6 ms·

But at a fundamental level, why do Discord and Clubhouse need to verify my identity? I don't think the question GP is asking is whether or not Stripe is a good

But at a fundamental level, why do Discord and Clubhouse need to verify my identity? I don't think the question GP is asking is whether or not Stripe is a good way to confirm someone's real-life identity, or whether it would be better for the government to do it. I think what they're asking why we're doing identity verification for chat applications. Is this a good direction overall for the Internet to be moving in? I don't like the idea that I should have one real-life identity that every service I sign up for online knows, even trivial services like social networks. I would argue a world like that is abridging on people's Right to Hide (https://anewdigitalmanifesto.com/#right-to-hide https://anewdigitalmanifesto.com/#right-to-hide)

lotsofpulp 5y ago
Who is “we”? Maybe the people operating the chat app have determined that it is in their businesses’ best interest to verify identity. I can certainly see it reducing costs for the business. I am not suggesting all businesses be required to do it. But I do not see why businesses should be prohibited from doing it. If you do not want an identity linked service, then buy a website name, and start a business and do not require people to identify.
- danShumway 5y ago
  "We" in this context means the overall population of users on the web, including non-corporate users and individuals who are exercising their freedoms online. We can't justify every architecture decision about the web via only business costs, if that was the case we'd make adblockers illegal and deprecate HTML. You need a stronger argument if you want me as a user to care about or support your business interests. If you want my support you have to show how this benefits the web overall, not just your company.
  - lotsofpulp 5y ago
    Is this a discussion about the architecture of the web? Or about specific websites? If Costco wants me to login to their website to buy things, or Facebook wants me to use real identity, that does not stop me from using alternatives that do not. Am I entitled to alternatives that do not verify identity? Maybe the operating costs are too high?
    - danShumway 5y ago
      Your proposal is for a government-run identity verification system. The "we" in this context (ordinary users) also comprise the majority of voters and regulators who will ultimately decide how the system you propose is built and what restrictions it will have; and that is a group that is not solely motivated by your business interests -- so it is kind of important for you to be able to convince them that your system benefits them, and not just a few businesses. Why should a Congressperson vote to build the system you propose instead of introducing a harsh privacy law that restricts which businesses are allowed to collect identification?
      - lotsofpulp 5y ago
        I think we can do both. Or at least restrict what a business can do with identification information that is mandatory, such as not being able to use it for marketing purposes or sold, and have it be temporary.
    - Nextgrid 5y ago
      > Facebook wants me to use real identity We're already living in a world where you have to "login with Facebook" to do many things, but at the very least you can currently still create a fake account if you have no other option. If reliable identity verification starts becoming commonplace, that option goes away.
  - Kiro 5y ago
    > why do Discord [..] need to verify my identity? > the overall population of users on the web You keep arguing about a non-issue. Normal users do not need to verify with Discord. It's only for bot owners of popular bots to prevent the widespread abuse Discord saw. https://news.ycombinator.com/item?id=27505905 https://news.ycombinator.com/item?id=27505905
    - danShumway 5y ago
      I disagree that bot developers should be placed in a separate category from normal users, and I disagree that 100 servers is a meaningful place to draw the line that Discord is drawing. The linked comment is incorrect to say that Discord only requires verification for specific permissions, Discord requires verification for bots who are in more than 100 servers regardless of what permissions they use. I think it's fairly obvious that verification for Discord bots is going to gradually expand and encompass more of the service, but maybe I'm just cynical from watching other companies do the same thing with their identity verification schemes. More importantly, I disagree that identity verification is the best way for Discord to combat abuse. I think that Discord's moderation tools and server settings are lackluster. At best, I think identity verification is a an easy way for them to avoid improving those tools, at the cost of user privacy. I don't think your comment changes anything about what I'm saying in regards to Discord, but regardless, I also want to point out that it's not just Discord we're talking about: we are seeing a trend towards more services online requiring real-world identities. So we can fight over whether Discord in specific should be grouped in with that trend (I think it should be), but even if you disagree on that point, it still seems pretty clear to me how Stripe's service is going to be used in the future. Do you feel identity verification is also a non-issue for services like Clubhouse and Facebook? I think the fact that Stripe is advertising both Discord and Clubhouse as early partners says a lot about the types of services they think are going to be attracted to their product.
      - Kiro 5y ago
        I think you're being too dogmatic about this. For me it's a perfectly valid use case for identity verification. It prevents a big problem and only affects an extremely tiny subset of users.
cardine 5y ago
> But at a fundamental level, why do Discord and Clubhouse need to verify my identity? Because of credit card fraud. I've run services where >5% of attempted transactions were done using stolen credit cards. So we used services that determine the risk of a transaction being fraudulent, and if the risk was too high, we required identity verification. The alternative was to reject those transactions outright and permanently lose those customers, which is terrible when there is a false positive. If credit card fraud is high, it doesn't matter whether you are a chat app or a bank app.
- danShumway 5y ago
  It sounds like you're asking for a payment verification system, not an identity verification system. Does Discord need to know my identity, or does it need to know that my card hasn't been stolen? If it's the latter, then I'm unsure why Stripe is offering the business access to my passport/license, and I'm unsure why we would want to build a government ID system for Discord instead of a government payment system.
- Nextgrid 5y ago
  Credit card fraud can be solved by other means though. 3D-Secure for example will offload the liability to the bank. The proper way to do it is to either enforce 3D-Secure or offer passport as an option when 3DS is unavailable, but because ID verification is getting easier and cheaper with services such as this one, there will be no reason to spend extra engineering time to implement solutions such as this one when you can just ask for everyone's passports especially when this also allows you to use the data for marketing purposes or be able to reliably ban "undesirable" people (and "undesirable" in this case doesn't mean "bad" or "illegal", it could simply be someone who uses an ad-blocker or doesn't "engage" with dark patterns like the company wants them to).
- supertrope 5y ago
  The bank should handle KYC. Mastercard and Visa forbid requiring ID. Handing PII opens up the customer to "identity theft" fraud which is much worse than having to cancel a credit card.
ZainRiz 5y ago
I suspect that those places need to verify your identity if they want to pay you money (e.g. you're accepting tips on clubhouse). There are a ton of legal requirements around you having to verify a person's identify before sending them money. These laws are often put in place to avoid money laundering, etc. I doubt they'd require every single user to go through the friction of verifying their identity.
movedx 5y ago
> Discord and Clubhouse need to verify my identity? Discord are doing it for verifying bot ownership, because bots can do a lot of damage if they're just free to sign up to Discord and start "talking" to people. A good way of omitting bad bots from the network is by verifying and tying the bot to the (verified) identity of a real person. I run a server with 1,200 people on it - I've never needed to verify my identity. You don't need to verify your identity for using Discord.
- danShumway 5y ago
  > A good way of omitting bad bots from the network is by verifying and tying the bot to the (verified) identity of a real person. Is it? I am much less charitable than you about whether Discord's bot verification is intended purely for user safety or whether it's a combination of laziness and a way of slowly clamping down control over how users access the service, how it can be extended, and what services/clients can interop. I disagree that 100 servers is a particularly large number for a popular bot to join, but more importantly I think the threat model you describe illustrates a deeper problem with Discord overall. If the issue is that bots can sign up to Discord and just start talking to people, that's a permissions issue. Why can bots do that? And why is it OK for bots to keep doing that as long as they're in fewer than 100 servers? So sure, we can have an extremely invasive form of verification, but we could also just... not let bots join random servers in the first place. We're jumping straight to real-life identification in a system that doesn't even support granular control over invites. In my opinion Discord's moderation and user-vetting tools are basically non-existent, so I am at least a little bit skeptical about whether verification is a completely necessary tradeoff between security and privacy.
  - d110af5ccf 5y ago
    I agree with your sentiment, but I don't even understand what the rationale for singling out bots is. A user of the service is either causing problems for others or not. Whether that user happens to be a bot doesn't seem relevant to me. HN does quite well without requiring anything other than an IP address. So does Mastodon. And mailing lists generally have no way of knowing even that!
toomanybeersies 5y ago
> But at a fundamental level, why do Discord and Clubhouse need to verify my identity? For the same reason that Facebook required proof that you were a college student. A platform with a barrier to entry and a degree of exclusivity (but not too exclusive), will tend to have higher quality content and interactions than an anonymous forum that anybody (and anybot) can join. Whether it's a good direction for the internet to be moving in, I have no idea. But it's certainly good business, which naturally makes me suspect it's the wrong trajectory.
Avamander 5y ago
> But at a fundamental level, why do Discord and Clubhouse need to verify my identity? Maybe not those two, but your bank does, your insurance company does, your employer does, your business partner does. There's a lot of places where there's trust placed in a specific citizen and their identity. The "root of trust" of being a citizen is the government, it'd be nothing new really to provide that digitally. The proof of it being doable are the governments providing electronic ID's for decade or two now. Solving those really hairy problems hundreds of millions of Americans are struggling or encumbered by daily.

lotsofpulp 5y ago

Who is “we”? Maybe the people operating the chat app have determined that it is in their businesses’ best interest to verify identity. I can certainly see it reducing costs for the business. I am not suggesting all businesses be required to do it. But I do not see why businesses should be prohibited from doing it. If you do not want an identity linked service, then buy a website name, and start a business and do not require people to identify.

danShumway 5y ago
"We" in this context means the overall population of users on the web, including non-corporate users and individuals who are exercising their freedoms online. We can't justify every architecture decision about the web via only business costs, if that was the case we'd make adblockers illegal and deprecate HTML. You need a stronger argument if you want me as a user to care about or support your business interests. If you want my support you have to show how this benefits the web overall, not just your company.
- lotsofpulp 5y ago
  Is this a discussion about the architecture of the web? Or about specific websites? If Costco wants me to login to their website to buy things, or Facebook wants me to use real identity, that does not stop me from using alternatives that do not. Am I entitled to alternatives that do not verify identity? Maybe the operating costs are too high?
  - danShumway 5y ago
    Your proposal is for a government-run identity verification system. The "we" in this context (ordinary users) also comprise the majority of voters and regulators who will ultimately decide how the system you propose is built and what restrictions it will have; and that is a group that is not solely motivated by your business interests -- so it is kind of important for you to be able to convince them that your system benefits them, and not just a few businesses. Why should a Congressperson vote to build the system you propose instead of introducing a harsh privacy law that restricts which businesses are allowed to collect identification?
    - lotsofpulp 5y ago
      I think we can do both. Or at least restrict what a business can do with identification information that is mandatory, such as not being able to use it for marketing purposes or sold, and have it be temporary.
  - Nextgrid 5y ago
    > Facebook wants me to use real identity We're already living in a world where you have to "login with Facebook" to do many things, but at the very least you can currently still create a fake account if you have no other option. If reliable identity verification starts becoming commonplace, that option goes away.
- Kiro 5y ago
  > why do Discord [..] need to verify my identity? > the overall population of users on the web You keep arguing about a non-issue. Normal users do not need to verify with Discord. It's only for bot owners of popular bots to prevent the widespread abuse Discord saw. https://news.ycombinator.com/item?id=27505905 https://news.ycombinator.com/item?id=27505905
  - danShumway 5y ago
    I disagree that bot developers should be placed in a separate category from normal users, and I disagree that 100 servers is a meaningful place to draw the line that Discord is drawing. The linked comment is incorrect to say that Discord only requires verification for specific permissions, Discord requires verification for bots who are in more than 100 servers regardless of what permissions they use. I think it's fairly obvious that verification for Discord bots is going to gradually expand and encompass more of the service, but maybe I'm just cynical from watching other companies do the same thing with their identity verification schemes. More importantly, I disagree that identity verification is the best way for Discord to combat abuse. I think that Discord's moderation tools and server settings are lackluster. At best, I think identity verification is a an easy way for them to avoid improving those tools, at the cost of user privacy. I don't think your comment changes anything about what I'm saying in regards to Discord, but regardless, I also want to point out that it's not just Discord we're talking about: we are seeing a trend towards more services online requiring real-world identities. So we can fight over whether Discord in specific should be grouped in with that trend (I think it should be), but even if you disagree on that point, it still seems pretty clear to me how Stripe's service is going to be used in the future. Do you feel identity verification is also a non-issue for services like Clubhouse and Facebook? I think the fact that Stripe is advertising both Discord and Clubhouse as early partners says a lot about the types of services they think are going to be attracted to their product.
    - Kiro 5y ago
      I think you're being too dogmatic about this. For me it's a perfectly valid use case for identity verification. It prevents a big problem and only affects an extremely tiny subset of users.

cardine 5y ago

> But at a fundamental level, why do Discord and Clubhouse need to verify my identity? Because of credit card fraud. I've run services where >5% of attempted transactions were done using stolen credit cards. So we used services that determine the risk of a transaction being fraudulent, and if the risk was too high, we required identity verification. The alternative was to reject those transactions outright and permanently lose those customers, which is terrible when there is a false positive. If credit card fraud is high, it doesn't matter whether you are a chat app or a bank app.

danShumway 5y ago
It sounds like you're asking for a payment verification system, not an identity verification system. Does Discord need to know my identity, or does it need to know that my card hasn't been stolen? If it's the latter, then I'm unsure why Stripe is offering the business access to my passport/license, and I'm unsure why we would want to build a government ID system for Discord instead of a government payment system.
Nextgrid 5y ago
Credit card fraud can be solved by other means though. 3D-Secure for example will offload the liability to the bank. The proper way to do it is to either enforce 3D-Secure or offer passport as an option when 3DS is unavailable, but because ID verification is getting easier and cheaper with services such as this one, there will be no reason to spend extra engineering time to implement solutions such as this one when you can just ask for everyone's passports especially when this also allows you to use the data for marketing purposes or be able to reliably ban "undesirable" people (and "undesirable" in this case doesn't mean "bad" or "illegal", it could simply be someone who uses an ad-blocker or doesn't "engage" with dark patterns like the company wants them to).
supertrope 5y ago
The bank should handle KYC. Mastercard and Visa forbid requiring ID. Handing PII opens up the customer to "identity theft" fraud which is much worse than having to cancel a credit card.

ZainRiz 5y ago

I suspect that those places need to verify your identity if they want to pay you money (e.g. you're accepting tips on clubhouse). There are a ton of legal requirements around you having to verify a person's identify before sending them money. These laws are often put in place to avoid money laundering, etc. I doubt they'd require every single user to go through the friction of verifying their identity.

movedx 5y ago

> Discord and Clubhouse need to verify my identity? Discord are doing it for verifying bot ownership, because bots can do a lot of damage if they're just free to sign up to Discord and start "talking" to people. A good way of omitting bad bots from the network is by verifying and tying the bot to the (verified) identity of a real person. I run a server with 1,200 people on it - I've never needed to verify my identity. You don't need to verify your identity for using Discord.

danShumway 5y ago
> A good way of omitting bad bots from the network is by verifying and tying the bot to the (verified) identity of a real person. Is it? I am much less charitable than you about whether Discord's bot verification is intended purely for user safety or whether it's a combination of laziness and a way of slowly clamping down control over how users access the service, how it can be extended, and what services/clients can interop. I disagree that 100 servers is a particularly large number for a popular bot to join, but more importantly I think the threat model you describe illustrates a deeper problem with Discord overall. If the issue is that bots can sign up to Discord and just start talking to people, that's a permissions issue. Why can bots do that? And why is it OK for bots to keep doing that as long as they're in fewer than 100 servers? So sure, we can have an extremely invasive form of verification, but we could also just... not let bots join random servers in the first place. We're jumping straight to real-life identification in a system that doesn't even support granular control over invites. In my opinion Discord's moderation and user-vetting tools are basically non-existent, so I am at least a little bit skeptical about whether verification is a completely necessary tradeoff between security and privacy.
- d110af5ccf 5y ago
  I agree with your sentiment, but I don't even understand what the rationale for singling out bots is. A user of the service is either causing problems for others or not. Whether that user happens to be a bot doesn't seem relevant to me. HN does quite well without requiring anything other than an IP address. So does Mastodon. And mailing lists generally have no way of knowing even that!

toomanybeersies 5y ago

> But at a fundamental level, why do Discord and Clubhouse need to verify my identity? For the same reason that Facebook required proof that you were a college student. A platform with a barrier to entry and a degree of exclusivity (but not too exclusive), will tend to have higher quality content and interactions than an anonymous forum that anybody (and anybot) can join. Whether it's a good direction for the internet to be moving in, I have no idea. But it's certainly good business, which naturally makes me suspect it's the wrong trajectory.

Avamander 5y ago

> But at a fundamental level, why do Discord and Clubhouse need to verify my identity? Maybe not those two, but your bank does, your insurance company does, your employer does, your business partner does. There's a lot of places where there's trust placed in a specific citizen and their identity. The "root of trust" of being a citizen is the government, it'd be nothing new really to provide that digitally. The proof of it being doable are the governments providing electronic ID's for decade or two now. Solving those really hairy problems hundreds of millions of Americans are struggling or encumbered by daily.