Hacker News Reader

Comment by boplicity | Hacker News Reader

I don't seem capable of actually setting up an account with Heztner and logging in. Their security is so tight, it seems to constantly lock me out. What if I were an actual customer? Yikes.

Does anyone else have this issue?

View on HN

Yep:

Dear Mr David Allison

After reviewing your updated customer information, we have decided to deactivate your account because of some concerns we have regarding this information. Therefore, we have cancelled all your existing products and orders with us.

Best regards

Your Hetzner Online Team

That's terrifying. Did they at least give you time to backup your data?

Please note that Hetzner does this only in couple cases: a) fake account data ; b) previous strikes (unpaid invoices, abuse etc..) with them ; c) in some cases customer is from country they do not do business with. I bet gazzilion OP above is within a or b

A) No B) No C) No

I got the same thing. My account was neither fake or had any previous strikes, it was a new account.

Their ToS also classifies Crypto-Mining, farming or plotting (whatever that is) as grounds for cancellation.

Also everything forbidden by German law results in a cancellation. So if you would have for example posted something before 2017 about a state leader that might seem like an insult your server might be gone. ( https://www.loc.gov/item/global-legal-monitor/2017-07-26/ger... )

https://cdn.hetzner.com/assets/Uploads/downloads/AGB-en.pdf Section 8.3

Make sure you avoid p2p stuff that scans for other servers on the hetzner network, too, even if it's legitimate and not infringing on copyright. They won't ban you right away, but their systems will detect it and give you 24h to confirm you're not infected with malware before shutting down the server. For IPFS or Bittorrent, you should be able to use it for legitimate purposes after blocking the local IPs.

d) the customer is black, romanian or a jew

I'm awaiting donwvotes, but honestly, if they don't give you a reason, everything can be one, and refusing a service on arbitrary grounds seems illegal to me :D

It's a private service; private companies can choose whoever they want to do business with. They're not a public service.

Are you sure about that? I know of a precedent in Poland, where a company refused to service (print some kind of invitation cards) some LGBT people, and was punished for it.

I imagine the laws in Germany are similar to the laws in Poland in that regard, both countries being in the European Union.

In USA, I really doubt any company could refuse to serve black people. Or women.

I wonder if the downvoters of my previous message share your (I'd say quite wrong) opinion or there's another reason for the downvotes - I'm up for a discussion!

I don't know about the downvotes, and I'm not a lawyer so take this with a grain of salt, but there's a difference between a service to the public (e.g. a café or a restaurant) and a service such as Hetzner.

No there is not, there is a difference between government services and private businesses but all private businesses play by the same rules

In Germany you are allowed to discriminate on all not protected factors.

protected factors are: race or ethnic background, gender, religion or belief, disability, age, or sexual orientation.

belief has a very high bar to meet, you are for example still allowed to discriminate against members of a political party.

discriminating based on location matching ip adress or not doing business with certain countrys is fully legal

I was evaluating them at the time. No data loss

Maybe you personally had no data loss, but I believe that the question was the more general "could other users in this situation expect to be able to recover their data?".

What? That sounds extremely unacceptable.

Can we get some context please, there must be a reason.

Were you able to backup first?

I created an account to evaluate them on Sun, 18 Jun 2023, 13:25 UTC. I verified my account on Sun, 18 Jun 2023, 13:29.

I received the above email entitled 'Rejection of Your account XXXXX' on Mon, 19 Jun 2023, 09:15.

I didn't follow up further. No backups required as I hadn't purchased anything

Literally this. Their staff won't provide any details, nor even a route towards a solution. When I asked what they suggest doing in this situation, they simply stopped responding.

Of course they don't. If they tell you why they have banned you, if you were a scammer, you'd know how they caught you and what to do better next time.

That's why none of the fraud prevention systems, be they at a tech company or a bank, tell you exactly why you've been banned/denied.

Any somewhat decent company would have an alternative, more rigid verification process to rely on when the basic one is insufficient. It doesn't require telling which part their doubts lie with. They do sometimes ask for an official ID, but apart from that...?

Either way their reasoning is flawed. An actual fraudster will simply keep trying and find out themselves, because they have nothing to lose. Therefore it's security through obscurity at best. Meanwhile legitimate customers/prospects suffer.

I had the inverse experience.

I setup 5 x $220/month servers and I wanted to make sure my payment method worked, contacted support a couple of times, wanted to make a prepayment or something.

No dice, they didn't want to take my money until the billing period closed, luckily everything worked fine.

It wasn't their cloud offering though, it was for the dedicated servers (Hetzner Robot), I don't know if that makes a difference.

I didn't ask to "take my money", just gave it to them forcibly by wire transfer, it showed up in my account all right.

Yup, I bought a dedicated server because I needed a CPU with AVX2 and VT-x, and it went poof some days later.

They didn't even do me the courtesy of emailing me to tell me about it, I had to ask support:

> > When I try to log in to my account it tells me that my credentials are invalid, and when I use forgot password it tells me that my account is disabled?

>We recently did some routine reviews of our customer accounts. We noticed some suspicious information in your account.

>We have some concerns regarding this information and we have decided to close your account.

>We do not share details about why certain accounts appear suspicious. Publishing this information would make it easier for people to create fake accounts and abuse our services.

I even went through their live-video face verification and passport scan and they didn't budge on this.

Were you an 'uncomplicated' customer i.e. from a country not associated with tons of online fraud, connecting plainly from a 'normal' ISP account (not a VPN, not using a browser cranked to the gills with privacy plugins) and using a conventional payment method registered to you at your address in the same country you were connecting from etc?

Yes. New Zealand.

Reply on news.ycombinator.com