7 ms·

Does Stripe intend to make a giant online database of international identity documents? Why should we trust Stripe to secure these? It could be Equifax levels o

Does Stripe intend to make a giant online database of international identity documents? Why should we trust Stripe to secure these? It could be Equifax levels of problematic if there would be a intrusion, but I also can't tell how Stripe plans to use this information.

rokobobo 5y ago
I never wanted Equifax to have any of my data, and yet here we are. After the breach, I wouldn’t ever be a paying customer to them if I had a choice. (Indirectly, I am still a “customer” in the sense that they probably still have my data and get new data about me—but apart from canceling all my cards, not sure what choice I have). In comparison, Stripe seems to charge for each product it offers. I think that’s a more fair and transparent model.
- f38zf5vdt 5y ago
  If the company you're interacting with uses Stripe ID verification and you are forced to use it to pay them, I'm not sure it's much better than going to a bank and opening an account and then Equifax getting the information immediately.
- tchalla 5y ago
  > In comparison, Stripe seems to charge for each product it offers. I think that’s a more fair and transparent model. They could be charging you AND creating an international ID database.
- NegativeLatency 5y ago
  For equifax you’re the product, not the customer
- falcolas 5y ago
  You are not a credit bureau's customer - the stores, public utilities, cell phone companies, banks, and so forth, are. They share that information to minimize their risk in extending credit (even something like billing you at the end of the month for services rendered is a form of credit) to you. And frankly, if Stripe is offering any form of credit, it's likely working with the credit unions too.
- franciscop 5y ago
  Vote for representatives that pass laws similar to the GDPR but for USA? If Equifax or you were EU-liable, you could ask them to show, modify or remove any and all of your data.
- rokobobo 5y ago
  Edit (sorry, I don't think I can edit my own comment at this point): I think I was missing the point. Storing user data for 3 years after verification seems unnecessary for the user. So yes, it does sound like some data-mongering f*ckery is going to happen/is happening.
______- 5y ago
> It could be Equifax levels of problematic if there would be a intrusion I'm sure they're not as lax as Equifax. I would hope that Stripe compartment all these documents so that a compromise of one database is not a compromise of the whole database. That's basic data storage hygiene in the information age. `Don't put all your eggs in one basket` as the saying goes.
- f38zf5vdt 5y ago
  I think the Estonian e-Card scheme is the right one despite hiccups in its implementation and ID verification should be the domain and responsibility of governments. Each ID card has an embedded private key-public key pair and you can sign to reveal your identity without having to resort to giving away anything else about yourself. There is already a zero-risk way for customers to verify themselves, so giant ID databases are a step backwards.
  - dante_dev 5y ago
    Many other countries in Europe can do it as well. The electronic identity cards of Austria, Belgium, Estonia, Finland, Germany, Italy, Liechtenstein, Lithuania, Portugal and Spain all have a digital signature application which, upon activation, enables the bearer to authenticate the card using their confidential PIN. Consequently they can, at least theoretically, authenticate documents to satisfy any third party that the document's not been altered after being digitally signed. This application uses a registered certificate in conjunction with public/private key pairs so these enhanced cards do not necessarily have to participate in online transactions. [0] https://en.wikipedia.org/wiki/National_identity_cards_in_the_European_Economic_Area https://en.wikipedia.org/wiki/National_identity_cards_in_the...
  - zyx321 5y ago
    Germany has an electronic ID card that can be used to certify identity, or only age, or only uniqueness, for a few pennies per auth. There's an app that lets you use your Android phone as a scanner, paired over wifi. Yet I've never seen any company use it. Everyone uses slower, more expensive private services that don't ask any questions about what you're going to do with the data they collect.
edwinwee 5y ago
No. 1. Stripe cares tremendously about and knows the importance of security—we’ve learned a lot from securely processing hundreds of billions of dollars in payments annually, and Identity is built from those learnings. (https://stripe.com/docs/security/stripe https://stripe.com/docs/security/stripe). 2. Any biometric identifiers that are created to perform the verification are never stored or retained—they are fully removed from all of our systems within 48 hours (usually within minutes). More on this at https://support.stripe.com/questions/managing-your-id-verification-information#data-storage https://support.stripe.com/questions/managing-your-id-verifi....
- f38zf5vdt 5y ago
  > We will typically store the rest of your submitted identity information for 3 years. This includes all images captured, extracted data from your ID document including name, date of birth, and ID number, and any information submitted via forms such as name, date of birth, SSN, email, and phone number, and the verification response. That doesn't make me feel a lot better. :( The images are enough to generate biometric data such as facial recognition profiles.
  - edwinwee 5y ago
    We are very specific about collecting consent before doing anything with your data. We ask for permissions before beginning the verification process, and if you consent, we will only use your biometric identifiers for the verification itself. (And again, those identifiers—which contain the most sensitive info—aren't stored.) Specifically, we ask for an additional level of permissions before conducting any additional biometric analysis. https://support.stripe.com/questions/common-questions-about-stripe-identity#verification-consent https://support.stripe.com/questions/common-questions-about-...
    - oefrha 5y ago
      I think you might be missing the point. I'm sure gp does not doubt that you collect consent before collecting and using data. However, when presented with the choice of not giving up personal data and not using $awesome_service (or maybe even $essential_service), I’d imagine all but a very tiny percentage of people would reluctantly give up personal data. The data is then stored for three years, and if there's ever a leak, it would be hugely damaging given the scope: > all images captured, extracted data from your ID document including name, date of birth, and ID number, and any information submitted via forms such as name, date of birth, SSN, email, and phone number, and the verification response.
rejectedandsad 5y ago
Stripe hires elite Stanford grads unlike Equifax is the simplest answer they probably wouldn’t say publicly. But the pedigree and engineering talent is miles better.
- oefrha 5y ago
  Being a Stanford grad myself, I wouldn’t put too much trust into Stanford grads, or <any elite university> grads.
  - rejectedandsad 5y ago
    In what sense? Looking at incoming classes it’s apparent you people are objectively superior to people like me before college than I am several years after. It’s almost definitely innate too, all the more depressing for strivers-turned-failures/underachievers like myself. The Stanford thing was really the basis for Palantirs competitive advantage in the consulting space over companies like Booz Allen Hamilton etc.
- objclxt 5y ago
  There isn’t a correlation between graduating from Stanford and being able to write secure code. If there was, all black-hats would be coming from Ivy League schools. They’re not.
  - wolverine876 5y ago
    > There isn’t a correlation between graduating from Stanford and being able to write secure code. Nor is there a correlation between Stanford degrees and wanting to write secure code.
tootie 5y ago
These databases already exist. Typically the way it works is after you claim an identity, they will look up past addresses, phone numbers or employers then present multiple choice questions asking which one is part of your past. The companies I've seen that do these are not hosting (or claim to not host) any of the data, but rather have hooks to fetch it from financial institutions. I think it's mostly credit bureaus, but could also be banks.
nightpool 5y ago
These databases already exist. For example, all driver's licenses issued in a state are part of the public record, and many companies already maintain databases of them. For example, you can sign up for an account with the NY DMV that allows you to search all DMV records, as long as your use falls within one of a dozen permissible use-cases (including "To verify the accuracy of information submitted by the individual to the business"). Identity documents are designed to be verifiable, which in this case generally precludes them from being secret
- akie 5y ago
  > These databases already exist. That doesn't matter.
jtsiskin 5y ago
Remember Stripes main offering - credit card data. They are already PCI compliant
imhoguy 5y ago
I don't think they are going to beat Facebook in this race.
arthur_sav 5y ago
Seriously. The only way i would trust such a thing is if i have complete control over my data and how it's used (that's probably never gonna happen from a for-profit imo)

rokobobo 5y ago

I never wanted Equifax to have any of my data, and yet here we are. After the breach, I wouldn’t ever be a paying customer to them if I had a choice. (Indirectly, I am still a “customer” in the sense that they probably still have my data and get new data about me—but apart from canceling all my cards, not sure what choice I have). In comparison, Stripe seems to charge for each product it offers. I think that’s a more fair and transparent model.

f38zf5vdt 5y ago
If the company you're interacting with uses Stripe ID verification and you are forced to use it to pay them, I'm not sure it's much better than going to a bank and opening an account and then Equifax getting the information immediately.
tchalla 5y ago
> In comparison, Stripe seems to charge for each product it offers. I think that’s a more fair and transparent model. They could be charging you AND creating an international ID database.
NegativeLatency 5y ago
For equifax you’re the product, not the customer
falcolas 5y ago
You are not a credit bureau's customer - the stores, public utilities, cell phone companies, banks, and so forth, are. They share that information to minimize their risk in extending credit (even something like billing you at the end of the month for services rendered is a form of credit) to you. And frankly, if Stripe is offering any form of credit, it's likely working with the credit unions too.
franciscop 5y ago
Vote for representatives that pass laws similar to the GDPR but for USA? If Equifax or you were EU-liable, you could ask them to show, modify or remove any and all of your data.
rokobobo 5y ago
Edit (sorry, I don't think I can edit my own comment at this point): I think I was missing the point. Storing user data for 3 years after verification seems unnecessary for the user. So yes, it does sound like some data-mongering f*ckery is going to happen/is happening.

______- 5y ago

> It could be Equifax levels of problematic if there would be a intrusion I'm sure they're not as lax as Equifax. I would hope that Stripe compartment all these documents so that a compromise of one database is not a compromise of the whole database. That's basic data storage hygiene in the information age. `Don't put all your eggs in one basket` as the saying goes.

f38zf5vdt 5y ago
I think the Estonian e-Card scheme is the right one despite hiccups in its implementation and ID verification should be the domain and responsibility of governments. Each ID card has an embedded private key-public key pair and you can sign to reveal your identity without having to resort to giving away anything else about yourself. There is already a zero-risk way for customers to verify themselves, so giant ID databases are a step backwards.
- dante_dev 5y ago
  Many other countries in Europe can do it as well. The electronic identity cards of Austria, Belgium, Estonia, Finland, Germany, Italy, Liechtenstein, Lithuania, Portugal and Spain all have a digital signature application which, upon activation, enables the bearer to authenticate the card using their confidential PIN. Consequently they can, at least theoretically, authenticate documents to satisfy any third party that the document's not been altered after being digitally signed. This application uses a registered certificate in conjunction with public/private key pairs so these enhanced cards do not necessarily have to participate in online transactions. [0] https://en.wikipedia.org/wiki/National_identity_cards_in_the_European_Economic_Area https://en.wikipedia.org/wiki/National_identity_cards_in_the...
- zyx321 5y ago
  Germany has an electronic ID card that can be used to certify identity, or only age, or only uniqueness, for a few pennies per auth. There's an app that lets you use your Android phone as a scanner, paired over wifi. Yet I've never seen any company use it. Everyone uses slower, more expensive private services that don't ask any questions about what you're going to do with the data they collect.

edwinwee 5y ago

No. 1. Stripe cares tremendously about and knows the importance of security—we’ve learned a lot from securely processing hundreds of billions of dollars in payments annually, and Identity is built from those learnings. (https://stripe.com/docs/security/stripe https://stripe.com/docs/security/stripe). 2. Any biometric identifiers that are created to perform the verification are never stored or retained—they are fully removed from all of our systems within 48 hours (usually within minutes). More on this at https://support.stripe.com/questions/managing-your-id-verification-information#data-storage https://support.stripe.com/questions/managing-your-id-verifi....

f38zf5vdt 5y ago
> We will typically store the rest of your submitted identity information for 3 years. This includes all images captured, extracted data from your ID document including name, date of birth, and ID number, and any information submitted via forms such as name, date of birth, SSN, email, and phone number, and the verification response. That doesn't make me feel a lot better. :( The images are enough to generate biometric data such as facial recognition profiles.
- edwinwee 5y ago
  We are very specific about collecting consent before doing anything with your data. We ask for permissions before beginning the verification process, and if you consent, we will only use your biometric identifiers for the verification itself. (And again, those identifiers—which contain the most sensitive info—aren't stored.) Specifically, we ask for an additional level of permissions before conducting any additional biometric analysis. https://support.stripe.com/questions/common-questions-about-stripe-identity#verification-consent https://support.stripe.com/questions/common-questions-about-...
  - oefrha 5y ago
    I think you might be missing the point. I'm sure gp does not doubt that you collect consent before collecting and using data. However, when presented with the choice of not giving up personal data and not using $awesome_service (or maybe even $essential_service), I’d imagine all but a very tiny percentage of people would reluctantly give up personal data. The data is then stored for three years, and if there's ever a leak, it would be hugely damaging given the scope: > all images captured, extracted data from your ID document including name, date of birth, and ID number, and any information submitted via forms such as name, date of birth, SSN, email, and phone number, and the verification response.

rejectedandsad 5y ago

Stripe hires elite Stanford grads unlike Equifax is the simplest answer they probably wouldn’t say publicly. But the pedigree and engineering talent is miles better.

oefrha 5y ago
Being a Stanford grad myself, I wouldn’t put too much trust into Stanford grads, or <any elite university> grads.
- rejectedandsad 5y ago
  In what sense? Looking at incoming classes it’s apparent you people are objectively superior to people like me before college than I am several years after. It’s almost definitely innate too, all the more depressing for strivers-turned-failures/underachievers like myself. The Stanford thing was really the basis for Palantirs competitive advantage in the consulting space over companies like Booz Allen Hamilton etc.
objclxt 5y ago
There isn’t a correlation between graduating from Stanford and being able to write secure code. If there was, all black-hats would be coming from Ivy League schools. They’re not.
- wolverine876 5y ago
  > There isn’t a correlation between graduating from Stanford and being able to write secure code. Nor is there a correlation between Stanford degrees and wanting to write secure code.

tootie 5y ago

These databases already exist. Typically the way it works is after you claim an identity, they will look up past addresses, phone numbers or employers then present multiple choice questions asking which one is part of your past. The companies I've seen that do these are not hosting (or claim to not host) any of the data, but rather have hooks to fetch it from financial institutions. I think it's mostly credit bureaus, but could also be banks.

nightpool 5y ago

These databases already exist. For example, all driver's licenses issued in a state are part of the public record, and many companies already maintain databases of them. For example, you can sign up for an account with the NY DMV that allows you to search all DMV records, as long as your use falls within one of a dozen permissible use-cases (including "To verify the accuracy of information submitted by the individual to the business"). Identity documents are designed to be verifiable, which in this case generally precludes them from being secret

akie 5y ago
> These databases already exist. That doesn't matter.

jtsiskin 5y ago

Remember Stripes main offering - credit card data. They are already PCI compliant

imhoguy 5y ago

I don't think they are going to beat Facebook in this race.

arthur_sav 5y ago

Seriously. The only way i would trust such a thing is if i have complete control over my data and how it's used (that's probably never gonna happen from a for-profit imo)