6 ms·

I honestly find it weird having all of these things suddenly want a copy of my passport in the cloud just sitting there waiting to be hacked in years to come wh

I honestly find it weird having all of these things suddenly want a copy of my passport in the cloud just sitting there waiting to be hacked in years to come when the security measures drop. At this point there is giant databases containing everything people need to take complete control of your identity sitting there just waiting to be hacked. I have no idea how to change it/fix it. But it seems weird to me.

emdowling 5y ago
You've nailed the complexity of this. On privacy, people are rightfully spooked about this for all the reasons you've mentioned. On safety, people are really happy about these initiatives as accounts backed by user identity are less likely to be used for harm. On security, leaks of these databases create issues to other sites and companies (eg: if Company X is compromised, then identity documents could be used to disable/bypass 2FA for Bank Y). To make it even more complicated, regulators often hold contradictory views. They want to see increased safety, but in the same breath will announce actions against companies for violating privacy. This is a super-difficult balance to strike. Specifically for Stripe, I trust them. So if I see that a new start-up is using them rather than rolling their own solution, that increases my trust. But it means there is now a big giant server in the cloud with millions (billions?) of identity documents that is worth a lot of money for hackers.
- agwa 5y ago
  > Specifically for Stripe, I trust them. So if I see that a new start-up is using them rather than rolling their own solution, that increases my trust Note that Stripe allows their customers access to the "captured images of the ID document, selfies, extracted data from the ID document, keyed-in information"[1]. So you still have to trust any company using Stripe not to download, store, and later leak your personal information, and you also have to trust them not to let their Stripe API token be compromised and exploited by identity thieves. [1] https://support.stripe.com/questions/managing-your-id-verification-information#data-access https://support.stripe.com/questions/managing-your-id-verifi...
- truffdog 5y ago
  > Specifically for Stripe, I trust them The problem with this is that the user isn't trusting Stripe today, they are trusting Stripe today, and all future Stripe managers and owners until the user dies and no longer cares. That's a big bet! Bad CEOs and sales happen.
- wolverine876 5y ago
  > people are really happy about these initiatives as accounts backed by user identity are less likely to be used for harm Has anyone told you they are really happy about it? I haven't heard someone say that. Most users have no idea about it.
lotsofpulp 5y ago
The fix is for the government to make it a service. Right now, the government is punting responsibility to private actors who do not have the legal tools to operate an identity service. The government already operates an identity service via passports. The only reason they do not have an electronic identity service yet is because it is beneficial for them to be able to blame private actors when things go wrong.
- specialist 5y ago
  This is The Correct Answer™. Misc governments already operate 1,000s of identity, credentialing, and licensing services. Wouldn't it be great if profiles on DoorDash, Yelp, Hotels, etc. were required to be linked to IRL identities and licenses?
  - nkohari 5y ago
    I suppose it depends on how much you want ~all of your online activity to be attributed to your real identity, in such a way that could be easily examined by the government.
    - specialist 5y ago
      Authenticity and anonymous speech are not mutually exclusive. Stop pretending they are.
      - d110af5ccf 5y ago
        You are the only one who mentioned speech, "online activity" is what was referred to. You specifically suggested linking profiles to government identification. "Linking" wouldn't seem to leave much room for anonymity regardless of activity.
        specialist 5y ago
        What's online activity if not speech? If DoorDash has a fake profile for D111af5ccf's Divine Donuts, is that not a crime? Impersonation, fraud, theft of IP, etc. Again, how does authenticity conflict with free speech? Examples, please.

emdowling 5y ago

You've nailed the complexity of this. On privacy, people are rightfully spooked about this for all the reasons you've mentioned. On safety, people are really happy about these initiatives as accounts backed by user identity are less likely to be used for harm. On security, leaks of these databases create issues to other sites and companies (eg: if Company X is compromised, then identity documents could be used to disable/bypass 2FA for Bank Y). To make it even more complicated, regulators often hold contradictory views. They want to see increased safety, but in the same breath will announce actions against companies for violating privacy. This is a super-difficult balance to strike. Specifically for Stripe, I trust them. So if I see that a new start-up is using them rather than rolling their own solution, that increases my trust. But it means there is now a big giant server in the cloud with millions (billions?) of identity documents that is worth a lot of money for hackers.

agwa 5y ago
> Specifically for Stripe, I trust them. So if I see that a new start-up is using them rather than rolling their own solution, that increases my trust Note that Stripe allows their customers access to the "captured images of the ID document, selfies, extracted data from the ID document, keyed-in information"[1]. So you still have to trust any company using Stripe not to download, store, and later leak your personal information, and you also have to trust them not to let their Stripe API token be compromised and exploited by identity thieves. [1] https://support.stripe.com/questions/managing-your-id-verification-information#data-access https://support.stripe.com/questions/managing-your-id-verifi...
truffdog 5y ago
> Specifically for Stripe, I trust them The problem with this is that the user isn't trusting Stripe today, they are trusting Stripe today, and all future Stripe managers and owners until the user dies and no longer cares. That's a big bet! Bad CEOs and sales happen.
wolverine876 5y ago
> people are really happy about these initiatives as accounts backed by user identity are less likely to be used for harm Has anyone told you they are really happy about it? I haven't heard someone say that. Most users have no idea about it.

lotsofpulp 5y ago

The fix is for the government to make it a service. Right now, the government is punting responsibility to private actors who do not have the legal tools to operate an identity service. The government already operates an identity service via passports. The only reason they do not have an electronic identity service yet is because it is beneficial for them to be able to blame private actors when things go wrong.

specialist 5y ago
This is The Correct Answer™. Misc governments already operate 1,000s of identity, credentialing, and licensing services. Wouldn't it be great if profiles on DoorDash, Yelp, Hotels, etc. were required to be linked to IRL identities and licenses?
- nkohari 5y ago
  I suppose it depends on how much you want ~all of your online activity to be attributed to your real identity, in such a way that could be easily examined by the government.
  - specialist 5y ago
    Authenticity and anonymous speech are not mutually exclusive. Stop pretending they are.
    - d110af5ccf 5y ago
      You are the only one who mentioned speech, "online activity" is what was referred to. You specifically suggested linking profiles to government identification. "Linking" wouldn't seem to leave much room for anonymity regardless of activity.
      - specialist 5y ago
        What's online activity if not speech? If DoorDash has a fake profile for D111af5ccf's Divine Donuts, is that not a crime? Impersonation, fraud, theft of IP, etc. Again, how does authenticity conflict with free speech? Examples, please.