Comment by woofie11 | Hacker News Reader

Comment by woofie11 | Hacker News Reader

Parent Full thread

My experience too.

ALWAYS have a lifetime free plan. It's okay to make it a useless lifetime free plan (your data disappears every 2 weeks; you have a 3 email per day quota; etc.). It just need to be enough to seriously evaluate your product, and if it has APIs, to develop to them. There are sometimes good reasons to do more, and sometimes not. But that's the minimum.

In the early days of AWS, I would build thing on AWS' free tier, and they turned into products later. One product is making AWS millions (literally). AWS lost out when I changed orgs, my one-year free tier quota was gone, and I couldn't do the same at future orgs.

At big organizations, the overhead of a PO is sufficient that you don't do it unless you have a compelling business case. Free plan allows you to build a business case over a weekend.

I've gone free->paid many times.

It's worth noting the figures here. The case for a free plan is much more compelling for a Fortune 500 company who will sign a million-dollar contract than for a small business.

Me experience is the exact opposite.

As a user:

- If I need the service and only intend to use it for a very small project, I love forever free plans. Because I know I can subscribe use your server time and forget my account forever. I often subscribe with a temp email so that I don't even receive your emails anymore.

- If I seriously need the service and is ready to pay for it, I don't really care about the free forever plan vs free trial vs paid trial.

As a business:

- Any time I have offered a free forever plan, basically 95% of the created accounts are dormant free accounts (like I personally am when I find the correct tool to scratch my itch). 4% are from people (usually from south east asia) creating hundreds/thousands of accounts (sometimes manually !) to circumvent the free plan limitations instead of just paying for the service. And 1% are from legitimate users/customers.

- People in the 95 and 4% categories still believe they are owed support. And if you don't give them an easy way to let them contact you, they now have twitter and facebook and business reviews websites to get to you. On top of emails, LinkedIn messages and yes, phone calls.

- Cutting the free accounts has almost no impact on real customers acquisition. You can let people experience your product with a temporary trial, that includes support and way more features, but behind the credit card screen. Extend the free trial as much as needed if people ask for it through your usual support channel. You will still get abusers but those are easier to detect, because they need to provide some payment details which are harder to fake, and after you shut them down for the third time in a row, they usually go away.

> Any time I have offered a free forever plan, basically 95% of the created accounts are dormant free accounts (like I personally am when I find the correct tool to scratch my itch).

What's the issue? Unused account shouldn't be a big spending. If it become one, take a bit of time to change it a bit (delete data/stop service after a set amount of inactivity) and use that occasion to send them an email that remind them that your service exist.

How do you feel about a free-forever plan behind a credit card screen?

Google Cloud is this way: stay below their free usage limits for some services and you'll never need to pay; but you need to give them your card up-front because it's a post-paid service and they need to ensure they can charge you if-and-when you do go over those limits.

Or, for another approach: how about a plan that's free, but where there's a small one-time fee on signup, regardless of the plan you choose? (You can be upfront to your users and tell them it's a KYC measure, if you like.)

Or, how about a free service, but gated with a real KYC/AML process on signup (of the "sign in through your bank" or "upload your driver's license to this third party" variety.)

Any of these approaches, IMHO, would filter out the 4% of spammers; and also act as a barrier to anyone who isn't serious about eventually trying the service — while not being as much of a barrier to people like the GP poster, who take five months to get around to testing a service before becoming a diehard fan of it, and don't want to be paying for those five months, but also look in apprehension at the idea of possibly having to spend time trying to get their (as-yet-unused) trial extended.

This might work in a B2B relationship but as an individual, there is no site on earth that is getting me to give you my bank account or driver's license info as part of a "free" or "trial" plan.

Maybe. MAYBE. I'll give you a credit card number since I know I can always dispute/chargeback if you turn out to be dishonest. No way do you get anything that can't be 100% undone within a few minutes.

> give you my bank account or driver's license info as part of a "free" or "trial" plan.

Re: bank accounts, nobody was suggesting that, that's not how KYC systems work. Re: driver's license info, that's not quite how (well-implemented, modern) KYC flows work, either.

For "signing up using your bank", I wasn't talking about giving the service a photo of a void cheque or anything; I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider, through a SAML broker.

I don't know if this is common anywhere else, but in Canada we have a pretty popular SAML SSO broker doing this (https://securekey.com/) ; it allows you to use all our major banks as SSO authentication agents (works with both web and mobile-app flows); and this SSO method is in use for many government sites (e.g. it's how you log in to file your taxes, pay federal student loans, etc.) Any (Canadian) business can actually add SSO to their site/app through this broker. And, just like with any other (good) SSO method, the app being signed into through the SSO broker doesn't receive your credentials.

Re: driver's license info, with regular KYC flows, you don't upload your driver's license info to the first party. Instead, you're directed to a trusted neutral third party (the KYC/AML provider), who has their own app; you give your credentials to that service, through its own app, which is essentially the account-creation flow for your account with that service; and then the first-party service you were interacting with SSOs you through the KYC service as an OAuth/OIDC flow.

I'm not familiar enough with SSO flows to be able to quantify any kind of risk, but it makes me very uneasy when things interconnect with my bank. Everything always seems secure until it isn't.

I don't mean to spread FUD, it just seems needlessly risky to make banks the central point of auth.

It really isn't/ shouldn't be.

In theory, the bank is really incentivized to provide proper and secure authentication (if someone can impersonate you to your bank, you're kinda screwed anyway). So, it only makes sense to trust a bank to provide the authentication service. One should realize that SSO integration with a bank doesn't mean 3rd party has any sort of access to the bank - it' just means that you authorize your bank to tell a 3rd party "yes, I believe this is really curryst"). Doesn't increase the attack surface for you - it only increases the "blast radius" if someone successfully compromises your bank account. But that one is typically already a dire situation.

It does increase the risk for you, the same way using Google or Facebook account does.

Once the bank won't authenticate you for some reason, all the accounts bound to this SSO provider also go the way of dodo.

> I was talking about doing Single Sign-On into the service, with your bank acting as the SSO (usually SAML) provider

Personally, I use my bank only for banking and would never ever consider using them as an SSO provider. They handle my money, I don't want them to handle anything else or have any more information about me than they already do. Also, in my personal experience, the banks aren't very technologically competent, so the less they are expected to do, the better.

What's your use case for the "one time fee"? Is this a barrier to prevent bad actors?

I can easily see use cases where someone without buying power can get a 50, maybe even 100 USD bond or 'license' of some sort PROVIDED that there's either only one or even more ideally a set of competitors who's "not a bad actor" licenses are interoperable; and work on the whole Internet for that task (without expiring until bad karma is dinged).

However no, nickle and dime-d to death, as well as those 'free but remember to cancel' plans, are the exact reason I'd never hand over real billing info until I'm serious about being billed.

The one-time fee is an e-stamp, basically. It makes having N identities N times as expensive as having one. It's one of the oldest anti-spam suggestions, from before spam filters were invented.

What you're talking about with that "license" is exactly what you get by everybody relying on a small set of KYC providers; except that the KYC provider doesn't charge you for registration, but instead requires a Proof-of-Stake in some state's legal system (i.e. a set of documents that require laborious up-front proofs to acquire, such that it's very hard to acquire two sets of them, but which can be used to validate identity freely once issued.)

KYC providers that just charge $100 instead of requiring a Proof-of-Stake challenge exist, too. That's essentially the (secondary?) purpose of businesses that will only trade with other incorporated businesses (or, to abstract that away, only with businesses that have a Dun & Bradstreet DUNS number): it costs $100 to incorporate, or to register one of those numbers, so you have to be at least $100 of serious to bother them, and you can't just keep spending hundred-dollar-bills forever to keep generating new identities to DDoS someone.

What I haven't heard of, interestingly, is a KYC provider that requires a proof of work. Something like "solve a thousand Captchas to create an account." Or a formalized version of the old "take a photo of yourself holding up today's newspaper." But that'd be totally workable as well.

I treat 'free but remember to cancel' plans as scams.

About 10 months ago I got emails from a company that developed an development environment that was I was mildly interested in. They presented an offer with said it was free so that people could help educate themselves during lockdown. Unfortunately the terms was after 1 year you needed to pay something like $1500 if you didn't cancel, these terms were right at the bottom of the page and very hard to spot. Paid through PayPal and the about $1500 was there right in front of me. I cancelled it on the same day.

A company offering that sort of deal waiting for people not to cancel and saying it is to help people during the lockdowns is just awful.

This sounds like a case of a free plan makes sense when the target for the free plan is someone without purchasing authority looking for leverage.

> Would you rather have 10 users that pay $100 monthly, or 1,000 users that pay $1?

I think this question is meant as an illustration but perhaps it hints at a rule of thumb. Let me substitute a different question and see what you think:

Do you want 1000 users paying $500 a month, or 5 million users paying a $1 a month?

5 million suggests a broad but shallow appeal to the app, and I don't doubt at all that the author has seen customers exhibit all of the listed behaviors - and more. But perhaps an application with a narrow but deep appeal makes sense with a free tier. You can always expand the appeal of your product to reach more markets once you have a proven track record and word of mouth working for you.

I would also say that at a minimum, if you don't let people test drive your application, you have to be quite skilled at creating demos and walkthroughs, and encourage third parties to do the same. Growing that kind of talent in house is probably too slow and unreliable. You're going to have to pay for at least one person to give you good advice.

> This sounds like a case of a free plan makes sense when the target for the free plan is someone without purchasing authority looking for leverage.

Well, that. Or somebody with leverage trying to reduce risks before jumping into a platform. Or somebody evaluating the options before deciding. Or somebody just making something the quickest way possible, leaving slow decisions for later...

There are many cases that fit the same sequence. They do impose different requirements on the free tier, but I don't think you'll ever measure them well enough to discover what is what.

> Or somebody evaluating the options before deciding. Or somebody just making something the quickest way possible, leaving slow decisions for later...

This is exactly it. I've been both with and without purchasing authority.

WITH purchasing authority, at many organizations, I still need paperwork and approvals. To give an extreme example, try working for an EU government agency....

My patterns definitely fit the ones described. 95% of the time, I create an account, and nothing comes of it:

* I try five tools, and pick one.

* I try five tools, and pick zero.

* I do a weekend hackathon, and there is no business case

* I do a weekend hackathon, there is a business case, but yours isn't the right product

... etc.

But 5% of the time, there's a conversion, and with big orgs, quite often a big $$$ conversion. Those 95% cost you nearly nothing, or act as discovery (I rarely make a support call, but if I do make one, it's valuable to you).

As a footnote, in many industries, you give actual, physical products which cost $$$ for free (e.g. an IC) for this reason. Some of these do put up gateways to make sure I'm from a place which might go from 1 sample to buying 10,000 (or an ed institution). I don't think those are a good fit, but I do think it's possible (and not too difficult) to screen out abuse in most cases.

> My patterns definitely fit the ones described. 95% of the time, I create an account, and nothing comes of it:

You don't need a free-forever plan to make those decisions, in these cases, just a sufficiently long timed-trial.

... assuming I never work on another project again, switch jobs, or fail to get around to evaluating your tool during the two weeks.

I've exhausted enough 2-week trials to know.

And at the same time, I'm hesitant to start them, since once they're gone, they're gone. You want minimal friction. Two clicks, and I'm using your tool. Yes, lower friction decreases your conversion rate, but that's because more people who aren't sure will try your tool.

Reply on news.ycombinator.com