Hacker News Reader

Comment by theturtletalks | Hacker News Reader

I was signing up for Hetzner years ago and it asked me to upload my passport to use their service.

At that same time, I was reading about this story about WireCard. It was like Stripe for Europe and worth billions. Turns out it was run by a Russian spy network and was all a sham. That video alleged Germany’s bureaucracy is filled with Russian agents and this can be traced back to the East/West Berlin days.

To save a few bucks a month over DO didn’t seem worth it to me to send my passport to a foreign country.

View on HN

> I was signing up for Hetzner years ago and it asked me to upload my passport to use their service.

I don't really understand what bothers you so much about providing a photo of a "passport" (if you are an European citizen they require a ID card) but credit card info didn't registered as a concern worth noting. Can you explain what is the difference?

Credit card is a largely fixed risk of financial loss, with some legal safeguards for recovery, and the ability to get a replacement card with a different number. Passport carries an open long-term risk of impersonation and you can't just get a new passport because some company has a copy. Just the financial side of that risk can have much greater impact. Unless a company has a legal requirement to "know your customer", e.g. a financial institution, this is a red flag.

> Unless a company has a legal requirement to "know your customer", e.g. a financial institution, this is a red flag.

Germany also has legal KYC requirements for web hosting and most other things relating to telecommunications.

And if those requirements include the need to supply passport information, that's a reason not to host in Germany.

They do.

Couldn’t have put it better myself. Even with payment processors, most they ask for is SSN and business EIN.

When I read about the WireCard scandal, the KYC stuff sent to them over the years is probably in the hands of foreign intelligence already. That’s what gave me pause.

> Credit card is a largely fixed risk of financial loss, (...)

This belief is deeply misguided. Do you understand that credit card transactions are used to provide access to your personal information?

Some companies even employ small token charges as identity verification processes. Payment systems such as MasterCard even explocitly offer identity verification services built around their payment system.

https://www.mastercard.com/global/en/business/cybersecurity-...

But a photo of your id card with your mobile camera is where you draw the line?

If there isn't a difference shouldn't my credit card be enough?

In Germany, Credit Cards are a relatively new development and not that common (especially for business transactions). Instead you usually pay post-facto with direct debit. But that of course requires that you verify your customers ahead of time, which is why processes are built around verifying identity first. (and with web hosting, KYC laws also come into play)

When many sites are collecting these photos, it increases possibility of them leaking. Since these are also used for KYC process in crypto sites etc, this in turn increases risk of identity theft.

I'm a Hetzner user in the US, but I pay for it with PayPal and was never asked to give my passport or identity. Americans are very rarely asked for these documents online, and even then it's typically only for government or financial services. It's also drilled into us that this info can be used for identity theft, so it's only natural to be wary of any non-government entity asking for them.

FWIW, if Hetzner had asked for my passport when I signed up, I would not have given it either.

I actually sent them a picture of my passport, and they still denied my account.

Hetzner was widely recommended and I was more than happy to pay a premium for their supposedly-excellent service, but I guess they didn't want my money.

Oh well. Went with OVH instead, and haven't had any issues since.

Same exact story here, they denied my account despite me sending them everything they requested, no explanation given. Went with OVH and had zero issues.

Yup, I signed last weekend, they asked me for a passport and I deleted the account immediately. Scaleway also asks for ID. I am gonna try OVH next.

I mean it's not great that Hetzner require this but it's a bit of a jump to assume that means they have links to Russian intelligence. This kind of thing is pretty common in Germany; not every private company is captured by Russian intelligence

Yes, no connection to WireCard but reading about that situation made me pause about giving my passport. At that point, I was like I’m trying to save a few bucks a month and risk is not worth it. Now if you’re buying their huge servers and are saving thousands, I can see why someone would do it.

They also don’t ask every person for the passport picture so maybe me using a custom DNS and VPN might’ve triggered something on their end.

If they are spies, they are taking their time to use the data for sure. I run servers with them since 2009 or so. That's 17 years.

I feel like the whole password thing was meant as a protection against SPAM or using servers for nefarious purposes as they know who's really behind every server.

Although, I can also see how real criminals would work around that easily by supplying fake identities. Sounds like one of those "why we can't have nice things". Well, at least the password I gave them 17 years ago has expired since.

It's a legal requirement in Germany exactly so the police can track who bought a spam server or a pirate server etc

I was doing the same here, trying to set up a Hertzner account. Getting away from US companies and buying European and all that. But after I had made the account (and wasting a lot of time on back and forth with their buggy sign-up flow), I got told that I needed to upload a picture of my passport to do anything.

Fuck no. I too decided to stick with DO.

Nice work from DO marketing team! Prices are completely not comparable and Hetzner was fighting scammers and kiddies, because low prices worked like a magnet for those.

Russian spies? WOW, the earth got really flat these days. Seeing what US is doing with citizens and private companies I would love some Russian spy to be interested in exactly mine, boring passport.

I encourage you to read about WireCard. It wasn’t just a normal sham company, it was able to fool auditing firms (one of the big 4) and the executives got away with it and are in Russia hiding. I’m trying to dig up the video also I can link it. There is no connection between WireCard and Hetzner outside of both being German companies.

And they're not just hiding, Jan Marsalek is allegedly actively managing FSB operations against European states.

> It wasn’t just a normal sham company, it was able to fool auditing firms (one of the big 4) and the executives got away with it and are in Russia hiding

I was an early wirecard customer, just using their prepaid debit cards, but I cancelled in 2017 because I didn't even trust them to keep a balance of 30€ safe.

Sorry, but anyone who didn't see that scam coming from 10 miles away was either gambling, complicit, or an idiot.

Look I'm just a dude who happened to land on DO a decade ago due to podcast ads and now wants to move away from it. Not due to prices but because I would prefer a European alternative. I didn't bring up Russian spies and I don't know if there's any validity to that story, I just don't want to upload passport pictures to random services. Their competitors don't require it.

I'll probably find the time and energy to move to OVH or something some time.

DO gave students $100 credit. Then required me to upload my passport, which they rejected. Then required me to pay $5 via PayPal just to verify me. Two weeks later they removed all the credit they had provided, without any warning period. I emailed them and explained that if something was provided without any stated validity period, EU law requires at least 3 years before it can expire. They suggested I delete my account if I don't like it.

After that experience (I've written about it multiple times in the past on HN), I really don't understand why people still defend DO.

That sounds pretty bad.

I don’t “defend DO”, I just use it for now; but as someone whose opinion on DO is at least neutral-to-positive, it is that way because I have never experienced what you did nor even read about similar experiences before. Your experiences don’t automatically impact my opinions without any form of communication.

Time to dust off the Whataboutism Is Bad speech again: but don't glaze over yet, because I might say something new. Not only is it still as rhetorically fallacious as it has ever been to treat complaints about third parties like they are responsive to first order concerns, but also (wake up! here comes the new part!) the deeper problem with whataboutism is that it assumes people can't consistently object to both.

I don't expect this to persuade, to be clear. I don't believe that people engaging in whataboutism are unable to understand why it's wrong so much as they have a different approach to language that detaches it from accountability to any sort of conceptual coherence that people are normally searching for when testing integrity of arguments; commenting on it is more about revealing a difference in which background values inform the way you choose to communicate.

Reply on news.ycombinator.com