launch Codename: Identity Proxy as a joint venture

[chadwhitacre]

Gratipay needs a way to verify national identity for our users, in order to be a good global financial citizen (see gratipay/inside.gratipay.com#119 ff.).

This introduces a fair amount of information security risk, as it involves storing personally identifiable information, including national identity numbers and documents (think: passport scans). At a minimum, then, it makes sense from an architectural point of view to implement this as a separate service from Gratipay.com itself: we want to build a vault that implements PCI-DSS, and it'd be great not to have to bring all of Gratipay under PCI-DSS.

There are other companies besides Gratipay that may also be interested in such a service, such as Bountysource (cc: @wkonkel @rappo), Liberapay (cc: @Changaco), and OpenCollective (cc: @xdamman). If there is enough interest, we could discuss building and launching this service jointly as a point of collaboration.

As a joint venture, Identity Proxy would be a consumer-facing app that would basically bridge national identity into OAuth. Consumers who upload their passport to Identity Proxy would be able to share their information with participating companies via Identity Proxy instead of having to upload sensitive information multiple times. We'd be retailing services such as Trulioo, Jumio, etc.

Any other companies interested in collaborating on this?

[Changaco]

It's an interesting idea that would benefit both users and payment services, but it might not be so easy to convince identity verification services that it would be good for them too.

The plan for Liberapay is to have MangoPay handle identity verification for us, you should try reaching out to them.