8 ms·

Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stri

• poorman 5y ago
  >Considering that Stripe's original selling point was that it let websites accept credit card payments without seeing your credit card number I thought that Stripe's original selling point was that you could easily accept payments online without having to integrate with complicated bank and payment processor tech.
  • agwa 5y ago
    As I understood it at the time, alternatives required PCI compliance, which Stripe allowed you to sidestep thanks to tokenization, so I do believe that was a selling point. But this is besides the point I'm making, so I've edited my comment.
• nrmitchi 5y ago
  > Considering that Stripe's original selling point was that it let websites accept credit card payments without seeing your credit card number This is true, but it's also kind of a misleading statement; the original selling point was that you could accept credit cards without having to deal with the requirements of PCI compliance and merchant accounts, which is done (partially) by you not ever seeing the card data. If there was similar compliance regulation around document storage, I would assume that Stripe would use "Identity-Document-Standards" compliancy as a selling point. As far as I know, there are no such requirements. I do think your #2 point though is exceptionally valid, and would hope that the majority of Stripe keys are scoped to not even provide access to this data/endpoints. Edit: grammar
• echopom 5y ago
  It's unfortunate , I'm an Enterprise Architect in Banking and honestly I wouldn't have let that feature go in production. Businesses that do not have a legitimate reason to view my sensitive document like Passport , should not be allowed to do so. Only authorized institutions like Licensed Payment Institution / Banks / Insurances etc... should be allowed to do so and AFTER they've been approved. It's sad because you can tell right away that this will we be abused by Stripe's customers inadvertently. Just like Uber "God View" thats you view any customer ride... Pretty sure the amount of "Identity Theft" or "Privacy" Scandal is going to explode with such technology available for everyone. I don't know how a product manager at stripe could tell himself that "Yes , it make sense to give access to sensitive documents" in an age where people are seeking more privacy.
  • OJFord 5y ago
    But, also as an Enterprise Architect in Banking, if you were considering Stripe Identity wouldn't you rely on it for KYC compliance? You can't just say Oh we outsource that to a third-party called Stripe, can you?
    • echopom 5y ago
      That's not my point , here my point is very clear and straightforward. Some people at Discord now have access at the pictures of my Passport that I uploaded during the verification process because they use "Stripe Identity". The FAQ is very clear , Stripe give you full access to those documents. It should NEVER do so. Now the very smart people have Discord have access to my passport they can now take a 50K Loan using my documents and face-check video , social security and some fake income documents. They can also destroy my entire life because I maintain a political blog with views they don't really like that they consider "hate speech". These are exaggerated examples , but you get the idea. I'm concerned by this , because more and more startups are going to use it to increase the value of their userbase to reduce fraud and look more attractive for their planned exit. In the meantime, people having access to my personal documents is going to go exponential... Again , I'm an Architect in Banking we have 500+ Partners selling Loan for us , they have NEVER access to your documents / personal data. They can only tell if the document has been approved , income range and some basic information. You don't know what they are going to do those sensitive documents / info , even if you have contractual agreement with them. Banking industry has had a very simple rule that everyone has been following for decade : DON'T TRUST THIRD PARTY. Stripe has decided to do otherwise I guess and I'm pretty scared about it. Stripe Identity seems like Identity Theft as a Service.
• edwinwee 5y ago
  Edwin from Stripe here. The two cases are actually very similar. If you want to avoid ID documents ever being stored on your servers, Identity makes it easy to do that. (Just as Elements/Stripe.js makes that easy for card numbers.) On the other hand, if you want to score card numbers or ID documents (and there are sometimes good reasons for doing this!), Stripe makes that straightforward.
  • prague60 5y ago
    Conflating credit card #'s and personal biometrics/SSNs is your first mistake. You think they are the same, they feel the same, but the risk to the customer is so much bigger. When a hotel copies my passport, they get a jpg. If they use Stripe, now I know they have my biometrics serialized to JSON. That feels way riskier and scarier to me, especially now that it's all centralized by Stripe. We hear about our personal data getting leaked and hacked every day, and here is Stripe making themselves an enormous target and serializing all the data for malicious actors. This feels like a really tone deaf misstep by the company.
    • tomc1985 5y ago
      It is trivially easy to key-in identity info from a JPG scan They are both toxic, IMO. Businesses need to stop relying on this stuff.
      • openthc 5y ago
        Right but -- the attack vector is different. Scan/parse 10000s of JPG, and all that jazz -- to get identites. Not Trivial. Or if the hotel stored the copy as a physical photo copy -- you're not bulk scanning 10k pieces of parchment at super speed for your identity-theft ring. But download JSON blobs? From 10k records the hotel didn't store properly (cause they are not IT experts, or don't have experts at close hand) -- if you get in to their system the JSON is loads easier to parse than the JPEG. Methods for KYC could(should!) be improved.
        • tevonsb96 5y ago
• mLuby 5y ago
  I wonder if instead Stripe could have routed calls through itself, filling in the secret info. Perhaps it was discussed? For example, imagine Joe Biden buys a widget from WidgetsR.us and wants it shipped to his home address of 1600 Penn Ave in DC. WidgetsR.us -> Fedex.com/order_XYZ/ship-to/Joe Biden at 1600 Penn Ave in DC WidgetsR.us <- Fedex.com "201 CREATED" Instead they could route through Stripe (where 123_joe corresponds to Joe Biden's identity docs in Stripe), which fills in the missing info. WidgetsR.us -> Stripe.com/identity/123_joe?redirect=Fedex.com/order_XYZ/ship-to/$NAME at $ADDRESS Stripe.com -> Fedex.com/order_XYZ/ship-to/Joe Biden at 1600 Penn Ave in DC Stripe.com <- Fedex.com "201 CREATED" WidgetsR.us <- Stripe.com '"201 CREATED"' That way WidgetsR.us never knew the $NAME or $ADDRESS of user 123_joe, but was still able to use them. (Yes, they could send that info to themselves, but then they're on the hook for protecting it.) The huge downside here is putting Stripe in your business's critical path. But if it's already there for payments, then why not for identity?
• alexchamberlain 5y ago
  I suspect most (if not all) KYC regulations require you to keep the evidence you used to verify the identity - even landlords in the UK are required to keep the evidence they saw of your right to live in the UK, let alone any institution that actually needs to prevent fraud etc. I suspect it's just a basic requirement of selling such a service to most medium-large businesses.
  • agwa 5y ago
    You're probably right about KYC, but KYC is just one of the four use cases presented by Stripe, and their customer logos include Clubhouse and Discord, which I highly doubt have KYC requirements or any need to access the underlying evidence. Stripe could do this differently: 1. Allow the customer to choose whether or not they need access to the evidence. 2. If customer has chosen to receive access to the evidence, the Stripe Identity UI should clearly disclose this. (And they shouldn't try to deceive users by talking about deleting biometric identifiers.) 3. Require customers with access to evidence to adhere to certain security standards, similar to how they treat exports of credit card numbers: https://stripe.com/docs/security/data-migrations/exports#where-we-can-export-to https://stripe.com/docs/security/data-migrations/exports#whe... Stripe could have been a leader in setting high standards on how this type of information is handled. Instead they've opted to go the easy route and maximize profits while the rest of us pay the negative externalities from identity theft.
    • alexchamberlain 5y ago
      I think this is a very fair assessment of a better approach, which allows it where necessary, but not by default.
• pc 5y ago
  (Stripe cofounder.) > Considering that Stripe was originally known for letting websites accept credit card payments without seeing your credit card number, one might assume that Stripe Identity only allows websites to see the verification result, and not your selfies and scans of your identity documents. A few points: - Fundamentally, Identity makes it possible to choose how much of this data traverses / is stored on your servers, just as Stripe did with card numbers. - There's a basic difference between card numbers and identity verification. With card numbers, you (generally) don't really care about the number -- you just want the payment. With ID verification, however, many businesses have good reason to want more than just the verification result. For example, they are often subject to compliance requirements that mandate that they themselves possess or have access to the raw information. They may need or wish to perform additional checks on their side. Etc. - The relevant UI in Identity is deliberately very clear on this points in order to avoid the assumption you're stating. The flow explicitly says "Stripe and [Business] may each use your data." Even though an end user might consider it suboptimal for the business to have their data, we still view it as an improvement to the usual status quo, where this data is frequently stored in very ad hoc fashion and without rigorous security protections. - While many of the businesses initially building on Identity wanted access to the raw information, it may well make sense for us to enable them to restrict themselves in the future. In this world, Stripe could tell their customers that the business doesn't have access to the raw details. (This might even make sense for Stripe payments in the future.) As a philosophical matter, we consider ourselves to serve the business, which means that limiting access to what we consider to be the business's own information feels a bit strange. That said, it might sometimes be in the interests of the business to allow them to limit themselves in this fashion (especially as Stripe's brand recognition among consumers grows). - There's a separate concern about compromise of the business's credentials leading to inadvertent disclosure of this information (a situation analogous to an S3 bucket key getting leaked). This is of general concern to us in lots of situations, not just with Identity. We have some new functionality on the way here.
  • agwa 5y ago
    Thanks for your reply. > Fundamentally, Identity makes it possible to choose how much of this data traverses / is stored on your servers, just as Stripe did with card numbers. There's a stark difference in how Stripe treats exports of card numbers versus exports of raw identity verification data. This makes it way easier, and more likely, for Stripe customers to choose to store raw identity verification information. > With ID verification, however, many businesses have good reason to want more than just the verification result. For example, they may be subject to compliance requirements that mandate that they themselves possess or have access to the raw information. They may need or wish to perform additional checks on their side. Etc. I acknowledge that some businesses have a need for this. But I see Discord and Clubhouse among your customer logos, and your product page talks about non-KYC use cases. Many of your customers will have access to identity documents without really needing it. That sucks for the end users of Stripe Identity, because it makes it more likely their data will be misused. A concrete suggestion: make it possible for businesses to choose whether they have access the raw data, and expose the choice to the end user in the Stripe Identity flow. Ideally, businesses that want the raw data would be subject to security compliance requirements. This is an opportunity for Stripe to be a leader in setting high standards on how this type of data should be handled.
• nati0n 5y ago
  Certainly a market for this sort of thing, but agree, dangerous privacy management.
• edwinwee 5y ago
  Just an update on this—we've some changes in flight. Accessing sensitive verification results like date of birth, extracted document numbers, or collected images will soon require the use of restricted API keys. (More at https://stripe.com/docs/identity/verification-sessions#results https://stripe.com/docs/identity/verification-sessions#resul....) Thanks again for your feedback. I'll shoot you an email to chat more too.