News for hackers. Stuff that matters.
Re:Stripe Identity by cardine on Monday June 14, 2021 @03:00PM (#27506732)
> But at a fundamental level, why do Discord and Clubhouse need to verify my identity?

Because of credit card fraud. I've run services where >5% of attempted transactions were done using stolen credit cards. So we used services that determine the risk of a transaction being fraudulent, and if the risk was too high, we required identity verification.

The alternative was to reject those transactions outright and permanently lose those customers, which is terrible when there is a false positive.

If credit card fraud is high, it doesn't matter whether you are a chat app or a bank app.

Re:Stripe Identity by danShumway on Monday June 14, 2021 @03:10PM (#27506868)
It sounds like you're asking for a payment verification system, not an identity verification system.

Does Discord need to know my identity, or does it need to know that my card hasn't been stolen? If it's the latter, then I'm unsure why Stripe is offering the business access to my passport/license, and I'm unsure why we would want to build a government ID system for Discord instead of a government payment system.

Re:Stripe Identity by Nextgrid on Monday June 14, 2021 @03:17PM (#27506956)
Credit card fraud can be solved by other means though. 3D-Secure for example will offload the liability to the bank.

The proper way to do it is to either enforce 3D-Secure or offer passport as an option when 3DS is unavailable, but because ID verification is getting easier and cheaper with services such as this one, there will be no reason to spend extra engineering time to implement solutions such as this one when you can just ask for everyone's passports especially when this also allows you to use the data for marketing purposes or be able to reliably ban "undesirable" people (and "undesirable" in this case doesn't mean "bad" or "illegal", it could simply be someone who uses an ad-blocker or doesn't "engage" with dark patterns like the company wants them to).

Re:Stripe Identity by supertrope on Monday June 14, 2021 @04:39PM (#27508004)
The bank should handle KYC. Mastercard and Visa forbid requiring ID. Handing PII opens up the customer to "identity theft" fraud which is much worse than having to cancel a credit card.