Comment by aeorgnoieang | Hacker News Reader

Comment by aeorgnoieang | Hacker News Reader

Parent Full thread

> Why do I care about how a site keeps records of payments?

I think you might want to care because that's a basic requirement of any legal business (or non-profit) pretty much anywhere.

The service is also time-limited. Would you pay some amount for images to be hosted for a limited time? That seems like a perfectly valid decision.

It may not be feasible to accept anonymous payments or accept credit card payments without at least an email address.

Also, services like this must necessarily 'bundle' their specific products, e.g. hosting individual images in the case of this site. The transaction costs, e.g. credit card payment processing fees, preclude charging too small amounts.

Maybe it would be possible to avoid requiring an email address, but then I'd expect they'd have to use your credit card 'fingerprint' as an account/user identifier. But I'm skeptical that any credit card processors would allow that, especially given the possibility (and likelihood) that people will upload illegal images like child pornography.

B.s., how does protonmail/vpn let me create accounts without a prior email? They do sms verification or arbitrary donation for antifraud. Yes, like an expiring paste, i don't care if an image i shared expires after a while. This site and many others accept btc payment. It is also a growing trend to allow guest checkouts without registration. A business needs to keep records but that is a backend problem,you can record individual transactions with unique IDs and be done with it. Unless you're in finance you don't need to track users (money laundering)

Also, an email or other means for the service to contact you, the user, is necessary for account recovery. Building a SaaS product without any efficient way to recover a lost password is silly. It leads to a ton of customer service headaches.

No it is not! You do not need and should not use email for password recovery. Ok, let's say you do that, what happens when you have 2FA? Both factors of authentication will be thwarted if your email is compromised? That is ridiculous! There are practical and simple solutions (such as recovery tokens, push notifications,etc...). Look, I don't you realize how often people's email gets compromised and how many intermediaries read and log email bodies. There are efficient ways. I mean ffs, do you need a valid email to sign up for email providers?? How do they handle resets? There arr many ways. The only thing worse than email is "secret" questions.

Reply on news.ycombinator.com