ire" does not yield any results, only a direct match to "ie" does. * "Provide personal information" - could default to the country where the text message went or at least could have a search instead of a <select> Not sure if it is possible but some of the orgs will ask to limit the phone numbers to just one region, e.g. only UK. I know I need to RTFM
- 3np 5y agoIt doesn't have to be this way. What Stripe (and others) are doing is a compromise, specifically compromising integrity and privacy of individuals, or as we like to call them, users. There are ways to securely address the problems Stripe Identity is solving for that don't involve a single centralized honeypot that both collect and retain all identification documents, build profiles of individuals, and handles authentication and attestation. These should be broken up. A company like Stripe sets and maintains norms. They have the means to work towards something better, instead of bidding up on the status quo with a blackbox moated vertical integration where market capture wins over everything else. If we don't get either industry cross-collaboration on open federated standards and networks, the only option will be strong government regulation enforcing well-intended but poorly executed alternatives. There are a lot of existing work on more open protocols, federated standards, and whatnot. All of that is being ignored, and nothing else is proposed as an alternative. Both companies (Stripe Identity's customer base) and individuals deserve better. --- Anecdote: I apologize if I am more verbose than I would have been if I hadn't just spent most of the past 5h in a Kafkaesque series of phone calls with Paypal. Replace Paypal payments with Stripe Identity in the following and tell me I'm exaggerating when I say that this is a danger to society: I was trying to do a single webshop purchase where the vendor only had Paypal integrated as an option. Something (supposedly with my IP/browser) made them require registering an account to proceed, which required phone verification in the country of my credit card. Account immediately got flagged and completely locked before the purchase was completed, everything got changed to the language of my credit card country (which I don't speak or read) and they told me to call Paypal support in that country, on a given number. I called and despite speaking great English, they were unable to help me in English, and told me I had to call the NA support instead. The robot voice on the other end asked what I wanted and after a couple of honest attempts, I tried with "live agent". At first it seemed like there was no way to get to a real person instead of the robot. It demanded me to verify the credit card associated with the number I was calling from - a Skype number that is not on any account of mine. I persisted in saying only "live agent" as an answer whatever the question as the voice persisted in its demands for information, until after 6~8 I was actually patched through. I was after that escalated/sent around 5 different times, each agent taking a good time to repeat the same conversation from the beginning, making me repeat each line of information they had and a fresh round of either of SMS or e-mail validation. The final agent stayed with me for the last couple of hours as we went through everything in detail. They guided me through another e-mail validation, a password change, each step involving a browser taking painfully long time due to extended reCaptchas at every step. At some point it seemed like it would just not work as there was an infinite loop of reCaptcha and login form. The agent refused to proceed as apparently this was the only way to verify my e-mail address. All this as I was actually still logged into the blocked account and clicking links in e-mails. Trying from another device and network connection, that loop finally got broken. Eventually it came to that I had the option of an "appeal process", involving me uploading a photo ID. I said I was not comfortable doing that. My only option then was to close my account. Which requires providing a photo ID. At this point I was very frustrated and told the agent that as a resident of the EU, I would like to request data deletion. After arguing a bit about that, it turned out that there was another way to close the account, but it involved another appeal process. The agent told me that should take about 3-5 business days. After the call I received an e-mail saying account closure had been initiated but will take a minimum of 180 days to complete. As for the purchase, the same agent actually stayed with me on the line as we tried from the beginning to do a "guest checkout", which is what I had been attempting to do from the beginning. It took a bit of back and forth until the conclusion was "it usually works but computer says no and I can't tell you why".
- elric 5y agoThere's definitely a market for this. Back when I worked in porn (in the camming sphere), we had a team of moderators whose main job was verifying the identity (especially age) of performers. With over 10k performers, this was a lot of work. And you can't just do it once. You have to do it every time a performer starts a performance. People would try all sorts of tricks, like taking a picture of themselves with an older sister's ID, all kinds of fake IDs, some better than others. Verifying an identity over webcam is no easy feat, those moderators had to be able to tell different passports apart (many, many, nationalities), tease out the fakes, and then make sure that they person in the ID is the same person presenting the ID. Problem is multiplied by the number of performers in the room. Performers who are eager to start making money instead of satisfying the moderators checklist.
- cam-perry 5y agoAgreed, there is a big market here. I worked on a real estate rental platform where we required ID verification for all listings and applications. At the time we used Berbix (YC company), which is practically the same as Stripe Identity. I would probably just use this Stripe feature today, since we were already using Connect for payments.
- whimsicalism 5y ago> like taking a picture of themselves with an older sister's ID, all kinds of fake IDs How would Stripe solve something like this?
- elric 5y agoOh I'm not saying Stripe has a magic way of solving this. I'm merely stating that this is a hard and annoying problem, that many businesses would gladly let someone else handle.
- seaorg 5y agoI’ve been saying for years that identity services will be a huge deal. In a world where captcha is less and less reliable and where fake posts are cheaper, faster and more convincing (GTP), there are almost no websites that can function without using an identity service. I’ve been screaming from the rooftops and nobody listened.
- punnerud 5y agoIs Stripe’s backend still Ruby? And how is the development process?
- howellnick 5y agohttps://cognitohq.com/ https://cognitohq.com/ is another YC company that's already in this space. I haven't tried either service, but I wonder how they compare.
- PanosJee 5y agoSeveral richly valued startups must be having a nervous breakdown right now.
- gshakir 5y agoAny connection to NIST 800-63-3 (Digital identity guidelines) ? Does it provide Identity assurance level 2 ?
- agwa 5y agoConsidering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. That would be an incorrect assumption. Per https://support.stripe.com/questions/managing-your-id-verification-information#data-access https://support.stripe.com/questions/managing-your-id-verifi... customers of Stripe Identity have API access to "captured images of the ID document, selfies, extracted data from the ID document, keyed-in information, and the verification result". Thus, when you use Stripe Identity to verify your identity, you have to trust that: 1. The website doesn't download, retain, and later leak your selfie and identity information. 2. The website's Stripe API token isn't compromised and exploited by identity thieves to access your selfie and identity information. Stripe appears to be leaning heavily on their claim that they don't disclose "biometric identifiers" to websites and that these "biometric identifiers" are deleted from their systems within 48 hours. This is extremely deceptive considering that biometric identifiers can be reconstructed from the selfie.
- poorman 5y ago>Considering that Stripe's original selling point was that it let websites accept credit card payments without seeing your credit card number I thought that Stripe's original selling point was that you could easily accept payments online without having to integrate with complicated bank and payment processor tech.
- agwa 5y agoAs I understood it at the time, alternatives required PCI compliance, which Stripe allowed you to sidestep thanks to tokenization, so I do believe that was a selling point. But this is besides the point I'm making, so I've edited my comment.
- nrmitchi 5y ago> Considering that Stripe's original selling point was that it let websites accept credit card payments without seeing your credit card number This is true, but it's also kind of a misleading statement; the original selling point was that you could accept credit cards without having to deal with the requirements of PCI compliance and merchant accounts, which is done (partially) by you not ever seeing the card data. If there was similar compliance regulation around document storage, I would assume that Stripe would use "Identity-Document-Standards" compliancy as a selling point. As far as I know, there are no such requirements. I do think your #2 point though is exceptionally valid, and would hope that the majority of Stripe keys are scoped to not even provide access to this data/endpoints. Edit: grammar
- ngngngng 5y agoThis is funny timing. My neighbor is the CTO at a company managing identity and building out frameworks and products to help other companies do it themselves. He was trying to pitch me on joining. Sounded neat until I found out how much they focus on the blockchain. It's far too likely it's a gimmick tacked on for no reason but getting hype and investment. Blockchain just attracts all the wrong people in my experience. This looks cool though, and no gimmicks.
- kebman 5y agoHow would you construct a secure zero knowledge proof to do this kind of thing over an API?
- jsonne 5y agoCan't tell you what a lifesaver this is and we're so excited to give it a shot. One of the challenges of adtech is there's a lot of bad actors trying to defraud ad platforms and a non insignificant amount of our time is thinking about how to minimize (can't eliminate) fraud. Having this baked into Stripe is a small miracle for us.
- rStar 5y agothis seems to be the opposite of what all the regular people getting into crypto are wanting. i will only adopt systems that give me more privacy, on balance, not less. make that decision a few times, even in modern life, and your privacy increases substantially from your naive neighbors.
- pqdbr 5y agoAny estimates of when this will be available for Brazil?
- mtnGoat 5y agolooks like a cool solution. having researched these tools very recently, i will say, the pricing is very high. there are other offerings on the market for $0.50 per look up and only bill you if its a positive lookup.
- jollybean 5y agoPlease no. If we need to use our identity online for Age Vertification, then why doesn't the government step in with an anonymous service for that? That - and - sites should have to get some kind of basic regulatory approval for asking for id. And then liable if they leak the data.
- rootsudo 5y agoStripe has lost it's way.
- newsbinator 5y agoWhy do you think so?
- Dowwie 5y ago@pc - This should be a pass-through / ephemeral type of service where a document is verified in-transit and then purged from memory. Stripe should not save any of these documents. Let Stripe customers deal with the decision whether to save in their own systems. Otherwise, this looks like yet another great value-added service -- congrats!
- verytrivial 5y agoThat's a mighty efficient process you've got there. I'll just leave this here: https://en.wikipedia.org/wiki/Bureau_of_Sabotage https://en.wikipedia.org/wiki/Bureau_of_Sabotage
- plumeria 5y agoCuriously, they support validating identities from Costa Rica but so far they don't support processing payments there. I wonder if the payments service is in-the-works for this country.
- methyl 5y agoThis is a great way to provide free trials to your users while minimising the risk of frauds. Great job!
- arthur_sav 5y agoYeah, let's make a for-profit corporation an identity management entity. What could go wrong. - Did you say something politically incorrect? Banned. - Stripe employees don't like you? Banned. - They just feel like it. Banned. Yeah. No.
- supertrope 5y agoThere's a tendency to conflate identification with endorsement. Twitter muddied the two together instead of keeping it as anti-spoofing measure. Users are trained to see HTTPS as a sign a website is legitimate or secure and not just a way to confirm the public key. Democrats want to use the unconstitutional no fly list to ban individuals from buying guns. After the Boston Marathon bomb attack some senators wanted to require KYC on all cellphones and encourage the police to not read suspects their defendant rights. The reflexive opposition to COVID-19 vaccine verification is because people don't trust the government.
- gip 5y agoI've worked in risk & fraud for some time now. As online platforms become mainstreams and are easier to build I think Trust and Safety is going to become the key differientiator. Stripe Indentity will no doubt play a big role and benefit the whole internet. Are any accuracy numbers for Stripe Identity currently available? I'm working with a merchant in Europe who is struggling due to fraud. Would be cool to figure out if Stripe Identity will improve over their current solution.
- xyst 5y agoBesides banks, brokerage, my accountant, or the government. Why would I give a private entity my ID to store as a ‘global’ user? Sounds like an epic data leak that’s waiting to happen.
- xtat 5y agoReally confused why this blew up so big when there are so many such KYC options. Someone enlighten me?
- mikeiz404 5y agoThis seems like a really useful service but I am concerned this is going to normalize requiring identity info for sites which do not legally need it. I imagine the pretext for most will be fraud prevention, and while this might be true, I cannot see how this wouldn’t eventually be used for ad targeting and other “consumer is the product” funding models without regulation restricting it.
- foota 5y agoIs knowing who the customer is with more certainty really useful though for targeting beyond just having their info they provide on sign up?
- mikeiz404 5y agoDepends on the degree of certainty I suppose. If it's close to 1 then probably not much though it does potentially provide more data to cross reference against when linking activity across services. Techniques such as using different email addresses and other first party data would no longer be effective for limiting cross linking of user data (fingerprinting is an issue as well) if a legal ID is required and that data is shared with the service. I’m on the fence about a service only using ID verification even from a fully trustworthy third party and not gaining any additional info (save for maybe a random unlinkable ID to prevent multiple accounts or perhaps just a flag indicating whether the ID is eligible for an account on that service). Even that bothers me. I would have to think about it some more. But I kind of do get it and see how that could enable better online communities. I’d like to think there is a better way though.
- SN76477 5y agoThis
- fenospro 5y agoInstead of being super serious, let me give a huge WELL DONE! to the UI/UX and frontend devs at Stripe to build such magnificent Web Pages!
- JacobiX 5y agoUnfortunately for this demo, they will successfully verify everyone. I was hoping for a real demo, in the past I had some interesting problems with selfie KYC checks because the photo in my passeport and my actual look are quite different …
- strifey 5y agoI used this for an online car rental service recently. My only main complaint was that it didn't work with FF for Android. Once I switched to Chrome, everything was great, but I'm disappointed in how often sites expect to be ran in a Chromium-based browser these days. Still appreciate seeing Stripe's name when taking a pic of my ID rather than just the rather small startup I was using. No offense to small startups, but I might've balked at it otherwise.
- edwinwee 5y agoHm! Could you email me with more on the device and browser versions? edwin@stripe.com
- SLWW 5y agoIt really makes you wonder what kind of optics they are looking through when coming up with these things. Literally no one (at least not the majority of individuals) wants this. It's one of those things that you expect a more shady company to release. Then again (and it's all hearsay mind you) that they are not a good company to work with, and when talking to employees who left, they don't seem like a good company to work for. Stick to CCs, that's intrusive enough.
- draw_down 5y agoI think it’s more “prove who you are in order to drive for Uber” and less “prove who you are in order to buy something on the internet”. The completion rates from the latter would be worse than just eating the fraud in probably most cases. We all want Uber to verify identity because paying for a ride with a complete anon is not the best idea.
- pedalpete 5y agoI think we'd be a perfect customer for this product, as we're in the consumer HaaS space, and one of the issues I've been made aware of by other HaaS companies is that they were getting subscriptions which would get the hardware, and then just disappear, resulting in a loss due to theft. I had been warned that stripe just wasn't set-up for this type of environment, but I think identity could really help. At the same time I'm VERY concerned that stripe has allowed the API to download the proof of identity. Just like I don't want to be managing customer credit cards, I don't want to manage customer identity documents either, and I don't want to upload my identity to a company that allows the documents to be downloaded. When I'm buying something on the internet, maybe I trust the company I'm buying from, maybe not but I know if they are using stripe, they never get my credit card number, so at most, they are able to only get away with the value of my purchase. My identity is another matter! If I trust stripe to manage my identity, that's probably ok. I don't think stripe should blanket allow their customers to download my identity. I get that perhaps some companies have this requirement, and I'd suggest that they need to be able to work with Stripe directly to enable this for them, but for every company that signs up with stripe to be able to download the identity file...it seems like a huge risk not worth taking.
- rognjen 5y agoIf you aren't government regulated, I'm not giving you my ID.
- mleonhard 5y agoI'm making a dating app. After sending a potentially-fraudulent user to a Stripe VerificationSession, I would like to send Stripe their other photos and find out how well they match the ID. Does Stripe have any plan to support that? Also, how long does the VerificationSession verified_outputs field remain accessible?