Hacker News Reader

Comment by crote | Hacker News Reader

When I was moving my server to a new hoster Hetzner was on the top of the list, but they refused me as a customer.

As it was going to host (among other things) my mail server, I could not use my primary (self-hosted) email address - because that's asking for trouble if I ever run into issues. It seems using Protonmail triggered something on their side.

They asked me for a copy of my ID card, which I happily provided. But they still refused my account, without explanation. Oh well, their loss. I've been at OVH now for a few years without any issues. OVH's product is definitely worse, but at least they'll actually let you use them.

View on HN

hi there, I am very sorry that we could not approve your account. We also do not publish a list of things that may or may not make your account accidentally appear fake. So I can't confirm whether or not it was the Protonmail or something else that may have triggered a review of your account. I am very sorry for the lack of transparency on this. I understand that it is frustrating and disappointing to be rejected as a customer. We are purposefully non-transparent about what triggers a review of new accounts. Why? If we published a list like this, it would very quickly become much easier for scammers and spammers to create realistic-looking accounts that they could use to abuse our products, and naturally, we don't want that. I glad that you have found another provider who could use to host your mail server. --Katie

This level of account paranoia (which is infamous at this point; it's one of the primary things mentioned every time Hetzner comes up) is one of several reasons why Hetzner is doomed to be a second-rate provider. If you have a credit card, you can get an AWS account. I've never provided any kind of ID to any American hosting provider. They wait until after you've done something bad to ban you.

It's more expensive to provide AWS-type "assume you can be trusted" service at a low-cost provider - and Hetzner is one of the lowest-cost big providers.

Low-cost attracts more fraudulent customers, using stolen credit card numbers. Hosting is particularly bad for this compared with other low-cost services, because of the community of people who want to use rented servers for DDOS and such, ideally without paying or being tied to a real identity.

It also attracts people who will do a card chargeback if the server isn't what they wanted or after they've used it for some temporary event. Some people don't appreciate that chargebacks are expensive for the low-cost supplier, and some people don't care.

Low-cost also means the penalty cost of credit card chargebacks is a higher proportion of income, even if the number of them was the same. It might be so much higher that the business couldn't be profitable at the prices it offers if it didn't aggressively filter which customers it takes on.

Could some "insurance", paid extra, be a solution to this? As in saying to Hetzner, hey, I'm a legitimate consumer, willing to pay extra for, say, a year, so that you do some additional checks (EDIT: in advance) and/or switch me to a better tier of more relaxed "fraud detection", offering some hot line, like between Russian and American generals, to help avoid any accidental, hm, deletions?

Or would that just not scale?

Exactly! Ask me to prepurchase some amount of resources (say $20 upfront) + limit my capabilities early-on until first invoice.

I’m not sure if reading this response made me feel better or worse.

Clearly if you are rejecting legitimate customers for arbitrary reasons there’s still some work to do on your approval process.

I mean, I get that there are bad actors, and that it’s rationally better for Hetzner to have false positives than false negatives. But it just feels wrong. Legitimate customers shouldn’t be rejected until they prove they’re malicious.

- "They asked me for a copy of my ID card,"

That's their courteous treatment. They asked me to consent to an AI scanning my face!

edit: Specifically with this startup,

https://www.idenfy.com/identity-verification-service/

I worked for them a couple of years ago. I can confidently say that as of 2 years ago, the only thing images of your face would've been used for is verifying if it's an actual human face (e.g. not a photo, mask, etc.) and performing a facial match with the photo on your document. Also, at least 2 years ago every identification flow had a human review, to weed out false positives and negatives. I'm fairly certain that these things have stayed the same, as the guys running it are a good bunch of people, and don't have any ulterior motives for using AI besides moving the SLA from humans to AI.

I just tried signing up to instagram recently and they want a selfie with my name and hand in the picture. Yeah, ok there.

I used a fastmail account and also got denied. Perhaps they deny anything not using a domain that's from a big email provider?

I too provided US State issued identification, which still resulted in my account being denied.

I generally think highly of the company, and want to pay them for their services; but they made it impossible for me.

Same thing here, signed up, got randomly flagged, provided all of the required documents and was still rejected with no option of using the service. The first and only time I had an experience like that with a business.

Reply on news.ycombinator.com