News for hackers. Stuff that matters.

A comment on Stripe Identity. Parent comment

Re:Stripe Identity by openthc on Monday June 14, 2021 @03:32PM (#27507137)
Right but -- the attack vector is different. Scan/parse 10000s of JPG, and all that jazz -- to get identites. Not Trivial. Or if the hotel stored the copy as a physical photo copy -- you're not bulk scanning 10k pieces of parchment at super speed for your identity-theft ring.

But download JSON blobs? From 10k records the hotel didn't store properly (cause they are not IT experts, or don't have experts at close hand) -- if you get in to their system the JSON is loads easier to parse than the JPEG.

Methods for KYC could(should!) be improved.

[ Parent | on HN ]
Re:Stripe Identity by tevonsb96 on Monday June 14, 2021 @03:45PM (#27507333)
But like one of the Identity team folks said, the hotel would only have the OPTION to download and store those blobs. They aren't required to, and I'm assuming they would not. They'd be happy with the verification result and letting Stripe handle storing the PII.

Speaking from experience as we use Stripe Identity, and love not having to store the PII.

[ Parent | on HN ]