HN user

rosasalberto

65 karma

Problem Solver. AI & Identity & Blockchain. Co-CEO of Didit https://github.com/rosasalberto

Posts2
Comments20
View on HN

Totally agree. That low-end device gap is exactly where the most sophisticated fraud hides.

Honestly, the "fundamental" fix for the adversarial stuff is just a really tight feedback loop. We lean hard into monitoring—combining customer feedback with internal outlier signals—so we can analyze shifts in real-time. Once we identify a pattern, it’s just about speed.

Sometimes an update means a full AI model retrain, other times it’s just a quick logic or product tweak. In this space, if you can’t iterate faster than the fraudsters, you’ve already lost. (which is the problem of 99% of the companies in the space, they are not able to detect fraud, and if they detect it and they want to push a fix, is already too late)

It’s not public yet — the identity wallet is still in private beta.

The idea is that users control their identity. They create a Didit account where they can verify themselves, add credentials, revoke connections, or delete everything at any time. We don’t store raw biometrics or documents in the wallet layer — only derived attributes like estimated_age, is_human, is_unique, or a face embedding used for matching.

Services request specific scopes (similar to “Sign in with X”), like is_over_18 or is_human, and the user explicitly approves what gets shared.

On age detection: it’s mainly for low-risk age-gating (social, gaming, adult content, etc.), where asking every user for an ID kills conversion. For higher-risk cases you’d still use full ID verification.

I don't have the full context on the Persona/Discord story yet, but our philosophy is that identity providers should be a shield, not a source of risk.

We address this by building privacy-preserving architectures that minimize the data footprint. First, we offer secure, long-term retention so companies don't have to store sensitive PII on their own servers—which are often managed by teams who aren't cybersecurity specialists.

Second, and more importantly, we provide granular data control. Our customers can select exactly which fields they need to keep (e.g., just Name, DOB, and Country) and set the system to automatically purge sensitive assets like ID photos immediately after verification. It’s about ensuring that only the absolute minimum amount of data necessary ever exists in the system.

This is a great point. In Didit you can already configure this kind of flexibility. For example, you can set rules like “if email/phone = X, skip ID verification” or route the user through a different flow.

We also built a case management system so support teams can manually review cases, approve/decline them, or override decisions when needed. Automation handles most cases, but humans can step in for the edge cases.

There is many direct competitors in the space, the main ones are Persona, Jumio, Incode, Sumsub, and even orchestrators like Alloy.

In general I believe we just built a better product:

- Fastest verification on the market (inference time < 2s, well optimized infra, we do real time checks (for example when you do the front scan of the ID, we do the checks real-time, instead of waiting for the user to do the back, like persona does, and takes > 30 s, ours is less < 2 s).

- Optimized onboarding rate worldwide, global coverage, any country, low connectivity and every device accepted, and optimized (different models loading in the client depending on the speed ..etc, and many more tricks)

- Fraud detection (we analize > 200 signals, to detect fraud in real time, from IP analysis, device fingerprinting, replay attacks, deepfakes ...) we got experts on that, and we act quickly if we see new attack vectors appear.

- Developer experience (self-service, pay per usage, API first). You can start doing verifications without needed to use the UI (everything programatic), and integrate in few minutes.

- Flexible, you can create any identity flow with your own rules. You can enable features with just 1 click, no need to reintegrate.

- Pricing model (pay per usage, no monthly minimums, no enterprise gated, and low prices)

We actually agree with the core concern.

Right now the internet has a terrible model where every company asks for your ID and stores it themselves. That means your identity data ends up scattered across dozens of databases.

We think the future is privacy-preserving identity and reusability: verify once, keep your identity in your own wallet, and only share minimal proofs (e.g. “over 18” or “real human”) instead of your full identity every time.

That’s the direction we’re building toward with SSI / identity wallets and reusable verification.

Stripe builds great products, including identity. But it’s not a specialized identity platform.

A few differences: - Limited global document coverage (not all IDs or countries supported). https://docs.stripe.com/identity - No advanced workflow orchestration for complex identity flows - Missing features like NFC chip verification - Pricing similar to traditional IDV vendors (expensive)

Stripe Identity works well inside the Stripe ecosystem, but companies that need more flexible, global identity infrastructure usually look for specialized solutions.

Stripe Identity is good, especially if you already use Stripe.

The main difference is that Stripe built identity mostly for their payments ecosystem, while Didit is a standalone identity infrastructure that works across any platform and any identity flow.

We also optimized heavily on fraud detection, speed, and much better pricing.