Comment by KronisLV | Hacker News Reader

Comment by KronisLV | Hacker News Reader

Parent Full thread

Would have loved to use Hetzner, sadly they rejected a picture of my ID card/passport (with some details blacked out) a few years ago when i tried registering and verifying my identity, i don't think there was any process for appealing to have someone else look at it again, thus my account ended up being blocked. Of course, this is just 1 data point and i'm sure that the experience of other people is more positive in general!

That said, the prices actually look pretty competetive and are indeed cheaper than Scaleway's offerings. However, Scaleway also recently came out with more cost effective instances, called Stardust (though the specifications are somewhat limited): https://blog.scaleway.com/a-star-is-born-as-scaleway-launche...

Personally, i use Time4VPS for my VPSes, which is a somewhat small daughter company of a larger Lithuanian telecom (Interneto vizija). Affiliate link, if anyone is interested in having a look: https://www.time4vps.com/?affid=5294

I've been using them for a few years, the uptimes and the performance both are generally pretty good, can even self-host an e-mail server and the few IPv4 addresses i've had from them haven't been blacklisted anywhere. However, they don't directly compete with SaaS or PaaS like AWS's or Scaleway's managed offerings.

Why wouldn't they reject a ID/passport with some details blacked out?

They have proper support lines where one can call and ask. (At least this was so a couple of years ago, no need to call support since then..).

> Why wouldn't they reject a ID/passport with some details blacked out?

In my subjective opinion, a better question would be: Why would they reject an ID/passport with some details blacked out?

The ID card and the passport both have serial numbers on them, as well as sufficient information (issuer country and the institution within the country), that any decent implementation of validating such data should be able to look it up.

As for the blacked out fields - they contain information pertaining to my social identification code, one that should be kept private under most circumstances (analogous to social security number in the US). It feels like that information could:

- provide absolutely no benefit to them

- compromise my privacy, should it be leaked due to improper handling of that data on their end

If not providing such sensitive information is grounds for denying account verification and termination of an account, then i'm perfectly fine with that and will simply look elsewhere, for other services. Other people may disagree with that and provide any and all information, the handling of which they deem acceptable, which is okay (hence, i mentioned that others' experience might be more positive/successful in that regard).

Maybe someone who works in the industry (not Hetzner in particular) and has worked with similar systems in the past may comment on what the mechanisms for validating ID cards and such are, and which bits of data are necessary and which aren't?

I might go a further step, to:

1. Why does some webhost think it gets to ask for your passport?

Lol the second they get hacked you have a world class identity theft nightmare

Go to a host where asking for your most protected personal information isn't part of doing business. This is absolutely ridiculous

There are bad actors. I don't know details but suspect that passport requirements help with deterring them. If Hetzner gets a bad reputation it affects all their customers.

Nice that you have options which meet your wishes. But I like the way Hetzner is doing business (not to mention the great quality-price ratio which is hard to find elsewhere).

No kidding. Linode does a good job for cheap VPS machines, as do DigitalOcean and Vultr, and they don't feel the need to ask for identity documents. I haven't heard of big cloud providers (AWS, Azure, etc.) doing that either. Perhaps this is some quirk of German law? In any case, that would be an immediate reason not to do business with them.

When I ran a hosting provider, a small US-based one, we had to block most international signups simply because every one of them turned into a spammer. Abuse is a very, very big problem. They may have discovered that individuals from specific locations are generally troublesome and require stricter verification.

> Why wouldn't they reject a ID/passport with some details blacked out?

A better question is why would they? Sending an unredacted copy of my ID to some foreign company just to buy some hosting would seem crazy to me.

Here's a quote from their authentication email when I signed up a few years ago:

> As a new customer, we kindly request that you provide us with a copy (scan/photo) of your passport or ID card for authentication purposes. You can blur or block out information that is not necessary for authentication.

I sent in a picture of my driver's license with everything except my photo, name, and address blacked out, and they approved it. (In hindsight I'm not even sure why I didn't black out the photo part.)

I stand corrected with them mentioning blur/block in the authentication email (this was not the case earlier). But anyhow, what is for you "some foreign company" and "some hosting" is for them "some customer" which most likely is nice/friendly but there are exceptions.

Reply on news.ycombinator.com